6979530 2001-08-26 11:45 +0200  /30 rader/ RoMaN SoFt / LLFB!! <roman@madrid.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-08-26  19:20  av Brevbäraren
Extern mottagare: grange@rt.mipt.ru
Extern kopiemottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <18962>
Ärende: SuSE 7.2 (& others) sendmail local xploit
------------------------------------------------------------

 Hi.

 This is the 'alsou.c' sendmail 8.11.x (x<=5) xploit with some very
slight modifications:
 - extensive documentation and example on how to get this to work on
several distros / sendmail versions 
 - working on default SuSE 7.2 (sendmail 8.11.3):
 - also included working parameters for SuSE 6.4 with *custom
compiled* sendmail 8.11.2:
 - allows to give offset in command line. Use with 'smxploit' script
(also included) in order to find correct offset. This will be
necessary in different distros / sendmail versions
- QUICK GUIDE for finding propper exploitation values (VECT, GOT and
OFFSET):
 ==> CASE A: Non-stripped binary:
 ==> CASE B: Stripped binary (this is the default on several distros):

 Please read complete alsou2.c comment lines for the whole
explanation.

 Regards,

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
    ** RoMaN SoFt / LLFB **  
       roman@madrid.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(6979530) /RoMaN SoFt / LLFB!! <roman@madrid.com>/--
Bilaga (application/octet-stream) i text 6979531
6979531 2001-08-26 11:45 +0200  /14 rader/ RoMaN SoFt / LLFB!! <roman@madrid.com>
Bilagans filnamn: "alsou2.tar.gz"
Importerad: 2001-08-26  19:20  av Brevbäraren
Extern mottagare: grange@rt.mipt.ru
Extern kopiemottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <18963>
Bilaga (text/plain) till text 6979530
Ärende: Bilaga (alsou2.tar.gz) till: SuSE 7.2 (& others) sendmail local xploit
------------------------------------------------------------
‹8jˆ;íisÛÆÕ_Å_ñJÛ)‘ ž¢-5Žc»iÛµäÌd$EÁ±$aƒXHä4éŸîè{{à!ÙI·3Á‰°o÷ÝÇ.(XN½(nÎg1²Ö½ßl»c÷»]ü¶í~¯#¿ŽúÖpÏî·;®ÝëôÚxí´Ývïtf6!™—ÜKùÔKîÄc©ø}^ö÷bÁs×
>%
۱Ѳ[ìïÚn»³´?Zñ;=»sìOÉÄmð·ë `¬N×ô6‰à_6a°/­`Œ¯ÀÀrkÊeà&Ê& ø”Á5K âh<É`ÊÃh^ñDqQZ·	lž±DD×BäS–d¼$Ä1o:‹àí„ß@ÆaÌ2äápÃÓ÷4$’ñb#‘¥\@Ĕ("Š
áFɘÐC6òò8ƒÓüôô-jëb´ëC#5‚ô‚/D–¿÷†ÿ‚4¹ÖϚšv [:zpxàÕh$Xvìvm[=xÂh¡ÄxS&`Š®>1ÁQÄB½ìã Kãfp¢f‰IÓµìîý¥‰DIç!—’μÍP
0⩒¶gu”q$ŧðé,ŠYx°aJ×Øá<˜xɘIÓßGåE	ƒ?Ц“Á¤­òÄÜbÀӔ‰OBâE¢_®)‰M£8â«ÒvA§4®•ê(¥Ò“ß UºUjmß7¶'½ÆüFzژܓKJ¨h)6‰LbYðV0¥Ô}1U€¤ÑLâò4d)­z•Z‚L¯e-#ë&Šcâ1aÂàÁ©.#–’ Ï6fZú·Yú»gOÏðâՙ´Æ«çÏOŸœ@Òz3¹M™‡¬x)åq¼öq–l%?\ØR@³þñö맇o¿þê™t%"'=,å³
ǔÔ*l¯½8g‚¦ÿzЏOàéô×'Cxɓ&
!¥ü(AÝßt¬&<7¢K©Iú\oãЇš'$oš)$…ê¼…6‰Æ¸RlüWÔ-¤“‘‹{,xŽÊINz'kÅ¢2?C+iK ­¥%|¦Ô–år¸@Å™#ô[ð Aîå½<O2¾NTþ
ÈHj
/"Ìr˜xèe—Ùç³]ÄZÙt¶¼Sˆ$jó§í˲Œ/×P°ä½råT3ّìžE³ºV§‹ê$_Þvcãb4Ayn1=ȼŽYžçiÀ¤t.Z·‹r$œãÊÚ›á7ûdiÁ°
˜
 MØe˜¤p–.ÈJÒ,4„"Id5eä4ŠÆ+Lљå¿N,+Ά2c
!´~¯ßE<ö‚èßT”ЃÆÄ—S´ÔTÿÞ¹¾WŽ¨=#³¨9ËòšEHÁ‚ï™hhæy5tߔ_³=üÃËQFÚDÿN‹G0lÖ5­µøþr§ë±M®ºê4L©Þ.òõ;“@Á=7K2Æè:h<^4µS“øuÌøá1úBM6yx›æ3.
OnYý#ƒvÇLî¿óéšá::œˆ©ž¢Q†ëCL2
SŸÇ¢•£(EW¸Asb¼¼…è8ŬNùµuðÐ:hÔèƒþz•z¨ŸáC0Þҕ„ÁÀÊ8\w¡c—ÛÒðٍ÷êÍ'à@óKü¸‹ýф“Jkͦág`uGÝöP³æ9øœ>؃ûH€¾ìùÀé;ÞÀn<dÞܬñƒø8øÁÀ:ÃÂ`Nvosžfá¡£”LD’”s}ß,ÓÙZ@¦-¹®`”±¥žó¶O]5•ÿ©,²¼¡K`u£z%CÌÇfàýŒGÔÅe¤¥JIDŽ2oÍW:»,ø˜‡5r‚
††ˆ|ìÓ?hmcc)½µ”ž¬ü©é8žë¸Åe:`÷o[&”Ë„»–
ƒQ§°Œ}7ÁnnÎI›
î`Pù2ÇòDö])c+婸yÔ¬_ޞ½n«õ5L²GËvD%’utŠN­+kÃÁÒÌzî—+'pÖÜÀ¬-'§˜œœ¦c9úé)î“3Ýb[1ÝHLØâïîár‘ߺÈ7
qŽm1î©9vyµúšµ×¢^,ïá±Èpp8p;¶}b¢ÇmDX`&|~Ø̣縕5ABýxµäå{?åQfz;ÌQÚ©qHó$AMXÏæ‘)BÚû~ÀÒ¾øP~³áÇ?«Ü¥;|F%§¶»xsÕô®þööÛ×W§ß`¿z‚ÆÛ!'6*J<¹À-yÓàë쑲¦Þ³«LwÝrÿé-û%Õ5R»²Ì×®é“ÔØÒm´‘øÿ­•vûn¿mZiñ¹[é[YêþF–ÜOÔÝË¢µxÒ^A,x‚®€
BŠ.eÛ5èÆSèÿ
ÿÖ{yʟgðX¹Gȼl"BÎSýOR:áƺnϲ–kێ9ú5
y„WfCnvèfc†©å©´>iDUçs˜zæôAãqÀ]ņ‘z1‘›•÷FÙ
‡$ŸúØÇ׶
2WÒ˜ÊlqÓ+›i2«÷v§/7ۅJ›bo,缾»ç­æ¬ØÕu›Þ
“DcE€r¼fDåxE
wRžlJ½‡Ö§+ zæÁc…uèÚ.¦üé4ŒŠh~­h¦3¢Þʞ°IòåÁÃr+Ìëá¼w˜‰UÅ¡áÑÑjØéŸ&ŽìÂÄÁŠ

û®3ê¬5ùS‰€†rÌGÒKŠD»vŠRîêF͜AaI¸ÑÃï–tQĺî›ó‚Õ<—Jò;4kAëjÚi鵺¯”gÈZáš™®÷TºlÿÈcwûuj5š03·j‚<
õX±$o;ÿυ²,ކÙýàÎR¼b^óò:å¾çNjb¦˜ÅÞB•U}”šÑ&÷=[f:g_°=å‰È<Œ;uÊՀ›4Ê2–ÈÐSg%!Óûc:z[OgRÍ<Á|þÕ˚=˵àù–½ŽB{•½Ž¦ TF«Ñ‰›~.ub­ò#½B‘9?[̘)F2¢þ}öó+ÊáS#}éƒÃÇêû‹4³¦Ñ,³ÒüD!´*P¹oNþ‹…hÑúšœgaùô¬Ò:X½ùJ÷-[obhYóÎAÛAÖGóLÊ_è:ÍsÕZ­ˆ-_€ÔԐúæ{
/ñtWu@Í% _çqÂRò¦Ïê
úƒ˜D3Q\îÈjÃÍ$
&Ûó¤\­lˆ&»‘Âã¥t¶úlmÈh{í¶P¹k¨pk’un!ißJÒ¹»IºNe©ë—¯^¿|û-®äâÃ`â¡ßNX“ÇŸ_Âqe¯z1o;óÀVß¡1÷ñÚéã³ð³KUâÐ3—™gs†xN÷bÞõižÂ¡5ƒ‹y§}1·qþàHÛºV8r,À{\§£Ç$]—h(Û/ÐÁqÖ»Àüjþ
§%Sͤú¨RɍÕ+„Œ¢çŠ‰ÒVö®®<1½ºªÑ±FL™|&µþ¨òK¥Bèh€¤&WÒqЩž¼¾>¿”+¨l<n€8w»½ËàÞC_x×çmúf×çîå£ÊÞ:'èRÇd•PVÆkõ
(eYCu,
ˆ=úŒúØ…ÙCZˆZS„ëSzÉÔ†;KjKÃÕáÐØõº(Î^4‚šœz/ß~óMù½KSž¢øj•:
¾·ÇpÛUk:týKeOÌRävT“2VŸ½xq,±¦lŠÉ%¡CÝʑÝÐ4i¼0–üàEµ±ò±:
j¤`ܽ`ÍÝÛӯꎱÏâQMªÛ¹¤UY,XE¦’
…GòyeOÓ­êvüax‘Tþꩲ—ÊyKW@æVú5Œc¨6C)«:‹=†¦´SjËb>Â;²ã!Hu‘¹Oâã-fÌ15¤¦Ôá‘þ³ìHՆú)&o>Ì-ü¬n:€´9ð2bÑåMïðÐPԒÑçÉ
´ύ{ԑ]cö/ì}Ô¦ûêvyÆÈ¡a‰.ÔµK×ä=d
=í«îœâàœ׬†þßúg×*¢þ׿ø#ÀæïÌööSÒ ßÿÜõû¯¶³úýOÇí#~×î¸åï>Üÿ“,}¾'&•ûtŽóÁ³€ûàv–g}ÊðÀ©°`¡Z<.zàPýÀÝ:+zЮVT¶;7§"ÐÄ;D½„GòÊ®cs¢ñ#öäérÞ!®öc%ä
+óE
%”PB
%”PB
%”PB
%”PB	%”PB	%”PB	%”PB	%”PB	%”PB	øLöØÝP
(6979531) /RoMaN SoFt / LLFB!! <roman@madrid.com>/(Ombruten)