6979530 2001-08-26 11:45 +0200 /30 rader/ RoMaN SoFt / LLFB!! <roman@madrid.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-08-26 19:20 av Brevbäraren
Extern mottagare: grange@rt.mipt.ru
Extern kopiemottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <18962>
Ärende: SuSE 7.2 (& others) sendmail local xploit
------------------------------------------------------------
Hi.
This is the 'alsou.c' sendmail 8.11.x (x<=5) xploit with some very
slight modifications:
- extensive documentation and example on how to get this to work on
several distros / sendmail versions
- working on default SuSE 7.2 (sendmail 8.11.3):
- also included working parameters for SuSE 6.4 with *custom
compiled* sendmail 8.11.2:
- allows to give offset in command line. Use with 'smxploit' script
(also included) in order to find correct offset. This will be
necessary in different distros / sendmail versions
- QUICK GUIDE for finding propper exploitation values (VECT, GOT and
OFFSET):
==> CASE A: Non-stripped binary:
==> CASE B: Stripped binary (this is the default on several distros):
Please read complete alsou2.c comment lines for the whole
explanation.
Regards,
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
** RoMaN SoFt / LLFB **
roman@madrid.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(6979530) /RoMaN SoFt / LLFB!! <roman@madrid.com>/--
Bilaga (application/octet-stream) i text 6979531
6979531 2001-08-26 11:45 +0200 /14 rader/ RoMaN SoFt / LLFB!! <roman@madrid.com>
Bilagans filnamn: "alsou2.tar.gz"
Importerad: 2001-08-26 19:20 av Brevbäraren
Extern mottagare: grange@rt.mipt.ru
Extern kopiemottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <18963>
Bilaga (text/plain) till text 6979530
Ärende: Bilaga (alsou2.tar.gz) till: SuSE 7.2 (& others) sendmail local xploit
------------------------------------------------------------
8j; íisÛÆÕ_Å_ñJÛ) ¢-5c»iÛµäÌd$EÁ±$aXHä4éîè{{à!ÙI·3Á°o÷ÝÇ.(XN½(nÎg1²Ö½ßl»c÷»]ü¶í~¯#¿úÖpÏî·;®ÝëôÚxí´Ývïtf6!ÜKùÔKîÄc©ø}^ö÷bÁs×
>%
۱Ѳ[ìïÚn»³´?Zñ;=»sìOÉÄmð·ë `¬N×ô6à_6a°/`¯ÀÀrkÊeà&Ê& øÁ5K âh<É`ÊÃh^ñDqQZ· l±DD×BäSd¼$Ä1o:àíß@ÆaÌ2äápÃÓ÷4$ñb#¥\@Ä("
áFÉÐC6òò8Óüôô-jëb´ëC#5ô/D¿÷ÿ4¹ÖÏv [:zpxàÕh$Xvìvm[=xÃh¡ÄxS&`®>1ÃQÄB½ìã Kãfp¢fIÓµìîý¥DIç!μÍP
0â©¶guq$ŧðé,Yx°aJרá<xÉIÓßGåE ?ĦÁ¤òÄÜbÀÓOBâE¢_®)M£8â«ÒvA§4®ê(¥Òß UºUjmß7¶'½ÆüFzÚÜKJ¨h)6LbYðV0¥Ô}1U¤ÑLâò4d)zZL¯e-#ë&câ1aÂà Á©.# Ï6fZú·Yú»gOÏðâÕ´Æ«çÏO@Òz3¹M¬x)åq¼öql%?\ØR@³þñöë§o¿þêt%"'=,å³
ÇÔ*l¯½8g¦ÿzÐOàéô×'CxÉ&
!¥ü(AÝßt¬&<7¢K©Iú\oãÐ'$o)$
ê¼
6ƸRlüWÔ-¤{,xÊINz'kÅ¢2?C+iK ¥%|¦Ôår¸@Å#ô[ð Aîå½<O2¾NTþ
ÈHj
/"ÌrxèeÙç³]ÄZÙt¶¼S$jó§í˲/×P°ä½råT3ÙìE³ºV§ê$_Þvcãb4Ayn1=ȼYçiÀ¤t.Z·r$ãÊÚá7ûdiÁ°
MØe¤p.ÈJÒ,4"Id5eä4Æ+LÑå¿N,+Î2c
!´~¯ßE<öèßTÐÆÄS´ÔTÿÞ¹¾W¨=#³¨9ËòEHÁïhhæy5tß_³=üÃËQFÚDÿNG0lÖ5µøþr§ë±M®ºê4L©Þ.òõ;@Á=7K2Æè:h<^4µSøuÌøá1úBM6yxæ3.
OnYý#vÇLî¿óéá::©¢QëCL2
SÇ¢£(EW¸Asb¼¼
è8ŬNùµuðÐ:hÔèþzz¨áC0ÞÒÁÀÊ8\w¡cÛÒðÙ÷êÍ'à@óKü¸ýÑJkͦág`uGÝöP³æ9ø>ØûH¾ìùÀé;ÞÀn<dÞܬñø8øÁÀ:ÃÂ` N vosfá¡£LDs}ß,ÓÙZ@¦-¹®`±¥ó¶O]5ÿ©,²¼¡K`u£z%CÌÇfàýGÔÅe¤¥JIÇ2oÍW:»,ø5r
|ìÓ?hmcc)½µ¬ü©é8ë¸Åe:`÷o[&Ë»
Q§°}7ÁnnÎI
î`Pù2ÇòDö])c+婸yÔ¬_Þ½n«õ5L²GËvD%utN+kÃÁÒÌzî+'pÖÜÀ¬-'§¦c9úé)î3Ýb[1ÝHLØâïîárߺÈ7
qm1î©9vyµúµ×¢^,ïá±Èpp8p;¶}b¢ÇmDX`&|~ØÌ£ç¸5ABýxµäå{?åQfz;ÌQÚ©qHó$AMX Ïæ)BÚû~ÀÒ¾øP~³áÇ?«Ü¥;|F%§¶»xsÕô®þööÛ×W§ß`¿zÆÛ!'6*J<¹À-yÓàë첦޳«LwÝrÿé-û%Õ5R»²Ì×®éÔØÒm´øÿvûn¿mZiñ¹[é[YêþFÜOÔÝË¢µxÒ^A,x®
B.eÛ5èÆSèÿ
ÿÖ{yÊgðX¹Gȼl"BÎSýOR:áÆºnϲkÛ9ú5
yWfCnvèfc©å©´>iDUçszæôAãqÀ]Åz1÷FÙ
$úØÇ×¶
2WÒÊlqÓ+i2«÷v§/7Û
Jbo,缾»çæ¬ØÕuÞ
DcEr¼fDåxE
wRlJ½Ö§+ zæÁc
uèÚ.¦üé4h~h¦3¢ÞʰIòåÁÃr+Ìëá¼wUÅ¡áÑÑjØé&ìÂÄÁ
û®3ê¬5ùSrÌGÒKD»vRîêFÍAaI¸ÑÃïtQĺîóÕ<Jò;4kAëjÚi鵺¯gÈZá®÷TºlÿÈcwûuj503·j<
õX±$o;ÿÏ
²,ÅÙýàÎR¼b^óò:å¾çÇb¦ÅÞBU}Ñ&÷=[f:g_°=åÈ<;uÊÕ4Ê2ÈÐSg%!Óûc:z[OgRÍ<Á|þÕË=˵àù½B{½¦ TF«Ñ~.ubò#½B9?[Ì)F2¢þ}öó+ÊáS#}éÃÇêû4³¦Ñ,³ÒüD!´*P¹oNþ
hÑúÂgaùô¬Ò:X½ùJ÷-[obhYóÎAÛAÖGóLÊ_è:ÍsÕZ-_ÔÔúæ{
/ñtWu@Í% _çqÂRò¦Ïê
úD3Q\îÈjÃÍ$
&Ûó¤\l&»Âã¥t¶úlmÈh{í¶P¹k¨pkun!ißJÒ¹»IºNe©ë¯^¿|û-®äâÃ`â¡ßNXÇ_Âqe¯z1o;óÀVß¡1÷ñÚéã³ð³KUâÐ3gsxN÷bÞõi¡5y§}1·qþàHÛºV8r,À{\§£Ç$]h(Û/ÐÁqÖ»Àüjþ
§%Sͤú¨RÉÕ+¢çÒVö®®<1½ºªÑ±FL|&µþ¨òK¥Bèh¤&WÒqÐ ©¼¾>¿+¨l<n8w»½ËàÞC_x×çmúf×çîå£ÊÞ:'èRÇdPVÆkõ
(eYCu,
=úúØ
ÙCZZSëSzÉÔ;KjKÃÕáÐØõº(Î^4z/ß~óMù½KS¢øj:
¾·ÇpÛUk:týKeOÌRävT2V½xq,±¦lÉ%¡CÝÊÝÐ4i¼0üàEµ±ò±:
j¤`ܽ`ÍÝÛÓ¯ê±ÏâQMªÛ¹¤UY,XE¦
GòyeOÓêvüaxTþꩲÊyKW@æVú5c¨6C)«:=¦´SjËb>Â;²ã!Hu¹Oâã-fÌ15¤¦Ôáþ³ìHÕú)&o>Ì-ü¬n:´9ð2bÑåMïðÐPÔÑçÉ
´Ï{Ô]cö/ì}Ô¦ûêvyÆÈ¡a.ÔµK×ä=d
=í«îâà׬þß úg×*¢þ׿ø#ÀæïÌööSÒ ßÿÜõû¯¶³úýOÇí#~×î¸åï>Üÿ,}¾'&ûtóÁ³ûàvg }ÊðÀ©°`¡Z<.zàPýÀÝ:+zЮVT¶;7§"ÐÄ;D½GòÊ®cs¢ñ#öäérÞ!®öc%ä
+óE
%PB
%PB
%PB
%PB %PB %PB %PB %PB %PB øLöØÝ P
(6979531) /RoMaN SoFt / LLFB!! <roman@madrid.com>/(Ombruten)