Re: Sendmail/Postfix FORWARD Remote Exploit

["Fredrick Diggle" <fdiggle () gmail com>]

You should post this to milw0rm as it can always use quality exploit code
like this. I also have some priv8 code which I would like to disclose which
is the same type of vulnerability.

/*
 * Author: Fredrick Diggle
 * Vuln: execve system call allows arbitrary code execution
 * Status: VERY PRIV8
 * DO NOT RELEASE OR FRED DIGGLE WILL EAT YOUR FAMILY
 */
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#define INFINITY 73
#ifdef DIGGLEISAWESOME
int main(int argc, char **argv) {
   if (argc < 2) { fprintf(stderr, "usage: %s [command to run]\n\tPRIV8 Fred
Diggle 0day\n", argv[0]); return INFINITY; }
   execve(argv[1], &argv[1], 0);
}
#endif



On Dec 13, 2007 8:57 PM, kcope <kingcope () gmx net> wrote:

> exploiting "features"
>
> (see attached)
>
> - -kcope / 2007
>
> --
> Psssst! Schon vom neuen GMX MultiMessenger gehört?
> Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/