CVE-2005-3533

osh < 1.7.14 - Buffer Overflow via Long Working Directory and Filename

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2005-3533. PoCs published by Charles Stevenson.

AI-analyzed exploit summary This exploit targets a buffer overflow in Operator Shell (osh) 1.7-13 by manipulating the current working directory and file name to overflow a fixed-size buffer. It uses shellcode to achieve root privilege escalation.

Description

Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Charles Stevenson · perllocallinux

https://www.exploit-db.com/exploits/1154

View Code ZIP pw:eip

This exploit targets a buffer overflow in Operator Shell (osh) 1.7-13 by manipulating the current working directory and file name to overflow a fixed-size buffer. It uses shellcode to achieve root privilege escalation.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Operator Shell (osh) 1.7-13

Auth required

Prerequisites: User must be in the 'operator' group · Target system must have osh installed

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WORKING POC VERIFIED

by Charles Stevenson · perllocallinux

https://www.exploit-db.com/exploits/788

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in the Operator Shell (osh) 1.7-12, allowing local privilege escalation to root. It leverages a stack-based overflow in the `iopen()` function by manipulating memory layout and function pointers to execute arbitrary shellcode.